Who should attend a quarterly business review?

Why This Matters for Security Teams

A quarterly business review only works when the people in the room can make or influence the decisions being discussed. For NHI security, that usually means the operational owner, the service or application owner, the identity or platform team, security leadership, and anyone accountable for budget or risk acceptance. If the review is missing the people who can approve changes, it becomes a reporting exercise instead of a decision forum.

This matters because NHI issues rarely stay technical. A stale secret, an overprivileged service account, or an unowned API key can affect uptime, compliance, and incident response at the same time. The Ultimate Guide to NHIs shows how often these issues are tied to weak visibility and lifecycle control, while NIST Cybersecurity Framework 2.0 reinforces that governance depends on clear accountability and decision ownership. In practice, many security teams discover that the wrong attendees were invited only after the review produces no action on scope, service expectations, or remediation funding.

How It Works in Practice

The attendee list should reflect the decisions the review is expected to produce. A useful quarterly business review for NHI governance normally includes four roles: the business owner who understands impact, the technical operator who knows the workflow, the security or IAM lead who can assess risk, and the finance or portfolio stakeholder who can approve trade-offs. When the meeting is about third-party integrations, include vendor management or procurement. When the review covers production services, include the platform or SRE owner who can speak to reliability and change windows.

For NHI-specific topics, the discussion should cover secret rotation, orphaned identities, privilege creep, service account ownership, and offboarding. Those topics are easiest to resolve when the owner of the workload and the owner of the control both attend. The Ultimate Guide to NHIs is useful here because it ties governance to lifecycle management, not just inventory. A good agenda usually separates metrics from decisions:

• What changed in the last quarter: new services, new integrations, and retired workloads
• Which NHIs are still unowned or overprivileged
• Which secrets are due for rotation or replacement
• What business risk requires an exception, budget, or timeline change
• Who is accountable for follow-up actions and by when

Security teams should treat attendance as a control design choice, not a calendar preference. If the review cannot trigger ownership changes, approval of remediation work, or acceptance of residual risk, then the meeting is not staffed correctly. These controls tend to break down when the attendee list is built around hierarchy instead of decision authority, because action items then stall in handoffs after the review ends.

Common Variations and Edge Cases

Tighter attendee control often increases coordination overhead, requiring organisations to balance decision quality against scheduling friction. That trade-off is real in large environments, especially when business units, platform teams, and third parties all own different parts of the NHI lifecycle.

Best practice is evolving for complex cases. In a low-risk operational review, a delegate may attend on behalf of a senior owner if that delegate can approve remediation or changes. In a high-risk review, however, current guidance suggests the actual decision-maker should attend, especially when exceptions, funding, or service-level commitments are on the table. For shared platforms, one representative may cover several applications, but only if they can speak to each workload’s access patterns and failure modes.

There is also a difference between a reporting review and a governance review. A reporting review can be lighter, with fewer attendees and more metrics. A governance review needs the people who can accept risk, assign ownership, and commit resources. The key test is simple: if the room cannot change the outcome, the wrong people are present. For organisations building a repeatable operating model, the attendance rule should be documented in the quarterly business review charter and linked to the control expectations in NIST Cybersecurity Framework 2.0.

Related resources from NHI Mgmt Group

• Quarterly Business Review
• How should security teams make NHI best practices usable across the business?
• When should organizations review their NHI policies?
• When should organizations review access controls?