An NHI management platform is only as good as the estate it can see, and a platform with stale connectors and blank owner fields will report a calm picture of a risky estate. This health check gives you thirteen quarterly metrics, each with a formula, a data source type and thresholds, to test whether your non-human identity platform is actually discovering, classifying, attributing and acting on the service accounts, API keys, tokens, certificates and workload identities you run. It is written for the NHI or identity engineering team that operates the platform and the security lead who relies on its numbers. It measures the tool, not the programme: outcomes across the whole estate, such as rotation and incident trends, belong in the NHI Programme Health Check.
What this health check covers
The scope is the NHI management platform itself: the discovery connectors it runs against cloud accounts, identity providers, SaaS tenants, CI/CD systems, secrets stores, directories and container clusters; the inventory it builds; the ownership, policy and risk data it holds; the remediation actions it triggers; and the platform's own administrators, credentials and audit trail. It applies whether the capability is a dedicated NHI security product, a module of a wider identity suite or an in-house inventory assembled from exports. For how to deploy and configure the platform see the NHI management platform rollout playbook; for how discovery works across environments see NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments.
The review is run by the platform owner in the NHI or identity engineering team and approved by the head of identity or a security delegate. Every metric here asks a question about the platform's trustworthiness as a source of truth: does it cover every place NHIs live, is its data current, can it attribute what it finds, and does it act when it should? A programme can only be as mature as the evidence underneath it, so read these results alongside the dimensions in the NHI Governance Maturity Model rather than as a replacement for it.
Key takeaways
- Coverage comes first. Every other number is meaningless for sources the platform does not connect to, so measure connected sources against an independent list of accounts, tenants and clusters.
- A connector that fails silently is worse than none. Track sync success and record age, because stale data looks exactly like clean data on a dashboard.
- Unclassified records are hidden risk. An identity the platform cannot type, attribute or link to a credential cannot be governed by any policy you write.
- The platform is a privileged NHI itself. Its connector credentials read across your whole estate, so hold them to a higher standard than the identities they inventory.
- Measure actions, not alerts. A healthy platform closes the loop: findings triaged in SLA and automated remediation that succeeds.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this NHI management platform health check at the cadence set out below. Collect each figure from the data source types described, score it against the green, amber and red bands, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare quarter on quarter: a falling coverage figure after a cloud migration or acquisition matters as much as any single score. Replace bracketed placeholders such as [Organisation] and [Name, role] with your own values.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Full thirteen-metric health check | Quarterly | NHI platform owner | Head of identity or CISO delegate | Metric workbook, source register, connector status export, findings log |
| Connector health and inventory freshness (NHMP-02, NHMP-03) | Weekly | NHI or identity engineering | NHI platform owner | Connector sync history, record age report |
| Source coverage reconciliation (NHMP-01) | Monthly and whenever a cloud account, tenant, cluster or acquired estate is added | NHI platform owner | Cloud and platform engineering lead | Independent source list, reconciliation diff |
| Platform administrator and connector credential review (NHMP-11, NHMP-12) | Quarterly | Identity security lead | Head of identity | Admin role export, connector credential register with scopes and ages |
| Ad hoc rerun | After an NHI incident, a platform upgrade that changes connectors, or an acquisition | NHI platform owner | CISO delegate | Same as quarterly |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. Bands are contiguous: a value sits in exactly one band. State the measurement date and any excluded sources in the workbook.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| NHMP-01 | Connected source coverage | In-scope identity sources (cloud accounts and subscriptions, identity provider tenants, SaaS tenants, CI/CD organisations, secrets stores, directories, clusters) with an enabled connector / in-scope sources on an independent register | Platform source list compared with cloud organisation account list, CMDB and SaaS register | 95% or above | 85% to below 95% | Below 85% |
| NHMP-02 | Connector sync success | Enabled connectors whose last full sync in the past 24 hours completed without error / enabled connectors | Platform connector status and job history | 98% or above | 90% to below 98% | Below 90% |
| NHMP-03 | Inventory freshness | NHI records refreshed from their source within the last 7 days / total active NHI records | Inventory export with last-seen and last-synced timestamps | 95% or above | 85% to below 95% | Below 85% |
