Most non-human identity (NHI) programmes can say how many service accounts, API keys and workload identities they have found, but far fewer can show whether those identities are owned, rotated, right-sized and retired on time across the whole estate. This health check is a recurring scorecard for an NHI programme that is already running. It gives twelve KPIs with formulas and thresholds, a sign-off cadence, a findings log and a remediation map. It is for NHI programme leads, IAM and PAM owners, platform engineering leads and the CISO who reports identity risk to the board, and it answers the question of how to audit non-human identities as a programme rather than as a tool.
The NHI Programme Roadmap tells you what to build and in what order; this page tells you, every quarter, whether it is working. It measures outcomes across all platforms (cloud, SaaS, CI/CD, directories and on-premises), so it complements rather than repeats the NHI Governance Maturity Model, which places you on a five-level scale but does not set thresholds.
What this health check covers
The scope is every non-human identity your organisation is accountable for: service accounts in directories and databases, cloud IAM roles and service principals, workload identities, API keys and personal access tokens, OAuth applications and integrations, certificates used for authentication, and AI agents acting with their own credentials. The KPIs measure ownership, credential hygiene, privilege, lifecycle and response across that whole population.
- Who runs it: the NHI programme lead collects the data with platform owners; internal audit or the second line samples the evidence; the CISO signs off.
- What it is not: a review of your NHI security platform. Whether discovery connectors work, how fresh the tool's inventory is and how the platform itself is secured belong to a platform review; see Securing the NHI management platform. This page measures what the programme achieves with whatever tools you use, including spreadsheets.
- Typical questions it answers: "what NHI programme KPIs should we report", "what share of our machine identities are orphaned" and "is our NHI governance improving quarter on quarter".
Key takeaways
- Test the inventory from outside. Inventory coverage is measured against NHIs found by independent evidence (incidents, audits, secrets scanning, cloud bills), not against what the inventory already contains.
- An owner must be a current person who has confirmed. Owner assignment counts only owners who are still employed and have attested in the last cycle; everything else is orphaned.
- Static secrets are the trend line that matters. Track the share of NHIs authenticating with long-lived static secrets and the share moved to federation or short-lived credentials every quarter; a flat or rising static share is a finding even inside the amber band.
- Lifecycle is measured in days. Dormant NHI rate and decommission latency show whether retirement happens, not just whether a policy says it should.
- Include NHIs in access reviews and incident metrics. If NHIs are excluded from certification campaigns and from incident reporting, the programme cannot show it reduces risk.
How to use this template
Copy the KPI table and the findings log into your own tracker, then run this NHI governance health check at the cadence below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Report per platform first (each cloud provider, each major SaaS tenant, CI/CD, directory) and then roll up, so a strong platform does not hide a weak one. Keep each completed review, because the quarter-on-quarter trend is what the board needs. Replace bracketed placeholders such as [Organisation] and [Role] with your own names.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Rotation and credential age report | Monthly | NHI programme team | NHI programme lead | Rotation job results, credentials over policy age by platform |
| Owner attestation campaign | Quarterly, rolling by platform | NHI owners | NHI programme lead | Attestation decisions, reassignments, NHIs disabled for no response |
| Full KPI review (this page) | Quarterly | NHI programme lead | CISO | KPI table, extracts, sample workpapers, findings log |
| Independent inventory sample | Quarterly | Internal audit or security assurance | Audit committee or CISO | Sample list, sources used, match results |
| Board or risk committee summary | Twice a year | CISO | Risk committee | Headline KPIs, trend, top risks and exceptions |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "In-scope NHI" means a non-human identity with at least one valid credential or active role on a platform in programme scope. "Policy age" means the maximum credential age set in your NHI or secrets policy for that credential type.
