Should organisations prioritise inventory cleanup before the 100-day phase?

Why inventory cleanup belongs before the 100-day phase

Inventory cleanup should happen before the 100-day phase because the work becomes more expensive once renewal dates start closing in. Unknown certificates, stale ownership records, and manual exceptions are easiest to correct while there is still time to discover them, validate their purpose, and reassign responsibility without rushing.

That is especially true for certificate estates with mixed ownership, because the same gap that looks manageable in a relaxed window can become a renewal failure later. A clean inventory is not just bookkeeping, it is the prerequisite for reliable rotation, decommissioning, and exception handling.

When the inventory is incomplete, teams tend to discover problems only when a renewal or outage forces action. At that point, remediation is constrained by short deadlines, cross-team dependency chains, and the risk of breaking systems that no one clearly owns.

What gets harder if cleanup is delayed

Delaying cleanup usually turns a discovery problem into an operational risk problem. Orphaned certificates may still be active in production, but without ownership, asset context, or usage visibility, they are difficult to classify quickly enough for safe renewal or retirement.

The practical failure mode is not usually a single catastrophic event. It is accumulated uncertainty: more manual handoffs, more last-minute approvals, and more reliance on people remembering how a certificate was issued, where it is used, and what breaks if it is changed.

That uncertainty also weakens automation. If the underlying inventory is noisy, automation cannot reliably decide what to renew, what to revoke, what to migrate, and what to leave alone. Cleaning the inventory first improves the quality of every later control decision.

For teams standardising their certificate and identity hygiene, the NHI Lifecycle Management Guide is a useful reference because it ties inventory, ownership, rotation, and offboarding into one operating model. The Top 10 NHI Issues also reinforces why inventory gaps and ownership ambiguity tend to produce the same downstream control failures.

Why the 200-day window is the safest place to fix it

The 200-day phase is valuable because it gives teams room to find unknown certificates, test discovery methods, and correct ownership before shorter deadlines reduce the margin for error. This is the point where cleanup is still a controlled exercise rather than an emergency response.

It is also the right time to remove manual handoffs. Once the estate is known and scoped, teams can decide where automation should issue reminders, where it should renew safely, and where human review must remain in place because the certificate is tied to a fragile or high-impact dependency.

The strongest anchor for this work is a documented lifecycle process. NHIMG’s Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs provides that lifecycle view, while the Key Challenges and Risks section is a useful reminder that visibility gaps and unmanaged credentials are usually the root cause, not the symptom.

Risk and Threat Considerations

When cleanup is deferred, the risk is less about the certificate itself and more about the uncertainty surrounding it. Unknown ownership, stale usage records, and long-lived secrets can hide active exposure until renewal time, when there is little opportunity to investigate safely.

Failure mechanism: Incomplete inventory leaves orphaned or misclassified certificates in place, so renewal, revocation, and replacement decisions are made under time pressure with weak context.

Impact: Teams can miss renewals, break dependent services, or leave unnecessary credentials active for longer than intended, increasing operational and security exposure.

Practitioner Guidance

What to prioritise: Clean up ownership, usage, and expiry data before automating renewal. If you cannot confidently name the owner and business purpose of a certificate, treat it as an inventory exception rather than a routine renewal candidate.

What to verify: Confirm that discovery coverage includes unknown, dormant, and manually issued certificates, not just the assets already known to the platform team. The inventory is only trustworthy when it catches the strays.

Decision rule: If a certificate cannot be mapped to a clear owner, service, and replacement path, fix that mapping first. Renewal without attribution only preserves uncertainty.

Practitioner takeaway: The earlier phase is for finding and classifying, the later phase is for executing. Once deadlines tighten, ambiguity becomes the real risk, so inventory cleanup has to come first.

Related resources from NHI Mgmt Group

• Should organisations prioritise SaaS cleanup before expanding access controls?
• Should organisations prioritise DSPM before IAM cleanup in hybrid environments?
• Should organisations prioritise secrets rotation before access cleanup?
• Should organisations prioritise AI agent access controls before broader NHI cleanup?