Vendors Inventory and Attributes on International Foundation for Information Technology (IF4IT)

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

About This Inventory

The Vendors Inventory governs every third-party vendor the enterprise engages — every organization from which the enterprise procures technology products, software licenses, subscriptions, cloud services, professional services, managed services, staffing, data, or any other capability. Each Noun Instance is a single, uniquely identified Vendor with its own Semantic ID, its own legal and commercial identity, its own tier classification, its own risk profile, and its full set of governance attributes. The inventory is the enterprise’s single source of truth for the answer to the question: who are our vendors, what do they provide, how critical are they, and what risks do they introduce?

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The following terms are used throughout this document with specific meanings.


Term	Definition
Vendor	A third-party organization from which the enterprise procures technology, services, data, or capabilities under a formal or informal engagement. A Vendor is a distinct legal entity with its own governance obligations, risk profile, and contractual relationship with the enterprise.
Vendor Tier	A strategic classification of a vendor’s importance to the enterprise: Tier 1 (Critical), Tier 2 (Important), Tier 3 (Standard), Tier 4 (Commodity). Drives the depth of governance oversight, frequency of review, and intensity of risk monitoring applied to each vendor.
Dependency Level	An operational assessment of how critically the enterprise depends on a vendor — what would happen to enterprise operations if the vendor were lost or significantly degraded tomorrow. Distinct from Vendor Tier, which is a strategic designation.
Substitutability	A measure of how easily a vendor could be replaced if the relationship ended — accounting for market alternatives, switching costs, and transition timeline. A key indicator of vendor leverage and concentration risk.
Fourth-Party Risk	The risk introduced by a vendor’s own subcontractors, cloud providers, and service dependencies — the vendor’s vendors. Fourth-party failures can disrupt enterprise services through the vendor without the vendor itself being the direct cause.
Data Processing Agreement	A contractual agreement (DPA) between the enterprise and a vendor that processes personal data on the enterprise’s behalf, governing how that data is handled. Required under GDPR and many other privacy regulations.
Business Associate Agreement	A contractual agreement (BAA) between the enterprise and a vendor that handles Protected Health Information (PHI) on the enterprise’s behalf. Required under HIPAA.
Concentration Risk	The risk that the enterprise is disproportionately dependent on a single vendor or a small group of vendors in the same category — such that the loss or failure of one vendor would have an outsized impact on enterprise operations or spend.
ESG Risk	Environmental, Social, and Governance risk in a vendor relationship — covering labor practices, ethical sourcing, carbon impact, diversity standards, and governance transparency. Increasingly required in enterprise vendor assessments by investors, regulators, and customers.
Offboarding Plan	A documented plan for the orderly termination of a vendor relationship — covering access revocation, data return or destruction, financial closeout, compliance handoff, and transition of dependent services. Should exist before it is needed for every significant vendor.
Vendor Lifecycle	The end-to-end stages of a vendor relationship: Selection and Due Diligence, Onboarding, Active Management and Review, Renewal or Renegotiation, and Offboarding. The Vendors Inventory governs vendor entities across all lifecycle stages.
DORA	The EU Digital Operational Resilience Act — a regulatory framework effective 2025 that requires financial institutions to document, assess, and continuously monitor their third-party vendor dependencies, with specific requirements for critical third-party providers.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Vendors Inventory governs every third-party organization from which the enterprise procures technology, services, data, or capabilities under a governed relationship. A Vendor qualifies for a record when it represents a distinct legal entity with which the enterprise has or has had a formal or material commercial engagement — a contract, a purchase order, a subscription, a statement of work, or a recurring service arrangement. Every entry is a Noun Instance of the Vendor Noun Type with its own Semantic ID, its own tier classification, its own risk profile, and its own Enterprise Relationship Owner.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Application Portfolio Management (APM) depends on this inventory to understand vendor dependency at the application level. Without the Vendors Inventory, APM cannot answer: which applications are sourced from vendors that are financially distressed? Which rationalization candidates are supplied by vendors with high Dependency Level and low Substitutability? What is the application-level impact of exiting a specific vendor relationship? These questions determine whether a portfolio rationalization decision is feasible and at what cost — and they cannot be answered without connecting applications to their supplying vendors.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Vendors Inventory has its most direct relationship with the Applications Inventory and Attributes. Applications are supplied, licensed, or maintained by vendors. The Applications Inventory is authoritative for Application records; the Vendors Inventory is authoritative for Vendor records. The connecting relationship is the Vendor attribute on Application records, which references Vendor Semantic IDs. The Related Applications relationship attribute in this inventory is derived from those Application records. The Applications Inventory and Attributes is published and available.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Vendors Inventory is one of 38 recognized Noun Types in the IF4IT Enterprise Inventory Management taxonomy. The full taxonomy, its governance principles, and the Inventory of Inventories are documented in the IF4IT Enterprise Inventory Management Best Practices document.

