# NHI Security Diagnostic Checklist

Review the management of API keys, tokens and service accounts used by services and workloads with ten questions.

## How to use

Answer yes or no to each question. Review the next step for each no and assign an owner.

## 1. Does secret scanning run automatically across all Git repositories?

- [ ] Yes
- [ ] No

**Next step:** Use a scanner for default branches and pull requests, and check its coverage.

## 2. Are CI/CD secrets managed in a dedicated secret store?

- [ ] Yes
- [ ] No

**Next step:** Identify hardcoded secrets in code and configuration and move them to a dedicated store.

## 3. Do you inventory service accounts and API keys, including creation, ownership and expiry?

- [ ] Yes
- [ ] No

**Next step:** Collect credential inventories from your main cloud and SaaS services and record their owners.

## 4. Do you enforce expiry and rotation policies for NHI credentials and verify execution?

- [ ] Yes
- [ ] No

**Next step:** Identify keys without expiry and review rotation policies and whether rotations actually happen.

## 5. Do you continuously monitor credentials exposed outside your organization?

- [ ] Yes
- [ ] No

**Next step:** Review monitoring coverage for external exposure surfaces such as public repositories.

## 6. Do you track NHI creation, use and revocation?

- [ ] Yes
- [ ] No

**Next step:** Include NHI revocation checks in offboarding and retain creator and owner audit logs.

## 7. Do you scan credentials included in dependencies and the software supply chain?

- [ ] Yes
- [ ] No

**Next step:** Review the coverage of dependency checks and secret scanning.

## 8. Do Kubernetes and cloud workloads use short-lived credentials instead of long-lived static keys?

- [ ] Yes
- [ ] No

**Next step:** Identify long-lived keys injected into workloads and review a migration to workload identity.

## 9. Does CI/CD use OIDC federation to authenticate to cloud providers?

- [ ] Yes
- [ ] No

**Next step:** Identify long-lived cloud keys in pipelines and plan the scope of a migration to OIDC authentication.

## 10. Do you document and rehearse a credential-exposure response playbook?

- [ ] Yes
- [ ] No

**Next step:** Document revocation owners, procedures and impact assessment, and rehearse the response.

## Use your results

Turn each no into a review item. Check exposed credentials, keys without owners and services without revocation procedures, then agree on remediation priorities with your team.

[Request a Cremit demo](https://www.cremit.io/demo)