Systems and vendor inventory
What this is: Every application: what it does, what data it holds, what it costs, who administers it, contract term, and renewal date.
It assumes: Nothing. This is usually the first thing to build.
Change before use: Nothing structural — fill it in.
Why this is the first document
Almost every technology control depends on a list that most organizations do not have: what systems exist. Access reviews, separation checklists, incident response, budget decisions, and contract negotiations all start from the inventory. It takes an afternoon to build and a few minutes a month to keep, and it routinely pays for the afternoon in the first year by surfacing duplicate tools and forgotten auto-renewals.
The inventory
One row per system or vendor. Include everything that stores organizational data or costs money — including the free tools, which hold data too.
| System / vendor | What it does | Data it holds | Sensitivity | Users | Administrator (person) | Cost / yr | Contract ends | Auto-renews? | Notice to cancel | Last access review |
|---|---|---|---|---|---|---|---|---|---|---|
| ☐ Client/PHI ☐ Personnel ☐ Financial ☐ General | ☐ | |||||||||
Rules
- The administrator is a person, and there are at least two for anything critical. A system whose only administrator has left is locked; a system whose administrator is "IT" is unowned.
- Sensitivity drives everything else. Anything marked Client/PHI or Personnel gets multi-factor authentication, appears on the separation checklist by name, and is in scope for the incident-response plan.
- Record the notice period, not just the renewal date, and calendar the notice date. The renewal date is too late to act on.
- No shared accounts. Where one exists, the inventory names it and the plan to eliminate it. Until eliminated, its password rotates on every separation.
Operating it
- Review monthly at close: new tools added (staff sign up for things), departures processed, upcoming notice dates.
- Run the access recertification from it [quarterly/twice a year]: each administrator confirms the user list against the roster and records the confirmation.
- Bring the cost column to budget season. The inventory is where duplicate tools and zombie subscriptions become visible.
Free to adapt and use. No registration, no fee, no attribution required. This is a working template, not legal, tax, or accounting advice — the requirements that apply to your organization are confirmed by your own counsel, auditor, and licensing authority.