The six most closely related Noun Types to Vendor, with their named relationships: (1) Application — an Application is supplied, licensed, or maintained by a Vendor; the Applications Inventory and Attributes is published. (2) Software Technology — a Software Technology is supplied or licensed by a Vendor; the Software Technologies Inventory is not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document. (3) Hardware Technology — a Hardware Technology is supplied or leased by a Vendor; the Hardware Technologies Inventory is not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document. (4) Contract and Agreement — one or more Contracts and Agreements govern every Vendor relationship; the Contracts and Agreements Inventory is not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document. (5) Integration — Integrations may connect systems supplied by a Vendor as source or target entities; the Integrations Inventory and Attributes is published. (6) Work — Work records reference Vendors engaged as delivery partners; the Work Inventory is not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Section A — Sourcing and Harvesting

Before building the Vendors Inventory from scratch, assess whether vendor records already exist in any form in the enterprise. Common sources include: procurement systems and ERP vendor master data (the most comprehensive source of active vendor legal names, payment terms, and spend data); accounts payable and spend analysis systems (reveal all vendors the enterprise has paid, including shadow vendors not captured in formal procurement); contract management systems (identify all vendors with executed contracts); and security and risk assessment tools (identify vendors that have completed security questionnaires or risk assessments). Harvesting from these sources and deduplicating across them produces a comprehensive vendor list faster than manual assembly.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

What Is a Vendor in This Inventory

A Vendor in this inventory is any third-party organization from which the enterprise procures technology products, software licenses, cloud services, professional services, managed services, staffing, data, or any other capability under a commercial engagement. The defining characteristic is the procurement relationship: a Vendor is an external organization the enterprise pays for something. Partners, customers, and internal organizations are distinct Noun Types governed by their own inventories — though some organizations may appear in multiple inventories if the enterprise has both a vendor and a partner relationship with the same entity.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Descriptive attributes capture the core identity of each Vendor Noun Instance — what the vendor is called legally and commercially, and what it provides to the enterprise.

Attribute Name

Maturity

Description and Notes

Semantic ID

Crawl

Description — A unique, permanent, human-readable identifier assigned to every Vendor following the enterprise naming convention.

Benefit(s) — Enables unambiguous cross-inventory referencing — Applications, Technologies, Contracts, Integrations, and Work records all reference Vendors by Semantic ID. Enables AI-assisted cross-inventory traversal without ambiguity.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Classification attributes position each Vendor within the enterprise vendor taxonomy — the type of services they provide, their strategic tier, and the industry they operate in.

Attribute Name

Maturity

Description and Notes

Vendor Type

Crawl

Description — The primary category of what this vendor provides to the enterprise.

Benefit(s) — Enables portfolio-level vendor analysis by type. Reveals the enterprise’s vendor mix — how many SaaS providers vs. professional services firms vs. managed service providers — and informs vendor governance model design.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Ownership and Stakeholder attributes establish the accountability structure for each Vendor relationship — who owns the relationship internally and who manages it externally at the vendor.

Attribute Name

Maturity

Description and Notes

Enterprise Relationship Owner

Crawl

Description — The named individual or role within the enterprise who is accountable for managing this vendor relationship end-to-end — from active governance through contract renewal and offboarding.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Lifecycle and Status attributes track the current governance state of each Vendor relationship and govern the key dates and plans associated with its lifecycle — from activation through offboarding.

Attribute Name

Maturity

Description and Notes

Relationship Status

Crawl

Description — The current governance state of this vendor relationship.

Benefit(s) — Enables the inventory to distinguish active vendor relationships from those in evaluation, under performance review, suspended, or terminated. Without Relationship Status, a vendor registry cannot be used for active governance.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Governance attributes document the review cadence, governing bodies, and oversight processes that govern each Vendor relationship.

Attribute Name

Maturity

Description and Notes

Review Cadence

Walk

Description — How often this vendor relationship is formally reviewed — including performance assessment, risk reassessment, contract compliance review, and strategic alignment check.

Benefit(s) — Ensures governance attention is proportional to vendor importance and risk. Tier 1 vendors warrant quarterly reviews; Tier 4 vendors can be reviewed annually.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Strategic attributes capture the enterprise’s assessment of each Vendor’s importance beyond operational dependency — the strategic value the vendor provides to the enterprise’s ability to innovate and compete.

