Vendor inventory

Expanded Definition

A vendor inventory is more than a procurement list. In NHI and IAM practice, it is a living governance record of every third party that can touch systems, data, or credentials through human access, service accounts, API keys, certificates, agents, or delegated integrations. Because definitions vary across vendors, the useful boundary is operational: if an external party can create, use, store, rotate, or revoke NIST Cybersecurity Framework 2.0 aligned identities or secrets, it belongs in the inventory.

For NHI Management Group, the inventory should capture access scope, data sensitivity, ownership, contract status, onboarding date, offboarding trigger, and evidence of revocation. That makes it a control surface for lifecycle governance, not a spreadsheet for vendor names. It also connects to the broader NHI lifecycle described in Ultimate Guide to NHIs — The NHI Market, where visibility and offboarding are central to reducing exposure. The most common misapplication is treating the vendor inventory as a static procurement register, which occurs when security teams do not track which third parties still hold active credentials after a contract, pilot, or integration ends.

Examples and Use Cases

Implementing a vendor inventory rigorously often introduces administrative overhead, requiring organisations to weigh faster procurement and integration against the cost of continuous credential and access tracking.

• A SaaS analytics provider receives an API key for ingestion. The inventory records the owning business unit, the dataset accessed, rotation cadence, and the exact condition that triggers revocation if the service is terminated.
• A managed service partner administers a privileged account through PAM. The inventory ties that account to the contract, a named internal owner, and the approval path for JIT elevation and emergency access.
• An AI agent vendor is granted tool access to ticketing and knowledge systems. The inventory identifies the agent, its execution authority, the secrets it can use, and the controls needed if the agent changes behavior or scope.
• A payroll processor exchanges files through an SFTP integration. The inventory documents the certificate, the data classification, and the fallback process if rotation fails or the certificate expires unexpectedly.

These patterns align with the lifecycle, visibility, and offboarding emphasis in Ultimate Guide to NHIs — The NHI Market, while the access-review mindset mirrors the governance intent in NIST Cybersecurity Framework 2.0. In practice, the inventory becomes the place where procurement, IAM, and security agree on who is still entitled to what.

Why It Matters in NHI Security

Vendor relationships are a frequent path for NHI sprawl because credentials are issued quickly and forgotten slowly. That is why a vendor inventory matters most when third-party access becomes the weak link in incident response, offboarding, or audit readiness. NHI Mgmt Group data shows that 92% of organisations expose NHIs to third parties, which means external access is not an edge case; it is part of the attack surface. When that exposure is not inventoried, revocation is delayed, stale secrets remain valid, and owners cannot prove who had access to what.

The risk grows when the organisation cannot connect a vendor to a specific credential, secret store, or revocation trigger. That gap defeats least privilege, slows containment, and makes Zero Trust implementation harder to defend. It also conflicts with the governance direction reflected in the NIST Cybersecurity Framework 2.0 and the lifecycle expectations discussed in Ultimate Guide to NHIs — The NHI Market. Organisations typically encounter credential misuse, surprise vendor persistence, or failed revocation only after a breach or contract dispute, at which point the vendor inventory becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Asset Inventory
• Secrets Inventory
• Why is NHI discovery and inventory the primary goal of NHI security?
• How do I select an NHI security vendor?