SORF Project

Template

Vendor and Service Inventory

The Vendor and Service Inventory is a template for documenting the vendors, services, subscriptions, tools, platforms, providers, and outside relationships an organization depends on.

Small organizations often use many services without having one clear list. A domain may be registered in one place, the website may be hosted somewhere else, email may be managed by another provider, payments may run through a separate platform, and receipts may go to a single person’s inbox.

This template helps make those dependencies visible.

Purpose

The purpose of this template is to help an organization understand:

The template is meant to support practical operational clarity. It is not a formal vendor risk management system.

Who this template is for

This template is designed for:

Larger organizations may adapt it, but they may need more formal contract review, procurement, security review, compliance review, or vendor risk management processes.

Start by listing the services that would create confusion if they stopped working, renewed unexpectedly, became inaccessible, or needed to be explained to someone else.

Good first entries include:

Do not try to document every minor tool on the first pass. Begin with the services that matter most.

Template fields

The Vendor and Service Inventory may include the following fields.

Vendor or service name

Record the name of the vendor, platform, tool, provider, contractor, or service.

Examples:

Use the name people recognize.

Category

Record the type of service.

Examples:

Categories make the inventory easier to sort and review.

Purpose

Describe why the organization uses the vendor or service.

Examples:

The purpose should be understandable to someone who does not already know the service.

Importance level

Record how important the service is.

Suggested values:

Critical services may affect revenue, website availability, communications, legal administration, payment processing, customer access, payroll, records, or continuity.

Responsible owner

Record the person, role, team, or outside provider responsible for the vendor relationship.

Examples:

Where possible, use both a role and current person.

Contact path

Record how the vendor is contacted.

Examples:

Do not store passwords, recovery codes, or sensitive support evidence in this field.

Billing owner

Record who receives invoices, receipts, renewal notices, or billing messages.

Examples:

This field is useful when billing notices go to one person’s inbox.

Billing or renewal cycle

Record the billing or renewal pattern.

Examples:

If the service renews annually, add the renewal month or date if it is useful and safe to record.

Approximate cost

Record the approximate cost, if useful.

Examples:

This is not meant to replace accounting records. It is for awareness.

Payment method reference

Record a safe payment reference.

Examples:

Do not record full payment card numbers, bank login details, or sensitive payment credentials.

Record the matching access reference, if applicable.

Examples:

This helps connect vendor records to access documentation without storing secrets.

Record related documentation.

Examples:

Use safe references only.

Status

Record whether the vendor is active.

Suggested values:

Cancelled vendors may still need to be retained for reference.

Last reviewed

Record the date the vendor record was last checked.

Review frequency

Record how often the record should be reviewed.

Examples:

Notes

Use notes for neutral, non-sensitive context.

Examples:

Do not use notes for passwords, API keys, payment card details, confidential contracts, or sensitive incident evidence.

Minimum version

A very small organization can begin with these fields:

Field Purpose
Vendor/service Name of the provider, tool, platform, or relationship
Category Type of service
Purpose Why the organization uses it
Importance Critical, important, useful, optional, or unknown
Owner Person or role responsible
Billing/renewal Billing cycle or renewal awareness
Access reference Where access is documented safely
Status Active, trial, cancelled, archived, or unknown
Last reviewed Date last checked

This minimum version is enough to create visibility.

Example entry

Field Example
Vendor/service Website hosting provider
Category Hosting
Purpose Hosts the public website
Importance Critical
Owner Website maintainer
Contact path Support portal
Billing owner Finance owner
Billing cycle Monthly
Approximate cost $20/month
Payment reference Paid through business card
Access reference “Website Hosting Admin”
Related records Access reference, continuity notes
Status Active
Last reviewed 2026-07-08
Review frequency Quarterly

Importance levels

Use importance levels to decide what should be reviewed first.

Critical

A critical vendor supports essential operations, revenue, communications, records, customer access, legal administration, payroll, or continuity.

Examples:

Critical services should usually have an owner, access reference, billing awareness, and review routine.

Important

An important vendor supports meaningful work but may not immediately stop operations if unavailable.

Examples:

Important services should still be reviewed periodically.

Useful

A useful vendor helps the organization but is not essential.

Examples:

Useful vendors may be reviewed less often.

Optional

An optional vendor may no longer be needed or may be temporary.

Examples:

Optional vendors should be reviewed before renewal.

Unknown

Unknown means no one is sure how important the service is.

Unknown should be treated as a review signal.

When to update this template

Update the Vendor and Service Inventory when:

What not to include

Do not include:

If sensitive documents must be preserved, store them in an approved secure location and reference them safely.

Suggested first pass

A useful first pass may take less than an hour.

Start with these questions:

  1. What services keep the website, email, payments, or records running?
  2. Who owns each service?
  3. Which services renew soon?
  4. Which services are critical?
  5. Where is access documented safely?
  6. Which services are unknown or no longer needed?

The goal is not perfection. The goal is visibility.

This template supports the Vendor Inventory standard.

It also connects to:

License

This template is intended to be provided as a free public resource.

Unless otherwise stated on the project license page, the standards and templates are made available for use, adaptation, and sharing under the project’s open content license.

The project name, logo, and official identity are not included in the template license.

Download template

This template is provided as a free public resource. Review the guidance on this page before using it, especially the notes about sensitive information.

Download Vendor and Service Inventory

Status: Draft · Version: 0.1 · Last updated: 7/8/2026

Do not record passwords, API keys, MFA recovery codes, private keys, seed phrases, payment card data, confidential customer records, or other sensitive values in general templates.