Attribute Name

Maturity

Description and Notes

Strategic Importance

Walk

Description — The assessed strategic importance of this vendor relationship to the enterprise’s ability to operate, innovate, and compete — beyond the operational dependency captured in Dependency Level.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Assessment and Health attributes capture the evaluated operational performance of each Vendor relationship over time.

Attribute Name

Maturity

Description and Notes

Performance Score

Run

Description — A calculated composite score representing overall vendor performance across delivery, quality, and SLA adherence over the most recent review period.

Benefit(s) — Enables portfolio-level vendor performance comparison and trend analysis. Identifies underperforming vendors before SLA breaches reach contractual penalty thresholds.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Technical attributes capture the technology characteristics of the vendor’s products and services relevant to the enterprise engagement.

The IF4IT has not yet identified standard attributes in this category for the Vendors Inventory. This does not mean no such attributes exist — organizations building this inventory are encouraged to identify and define attributes in this category that are relevant to their specific context and governance needs.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Operational attributes capture the support model, SLA commitments, escalation paths, and offboarding readiness that govern day-to-day vendor relationship management.

Attribute Name

Maturity

Description and Notes

Support Model

Walk

Description — The support coverage model offered by this vendor for the enterprise’s engagement.

Benefit(s) — Ensures business continuity planning accounts for support coverage gaps. A Mission-Critical vendor with Business Hours support in a single time zone has a material coverage gap for global operations.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Security attributes capture the security certifications and assessment history that govern the vendor’s security posture and the enterprise’s ongoing security due diligence obligations.

Attribute Name

Maturity

Description and Notes

Security Certifications

[Multi-Value]

Walk

Description — The current, valid security and compliance certifications held by this vendor.

Benefit(s) — Provides objective third-party validation of the vendor’s security posture. Certifications are the primary evidence artifact for vendor security governance in regulatory frameworks including GDPR, HIPAA, and DORA.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Data and Information attributes capture the legal agreements governing how this vendor handles enterprise data — the DPA and BAA status that determines regulatory compliance for personal and health data processing.

Attribute Name

Maturity

Description and Notes

Data Processing Agreement

Walk

Description — Whether a Data Processing Agreement (DPA) is in place with this vendor. Required under GDPR and many other privacy regulations when a vendor processes personal data on behalf of the enterprise as a data processor.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Geographic and Jurisdictional attributes capture where this vendor operates, where it processes enterprise data, and the geopolitical risk profile of its operating jurisdictions.

Attribute Name

Maturity

Description and Notes

Headquarters Jurisdiction

Crawl

Description — The country and state or province where this vendor is legally domiciled — the jurisdiction of incorporation or registration.

Benefit(s) — Governs which legal system applies to contract disputes and which data protection laws the vendor is subject to as a data processor. A vendor domiciled in the EU is directly subject to GDPR as a processor regardless of where the enterprise is located.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Temporal and Effective Date attributes capture validity windows for time-bounded vendor relationship characteristics.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Contractual and Legal attributes capture the governing contract terms — the primary contract reference, expiration date, auto-renewal provisions, and termination notice requirements.

Attribute Name

Maturity

Description and Notes

Primary Contract Reference

Walk

Description — The Semantic ID of the primary governing contract record in the Contracts and Agreements Inventory — the master agreement, framework agreement, or primary statement of work governing this vendor relationship.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Vendor and Supplier attributes capture information about the vendor’s own supply chain and third-party dependencies relevant to the enterprise engagement.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

IT Environment attributes capture the operating environments in which this vendor’s systems or services are deployed within the enterprise.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Skills and Competencies attributes capture the skills and competencies required within the enterprise to effectively manage and govern this vendor relationship.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Provenance and Audit attributes capture metadata about the Vendor record itself — how it was created, when it was last updated, and the reliability of its content.

Attribute Name

Maturity

Description and Notes

Record Created Date

Walk

Description — The date on which this Vendor record was first created in the inventory.

Benefit(s) — Supports audit and compliance reporting.

Source — Manual.

Examples — 2024-03-15, 2023-11-01

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Risk attributes capture the comprehensive risk profile of each Vendor relationship — operational dependency, substitutability, financial health, fourth-party exposure, ESG risk, geopolitical risk, and the specific factors driving the overall risk rating.

