Resource import is the process of bringing cloud or application assets into an access management system so they can be governed centrally. A strong import workflow should reduce manual tagging, improve inventory completeness, and help teams onboard assets without disrupting normal operations or losing policy visibility.
Expanded Definition
Resource import is the governed onboarding of cloud and application assets into an access management or identity platform so they can be inventoried, assigned policy, and monitored centrally. In NHI programs, the term usually covers service accounts, APIs, workloads, secrets-bearing systems, and related application resources that need visibility before they can be secured. The concept sits close to asset discovery and registration, but import is the operational step that makes an asset actionable inside governance tooling.
Definitions vary across vendors on whether import means passive discovery, active enrollment, or both. NHI Management Group treats it as the point where a resource becomes manageable for lifecycle controls such as ownership, tagging, rotation, and deprovisioning. That distinction matters because a resource that is merely detected is not yet governed. For a standards-oriented view of governance and control mapping, teams often align the workflow with the NIST Cybersecurity Framework 2.0.
The most common misapplication is treating import as a one-time inventory upload, which occurs when teams skip ownership assignment, policy mapping, and validation of whether the resource is still active.
Examples and Use Cases
Implementing resource import rigorously often introduces upfront classification and verification work, requiring organisations to weigh faster central governance against temporary onboarding friction.
- Importing cloud service accounts into an NHI inventory so each account has an owner, purpose, and rotation policy before it is granted access to production systems.
- Registering application API keys during CI/CD onboarding so secrets can be tracked in a governance platform rather than remaining embedded in build scripts or deployment files.
- Bringing legacy machine identities into a central access management system after discovery, then reconciling them against active usage to remove stale entries.
- Importing SaaS-integrated resources to create a complete list of third-party connections, which helps security teams review which external systems can invoke internal APIs.
- Using a staged import process for high-risk workloads so policy enforcement is validated before credentials are tied to live production traffic.
These workflows are especially important when import supports remediation for exposed secrets and identity abuse, as seen in NHIMG research such as ASP.NET machine keys RCE attack and Gladinet Hard-Coded Keys RCE Exploitation.
Why It Matters in NHI Security
Resource import is foundational because you cannot govern what you cannot see. In NHI environments, incomplete onboarding leads to blind spots in ownership, stale credentials, duplicate identities, and policy gaps across service accounts, API keys, and workload access paths. That is why NHI Management Group emphasizes visibility as a prerequisite to control: only 5.7% of organisations have full visibility into their service accounts, and that shortfall usually begins with weak or inconsistent import processes. When import is done well, teams can connect each resource to rotation, offboarding, and least-privilege enforcement instead of leaving assets outside the control plane.
Import also matters for Zero Trust programs, where asset context must be accurate before access decisions can be trusted. If the imported record is incomplete, the downstream policy engine may enforce the wrong permissions or miss a credential that should have been revoked. The same governance discipline applies to third-party and cross-system resources, which can otherwise persist long after business use has ended. Organistions typically encounter the cost of poor resource import only after an incident review reveals unknown service accounts, at which point the import workflow becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Resource import is the entry point for NHI inventory and ownership control. |
| NIST CSF 2.0 | ID.AM-1 | Asset management requires complete inventories of systems and resources. |
| NIST Zero Trust (SP 800-207) | SC.AC-1 | Zero Trust depends on accurate resource context before access is evaluated. |
| NIST SP 800-63 | Digital identity assurance relies on correctly binding identities to managed resources. |
Import every NHI with verified ownership, purpose, and lifecycle metadata before granting governance.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