| ID | KPI | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| NHIP-01 | Inventory coverage | NHIs in an independent sample (from secrets scanning hits, incident and audit findings, cloud and SaaS admin exports) already recorded in the inventory of record with type and platform ÷ NHIs in the sample (minimum 50 per quarter) | Inventory of record, independent sample workpaper | 95% or above | 85% to below 95% | Below 85% |
| NHIP-02 | Owner assignment rate | In-scope NHIs whose owner is a current employee or active team and confirmed ownership in the last attestation cycle ÷ in-scope NHIs | Inventory of record, HR directory, attestation records | 95% or above | 80% to below 95% | Below 80% |
| NHIP-03 | Orphaned NHI rate | In-scope NHIs with no owner, an owner who has left, or an owning team that no longer exists ÷ in-scope NHIs | Inventory of record joined to HR and team directory | Below 2% | 2% to 10% | Above 10% |
| NHIP-04 | Credential age over policy | Static credentials (passwords, API keys, access keys, tokens) older than their policy age ÷ static credentials in scope | Credential metadata from directories, cloud IAM, SaaS admin and secrets stores | Below 5% | 5% to 15% | Above 15% |
| NHIP-05 | Rotation success rate | Scheduled rotations completed without manual intervention or service outage ÷ scheduled rotations in the period | Rotation job logs, change and incident records | 98% or above | 90% to below 98% | Below 90% |
| NHIP-06 | Static secret share | In-scope NHIs that authenticate with a long-lived static secret ÷ in-scope NHIs | Inventory of record with authentication method | Below 30% | 30% to 60% | Above 60% |
| NHIP-07 | Over-privileged NHI share | In-scope NHIs holding administrative, wildcard or owner-level permissions, or permissions unused for 90 days, without an approved exception ÷ in-scope NHIs | Cloud IAM and entitlement analysis, directory group membership, SaaS role exports | Below 5% | 5% to 15% | Above 15% |
| NHIP-08 | Dormant NHI rate | In-scope NHIs with a valid credential and no successful authentication or API activity in 90 days ÷ in-scope NHIs | Directory last logon data, cloud and SaaS audit logs, key last-used data | Below 5% | 5% to 15% | Above 15% |
| NHIP-09 | Decommission latency | Median days from the trigger (application retired, owner confirms not needed, or 90 days dormant) to all credentials revoked and the identity disabled | Change tickets, decommission records, credential revocation timestamps | Under 14 days | 14 to 45 days | Over 45 days |
| NHIP-10 | NHI in access reviews | Privileged and production NHIs included in a completed access review or certification in the last 12 months ÷ privileged and production NHIs | Certification campaign records, inventory of record | 95% or above | 75% to below 95% | Below 75% |
| NHIP-11 | Federation adoption share | Workloads on platforms that support workload identity federation or platform-issued short-lived credentials that use them ÷ workloads on those platforms | Cloud IAM configuration, CI/CD pipeline configuration, inventory of record | 80% or above | 50% to below 80% | Below 50% |
| NHIP-12 | NHI incident MTTR | Median hours from detection of an NHI credential exposure or misuse to the credential being revoked or rotated and the affected services restored, across incidents in the last two quarters | Incident records, credential revocation timestamps | Under 4 hours | 4 to 24 hours | Over 24 hours, or not measured |
Why these KPIs and how they map to risk
The KPIs follow the risks in the OWASP Non-Human Identities Top 10 2025 and the account and authenticator controls in NIST SP 800-53 Rev. 5, so each result can be traced to a recognised risk or control.
| KPI | OWASP NHI Top 10 2025 risk | NIST SP 800-53 Rev. 5 |
|---|---|---|
| NHIP-01 Inventory coverage | Supports all ten | CM-8 System Component Inventory, IA-4 Identifier Management |
| NHIP-02, NHIP-03 Ownership | NHI1 Improper Offboarding | AC-2 Account Management |
| NHIP-04, NHIP-05, NHIP-06 Credentials | NHI7 Long-Lived Secrets, NHI2 Secret Leakage | IA-5 Authenticator Management |
| NHIP-07 Privilege | NHI5 Overprivileged NHI | AC-6 Least Privilege, AC-6(7) Review of User Privileges |
| NHIP-08, NHIP-09 Lifecycle | NHI1 Improper Offboarding | AC-2(3) Disable Accounts |
| NHIP-10 Access reviews | NHI5 Overprivileged NHI, NHI9 NHI Reuse | AC-2 Account Management, AC-6(7) |
| NHIP-11 Federation | NHI4 Insecure Authentication, NHI7 Long-Lived Secrets | IA-9 Service Identification and Authentication |
| NHIP-12 Incident MTTR | NHI2 Secret Leakage | IR-4 Incident Handling |
How to collect the data
- Fix the population. Agree the in-scope platforms and the inventory of record for the quarter. Record the in-scope NHI count per platform; every percentage uses it as the denominator, so it must not move during the review.
- Build the independent sample for NHIP-01. Take NHIs from sources the inventory did not produce: secrets scanning findings, identities named in incidents and audit findings, cloud and SaaS admin console exports pulled directly by an assurer, and credentials referenced in CI/CD configuration. Check each one against the inventory. NHI Inventory Reconciliation describes the matching.