| NHMP-04 | Unclassified identity records | NHI records with no identity type (service account, API key, token, certificate, workload identity, agent) assigned / total active NHI records | Inventory export with classification field | 2% or below | Above 2% to 10% | Above 10% |
| NHMP-05 | Credential-to-identity linkage | Discovered credentials (keys, secrets, tokens, certificates) linked in the platform to the identity they authenticate / total discovered credentials | Platform credential inventory and relationship data | 90% or above | 75% to below 90% | Below 75% |
| NHMP-06 | Owner recorded in the platform | Active NHI records with an owner field set to a named person or team / total active NHI records | Inventory export with owner attribute | 90% or above | 70% to below 90% | Below 70% |
| NHMP-07 | Owner sync latency | Leaver and team change events from the HR or directory feed reflected in platform owner records within 24 hours / such events in the quarter | HR leaver feed and directory change events joined to platform owner change history | 98% or above | 90% to below 98% | Below 90% |
| NHMP-08 | Credential metadata completeness | Credential records with creation date, expiry (or "no expiry" flag) and last-used date all populated / total credential records | Platform credential inventory | 90% or above | 75% to below 90% | Below 75% |
| NHMP-09 | Policy evaluation coverage | Active NHI records evaluated by at least one enabled posture or detection policy in the last 7 days / total active NHI records | Platform policy engine evaluation log | 95% or above | 80% to below 95% | Below 80% |
| NHMP-10 | High-severity findings triaged in SLA | Critical and high platform findings acknowledged and assigned within the SLA in the quarter / critical and high findings raised in the quarter | Platform finding history, ticketing system | 90% or above | 70% to below 90% | Below 70% |
| NHMP-11 | Automated action success | Platform-initiated actions (rotation requests, disable or revoke actions, owner notifications, ticket creation) that completed successfully / platform-initiated actions in the quarter | Platform workflow or integration execution log | 95% or above | 85% to below 95% | Below 85% |
| NHMP-12 | Connector credential hygiene | Connector credentials that are read-only scoped (or scoped only to the actions the platform is approved to take) and either federated or rotated within 90 days / total connector credentials | Connector credential register, source-side permission export | 100% | 90% to below 100% | Below 90% |
| NHMP-13 | Platform administration and audit trail | Platform administrator accounts that sign in through corporate SSO with phishing-resistant MFA and are on the approved admin list, counted only when the platform audit log reached the SIEM for every day of the quarter / total platform administrator accounts | Platform role export, identity provider assignment export, SIEM ingestion report | 100% | 90% to below 100% | Below 90%, or any day with no audit log delivered |
Read NHMP-01 to NHMP-03 together: high coverage with low freshness means the platform knows where to look but is looking at last month. Read NHMP-06 with NHMP-07: an owner field filled with a departed engineer's name passes NHMP-06, and only a prompt feed (NHMP-07) stops the platform carrying that stale name for weeks. Whether owners are confirmed and orphans removed is a programme outcome, measured in the NHI programme health check, not here. NHMP-12 matters because connector credentials often hold broad read access to identity and secrets metadata across every cloud and SaaS tenant; misuse of them maps to MITRE ATT&CK T1078.004 Cloud Accounts and T1528 Steal Application Access Token.
How to collect the data
- Independent source register (NHMP-01): build the denominator from systems the platform does not control: the cloud organisation's account and subscription list, the identity provider tenant list, the SaaS register, the CI/CD organisation list and the CMDB. A platform measured against its own source list will always score 100%.
- Connector status export (NHMP-02): take the connector job history for the last 24 hours and the last 30 days. Record partial syncs as failures; a connector that returns some records and errors on others gives a misleading inventory.
- Inventory export (NHMP-03 to NHMP-09): export every active NHI record with type, source, owner, linked credentials, last-synced and last-used timestamps, and the policies evaluated against it. Use the same export for all seven metrics so the denominators agree.
- HR and directory feed (NHMP-07): compare the timestamp of each leaver or team change event in the HR or directory feed with the time the platform updated the matching owner records.
- Finding and workflow history (NHMP-10, NHMP-11): pull the quarter's findings with severity, raised, acknowledged and closed times, and the execution log of every automated action with its result. Count an action as successful only when the target system confirms it, not when the platform sends the request.
- Platform security data (NHMP-12, NHMP-13): list every connector credential with its source-side permissions and age, the platform's role assignments, the identity provider assignment for the platform application, and the SIEM's daily ingestion count for the platform audit log.
Run collection with a read-only reporting role and record its permissions in the workbook. Any source that could not be exported is itself a finding against NHMP-01, not a gap to skip. For reconciling platform data against other inventories, see NHI Inventory Reconciliation.
