Vendors Inventory and Attributes

The Vendors Inventory is the authoritative enterprise record of every third-party vendor the enterprise engages — every organization from which the enterprise procures technology, services, data, or capabilities. Each Noun Instance in this inventory is a single, uniquely identified Vendor: a governed record capturing who the vendor is, what they provide, how strategically important and operationally critical they are, what risks they introduce, and how they connect to every other element of the enterprise technology and delivery portfolio. The Vendors Inventory is the foundation of the enterprise’s third-party risk management program, vendor governance framework, and vendor-level contribution to the Enterprise Model. Without it, the enterprise cannot systematically assess vendor dependency, manage third-party risk, govern contract renewals, or plan for vendor exit. The Vendors Inventory is a foundational governance artifact for Application Portfolio Management (APM), Technology Portfolio Management (TPM), and the Enterprise Model. APM uses it to connect applications and technologies to the vendors that supply and maintain them — enabling vendor dependency analysis and vendor exit impact assessment at the application level. TPM uses it to govern technology investments by understanding which technologies are sourced from which vendors, enabling vendor concentration analysis and technology portfolio rationalization informed by vendor risk. The Enterprise Model depends on it as the vendor dimension of the enterprise graph — connecting vendors to the applications, technologies, contracts, integrations, and work items they participate in through typed relationships that AI agents can traverse. The Vendors Inventory is also the primary evidence artifact for regulatory frameworks that require documented vendor oversight — including GDPR, HIPAA, PCI DSS, and the EU Digital Operational Resilience Act (DORA). This document is part of the IF4IT Enterprise Inventory Management taxonomy — the master catalog of all Noun Types the enterprise recognizes and tracks. The general principles that govern inventory design, schema definition, data quality standards, federated ownership, lifecycle management, and AI-assisted population apply to this inventory and every other inventory in the enterprise and are addressed in the IF4IT Enterprise Inventory Management Best Practices document. Practitioners should read that document alongside this one. The attribute taxonomy presented in this document is a suggested baseline — not a mandatory schema and not a complete enumeration of every possible attribute. Enterprises are explicitly encouraged to add attributes specific to their context, adapt what is here to their needs, and define what IF4IT has not yet identified.