- Join owners to HR. Join the owner field to the HR and team directory at the review date and to the latest attestation results. Leavers, dissolved teams and non-responses count against NHIP-02 and towards NHIP-03. See NHI Ownership Attestation Campaigns Guide.
- Pull credential metadata. From directories, cloud IAM, SaaS admin exports and secrets stores, record creation date, last rotation date and authentication method for each credential. This feeds NHIP-04 and NHIP-06.
- Read rotation logs. Count scheduled rotations, failures and rotations that needed manual fixes or caused an incident for NHIP-05.
- Measure privilege and activity. Use entitlement analysis and audit logs to find administrative and wildcard permissions, unused permissions and NHIs with no activity in 90 days (NHIP-07, NHIP-08). NHI Dormancy Detection covers the activity signals per platform.
- Time decommissions and incidents. From change and incident records, take the trigger date and the revocation timestamp for each retired NHI and each NHI credential incident (NHIP-09, NHIP-12). The NHI incident metrics page defines incident categories in more depth.
- Check certification scope and federation. Compare certification campaign populations with privileged and production NHIs (NHIP-10), and count workloads using federation or platform-issued short-lived credentials (NHIP-11).
Red flags that need action now
- A privileged NHI (domain admin, cloud organisation admin, CI/CD admin) with no current owner.
- Static cloud access keys or personal access tokens older than one year on production systems.
- An NHI credential found in a public repository, paste site or ticket that has not been revoked.
- Service accounts used interactively by people (OWASP NHI10 Human Use of NHI), or one credential shared across many workloads or environments.
- Rotation jobs failing silently for more than one cycle.
- NHIs excluded by design from access certification campaigns.
- Third-party integrations holding broad OAuth scopes with no owner on your side.
- No measured time for revoking an exposed NHI credential, or no NHI incident category at all.
Findings log
| ID | Finding | KPI | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-NHIP-01 | [Description, population and figure, e.g. 340 of 4,100 cloud NHIs are orphaned] | NHIP-03 | [Critical / High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-NHIP-02 | [Description] | NHIP-04 | [Severity] | [Role] | [Date] | [Status] |
| HC-NHIP-03 | [Description] | [KPI ID] | [Severity] | [Role] | [Date] | [Status] |
Suggested due dates: red flags within 7 days, red KPIs within 30 days for a remediation plan and 90 days for measurable improvement, amber KPIs by the next quarterly review. Risk acceptance needs the NHI programme lead's and the platform owner's signatures and an expiry date.
Remediation map
| Finding type | Where to fix it |
|---|---|
| Inventory gaps (NHIP-01) | NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments and NHI Inventory Reconciliation |
| Ownership and orphans (NHIP-02, NHIP-03) | NHI Ownership Guide and How to assign owners to orphaned service accounts |
| Credential age, rotation and static secrets (NHIP-04 to NHIP-06) | Secrets Rotation Runbook Template and Secrets Management Guide |
| Over-privilege and access reviews (NHIP-07, NHIP-10) | Least Privilege Techniques Guide and Access Reviews Guide |
| Dormancy and decommissioning (NHIP-08, NHIP-09) | NHI Offboarding and Decommissioning Guide and NHI lifecycle automation |
| Federation adoption (NHIP-11) | Workload Identity Federation Guide |
| Incident response time (NHIP-12) | Workload Identity Compromise Response Playbook and NHI incident metrics |
Related guides
- NHI Programme Roadmap: the build plan this scorecard measures.
- NHI Governance Maturity Model: the five-level model these KPIs give evidence for.
- Identity Security Metrics Guide: identity metrics beyond NHIs for a combined dashboard.
- NHI programme cost model: for linking KPI improvement to budget.
- Non-Human Identity (NHI) Guide: the overview for new stakeholders.
References
- OWASP: Non-Human Identities Top 10 2025
- NIST: SP 800-53 Rev. 5 (AC-2 Account Management, AC-2(3) Disable Accounts, AC-6 Least Privilege, IA-4 Identifier Management, IA-5 Authenticator Management, IA-9 Service Identification and Authentication, CM-8 System Component Inventory, IR-4 Incident Handling)
- NIST: Cybersecurity Framework 2.0 (PR.AA-01 identities and credentials for services managed, PR.AA-05 access permissions, GV.RR-02 roles and responsibilities, GV.OV-03 risk management performance reviewed)
- CIS: Critical Security Controls v8.1 (Control 5 Account Management, Control 6 Access Control Management)
Related NHI Mgmt Group resources: NHI Programme Roadmap, NHI Governance Maturity Model, NHI Risk Scoring Guide, Service Account Security Guide.