Abstract

This study asks which records show vendor access to executive systems remains necessary and current. Public evidence frames the governance boundary, while a 30-record local sample supplies descriptive observations. [1] [2] [3]

Methodology

Editors retained source population, purpose, and limits. The design uses 30 records, 2 independent reviewers for ambiguity, stable definitions, and no invented public company rate. Counts, a median, the 90th percentile, unresolved records, and reviewer disagreement remain separate.

Research question and boundary

The question is which records show vendor access to executive systems remains necessary and current. Sending, assigning, approving, and completing are different events; authority and consequence remain explicit.

Government, academic, standards, and local operating records answer different questions and are not combined into false certainty.

Evidence interpretation

Human accounts, service identities, API credentials, mailbox rules, and document shares are different access paths. Reviewers verify purpose and owner without revealing secret material. Last use informs review but does not automatically justify retention. Contract status, incident work, and legal hold remain documented exceptions.

For this executive-support question, the bounded application is to inventory approved access paths and match each to current purpose, owner, scope, last use, decision, and revocation evidence. [1] [2] [3]

Measurement design

Relevant measures include orphaned accounts, excess roles, stale tokens, missing owners, overdue review, failed revocation, and unauthorized persistence. Each requires a denominator, observation window, source system, and interpretation limit.

The study reports missing records, censored observations, exceptions, and known confounders rather than dropping inconvenient cases.

Limitations and decision use

The cited sources do not establish a universal target for which records show vendor access to executive systems remains necessary and current. Sector, role, regulation, consequence, and available backup affect applicability.

A second 30-record sample using the same definitions is required before treating a pattern as stable. The result supports a bounded governance decision, not a causal claim.

Operational implication

Use the measured pattern to inventory approved access paths and match each to current purpose, owner, scope, last use, decision, and revocation evidence. Record the decision owner and the evidence date, then repeat the same definitions in a later review window. The final record should identify the observation that changed the decision, the unresolved uncertainty, the system holding the supporting evidence, and the date when the conclusion expires. Preserve excluded records with reasons so a reviewer can reconstruct the denominator and distinguish a real change from altered data collection.

If the later sample changes direction, revise the interpretation explicitly rather than silently changing a threshold. This keeps the research conclusion traceable to the records that supported it.

Key findings

  • Human accounts, service identities, API credentials, mailbox rules, and document shares are different access paths. Reviewers verify purpose and owner without revealing secret material. Last use informs review but does not automatically justify retention. Contract status, incident work, and legal hold remain documented exceptions.
  • The evidence supports examining orphaned accounts, excess roles, stale tokens, missing owners, overdue review, failed revocation, and unauthorized persistence without collapsing them into one score.
  • Apply the result by choosing whether to inventory approved access paths and match each to current purpose, owner, scope, last use, decision, and revocation evidence.
  • Repeat the defined sample and keep unresolved cases visible.

Sources

  1. Security and Privacy Controls for Information Systems, NIST
  2. Zero Trust Architecture, NIST
  3. Digital Identity Guidelines, NIST
  4. Privacy Framework, NIST
  5. Protecting Personal Information, Federal Trade Commission
  6. Logging Made Easy, UK National Cyber Security Centre
  7. CIS Controls Version 8, Center for Internet Security
  8. OWASP Logging Cheat Sheet, OWASP
  9. OWASP Authentication Cheat Sheet, OWASP
  10. Digital Identity Guidelines: Authentication and Lifecycle Management, NIST
  11. Guide to Computer Security Log Management, NIST
  12. Cybersecurity Framework, NIST
  13. Computer Security Incident Handling Guide, NIST

Return to the Research Content library