Attribute Name

Maturity

Description and Notes

Assessed Risk

Crawl

Description — The overall risk rating for this vendor relationship — the combined assessment of likelihood and impact of vendor failure, data breach, service disruption, or compliance violation.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Compliance and Regulatory attributes capture the overall compliance status of the vendor relationship with enterprise vendor governance requirements.

Attribute Name

Maturity

Description and Notes

Compliance Status

Walk

Description — The overall compliance status of this vendor relationship with respect to enterprise vendor governance requirements — including security certifications, DPA/BAA status, SLA performance, and contract compliance.

Benefit(s) — Enables a compliance dashboard at the vendor level — surfacing which vendor relationships have open governance gaps requiring remediation.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Financial attributes capture the cost profile of each Vendor relationship — total spend, spend category, and payment terms.

Attribute Name

Maturity

Description and Notes

Annual Spend

Walk

Description — The total annual spend with this vendor across all contracts, licenses, subscriptions, and engagements.

Benefit(s) — The primary financial metric for vendor portfolio analysis. Enables identification of spend concentration, rationalization candidates, and negotiation leverage opportunities. A vendor with high Annual Spend and low Strategic Importance is a rationalization target.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Relationship attributes connect each Vendor to the related Noun Instances in other inventories that they supply, support, or participate in — forming the vendor dimension of the Enterprise Model graph.

Every attribute in this category is Derived from records in other inventories. No manual data entry is required for any attribute in this category once the connected inventories are published and the cross-inventory linkage is established. Do not create data entry fields for any attribute listed here.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Applications are among the most significant things vendors supply to the enterprise. The Applications Inventory and Attributes is published and available. The connecting relationship is the Vendor attribute on Application records, which references the Vendor Semantic ID for the vendor that supplies, licenses, or maintains each application. The Vendors Inventory reflects this relationship in the Related Applications attribute, which is derived from the Applications Inventory.

When this relationship is well-governed, APM can answer vendor-level application dependency questions with precision: which applications would be affected if we exited this vendor relationship? Which vendors supply applications with no viable alternative? Which application rationalization candidates are supplied by vendors already under exit planning? These questions determine the feasibility and cost of portfolio decisions before commitments are made.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Software Technologies and Hardware Technologies are supplied, licensed, or leased by vendors. The Software Technologies Inventory and Hardware Technologies Inventory are not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document for their current definitions in the Noun Type taxonomy. When published, both will carry a Vendor attribute referencing the supplying vendor’s Semantic ID, and the Vendors Inventory will reflect these relationships in the Related Software Technologies and Related Hardware Technologies attributes.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Every vendor relationship is governed by one or more contracts. The Contracts and Agreements Inventory is not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document. When published, every Contract and Agreement record will reference the Vendor Semantic ID of the vendor party. The Vendors Inventory references the primary governing contract through the Primary Contract Reference attribute and all associated contracts through the Related Contracts relationship attribute.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Integrations connect enterprise systems — and many of those systems are supplied by vendors. The Integrations Inventory and Attributes is published and available. The connection between the Vendors Inventory and the Integrations Inventory is indirect: an integration connects a source entity to a target entity, and those entities may be systems supplied by specific vendors. The Related Integrations attribute in the Vendors Inventory is derived by identifying all integration records where the source or target entity is a system supplied by this vendor.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

Work records — initiatives, projects, and programs — frequently engage vendors as delivery partners. The Work Inventory is not yet published — refer to the IF4IT Enterprise Inventory Management Best Practices document for its current definition in the Noun Type taxonomy. When published, Work records will reference Vendor Semantic IDs for vendors engaged as participants or delivery resources, and the Vendors Inventory will reflect these relationships in the Related Work attribute.

Vendors Inventory and Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Vendors Inventory and Attributes document is one of many Noun Type inventories in the IF4IT Enterprise Inventory Management taxonomy. Each inventory in the taxonomy governs a distinct class of enterprise asset, relationship, or organizational construct — and each contributes its records and relationships to the Enterprise Model that connects them all. The full catalog of recognized Noun Types, the principles that govern inventory design and federation, the Inventory of Inventories, and guidance for building, connecting, and maturing a complete enterprise inventory program are documented in the IF4IT Enterprise Inventory Management Best Practices document. Practitioners who find value in the Vendors Inventory are encouraged to explore the broader taxonomy — each additional inventory that is built and governed strengthens the Enterprise Model and expands the range of questions that AI-assisted enterprise analysis can answer. The IF4IT welcomes contributions from practitioners who develop attribute categories, attribute definitions, or governance approaches not covered in this document — your real-world experience is how this framework matures.