Red flags that need action now
- A production cloud account, identity provider tenant or CI/CD organisation with no connector at all.
- A connector that has not completed a sync in more than seven days while the dashboard still shows its identities as current.
- Connector credentials with write or administrative rights the platform does not need, or a static connector key older than a year.
- Platform administrators signing in with local accounts that bypass SSO and MFA.
- Gaps in the platform audit log reaching the SIEM, especially around administrator or policy changes.
- Owner fields defaulted in bulk to a single team mailbox or to the person who ran the import.
- Automated revoke or rotation actions reported as successful that the target system shows never happened.
- Policies disabled or set to report-only without a recorded approver and expiry date.
Where a red flag suggests the platform or its connector credentials may be misused, switch to If your NHI management platform is compromised.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-NHMP-01 | [Number] in-scope sources with no connector | NHMP-01 | [Critical / High / Medium / Low] | [Name, role] | [YYYY-MM-DD] | [Open / In progress / Closed / Risk accepted] |
| HC-NHMP-02 | [Number] connector credentials with excess scope or older than 90 days | NHMP-12 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-NHMP-03 | [Number] leaver events not reflected in owner records within 24 hours | NHMP-07 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-NHMP-04 | [Finding] | [NHMP-nn] | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
Suggested severity: red on NHMP-01, NHMP-12 or NHMP-13 is critical with a 30-day due date; other reds are high at 60 days; ambers are medium at 90 days. Carry open rows forward with their original due date so slippage stays visible.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| Missing sources and failing connectors (NHMP-01, NHMP-02, NHMP-03) | NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments; NHI management platform rollout playbook |
| Unclassified records and unlinked credentials (NHMP-04, NHMP-05, NHMP-08) | NHI Inventory Reconciliation; Machine Identity Naming and Tagging Standard Template |
| Missing or invalid owners (NHMP-06, NHMP-07) | NHI Ownership Guide; NHI Ownership Attestation Campaigns Guide |
| Policy gaps and slow triage (NHMP-09, NHMP-10) | Detection Engineering for Non-Human Identities Guide; NHI Risk Scoring Guide |
| Failed automated actions (NHMP-11) | NHI lifecycle automation |
| Connector credentials and platform administration (NHMP-12, NHMP-13) | OWASP NHI Top 10 NHI5 Overprivileged NHI Guide; OWASP NHI Top 10 NHI7 Long-Lived Secrets Guide |
Framework mapping
| Metric | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | OWASP NHI Top 10 2025 |
|---|---|---|---|
| NHMP-01 to NHMP-05 | CM-8 System Component Inventory; IA-4 Identifier Management | ID.AM-02; PR.AA-01 | NHI1 Improper Offboarding |
| NHMP-06, NHMP-07 | AC-2 Account Management | PR.AA-01 | NHI1 Improper Offboarding |
| NHMP-08 | IA-5 Authenticator Management | PR.AA-01 | NHI7 Long-Lived Secrets |
| NHMP-09, NHMP-10 | AU-6 Audit Record Review, Analysis, and Reporting | DE.CM-09 | NHI2 Secret Leakage |
| NHMP-11 | AC-2(3) Disable Accounts | PR.AA-01 | NHI1 Improper Offboarding |
| NHMP-12 | AC-6 Least Privilege; IA-5 Authenticator Management | PR.AA-05 | NHI5 Overprivileged NHI |
| NHMP-13 | AC-2 Account Management; AU-2 Event Logging | PR.AA-05; GV.OV-03 | NHI10 Human Use of NHI |
In CIS Controls v8.1 the metrics sit mainly in Control 5 (Account Management), Control 6 (Access Control Management) and Control 8 (Audit Log Management).
Related guides
- NHI Programme Health Check: the outcome measures across the estate that this platform check feeds.
- NHI Governance Maturity Model: the five levels these platform metrics provide evidence for.
- NHI Programme Metrics: rolling platform data into programme reporting.
- If your NHI management platform is compromised: response when the platform itself is the incident.
- NHI Security Platform Buyer's Guide: if the health check shows the capability you have cannot meet these measures.
References
- OWASP: Non-Human Identities Top 10 2025
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls Version 8.1
- MITRE ATT&CK: Cloud Accounts
- MITRE ATT&CK: Steal Application Access Token
Related NHI Mgmt Group resources: Non-Human Identity (NHI) Guide, NHI Dormancy Detection, Secrets manager health check, Workload identity platform health check.