Vendorapp › OpenVMO › Vendor inventory
Vendor inventory in OpenVMO.
The register is the backbone of the programme. If a company gets your money, your data or access to your systems, it belongs in one list with the same minimum fields for every entry.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
Every framework you will be audited against starts here: SOC 2 expects you to identify your vendors, ISO 27001 expects an inventory, NIS2 asks for a directory of suppliers and DORA for a register of information. Most startups that fail this do have a list; it is just three lists that disagree.
Vendor inventory is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 5 INV practices.
Single register
One register holds every vendor that receives money, data or access. Evidence: The register itself, with a single agreed location.
Minimum fields
Every entry records at least the fields in the OpenVMO register schema: name, domain, service, owner, lifecycle state, tier, data, access, contract and renewal date. Evidence: A register export with those columns filled in.
Discovery sweep
At least once a year the register is checked against the finance ledger, card spend, single sign-on apps, DNS and email records, and expense tools. Evidence: The date of the sweep, the sources checked and the vendors it added.
Lifecycle state
Each vendor carries a lifecycle state (proposed, active, suspended, offboarding, offboarded), and offboarded vendors are kept, not deleted. Evidence: The state column, with offboarded vendors still present and dated.
Quarterly reconciliation
Every quarter the register is reconciled to spend and to single sign-on, and gaps are fixed. Evidence: Dated reconciliation records listing the differences found and how each was resolved.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | One register with the minimum fields filled in for every vendor. |
| Level 2: Managed | Lifecycle states tracked, offboarded vendors retained, and an annual discovery sweep to find what slipped past. |
| Level 3: Defined | Quarterly reconciliation against spend and single sign-on, so the register and reality never drift far. |
| Level 4: Optimised | Reconciliation is automated from finance and identity systems, and the register can be exported in regulator formats. |
With a spreadsheet
Doing it without any special tool.
- Download the OpenVMO register template (CSV). Its columns are the minimum fields.
- Seed it from the last twelve months of card and bank statements, then your single sign-on app list.
- Never delete a row. Set the lifecycle state to offboarded and record the date and reason.
Common mistakes
Where teams usually go wrong.
- Only listing vendors with a signed contract. Card-paid software with your data in it counts.
- Keeping separate lists in finance, security and legal that never agree.
- Deleting vendors when you stop using them, which loses the record an auditor will ask for.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC9.2 |
| ISO/IEC 27001:2022 | A.5.19, A.5.9 |
| NIS2 and Implementing Regulation 2024/2690 | Art. 21(3); CIR 2024/2690 Annex §5.2 |
| DORA | Art. 28(3); ITS 2024/2956 (register of information) |
| NIST CSF 2.0 | GV.SC-04 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Vendor register (CSV): The register with every OpenVMO minimum field as a column, plus two example rows. Open it in any spreadsheet.
- Register schema (JSON Schema): The same register as a JSON Schema, for tools that want to import or export OpenVMO registers.
All OpenVMO templates are on the templates page.
Previous domain: Governance and ownership. Next domain: Intake and onboarding.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.