Research question
When does vendor access review become a measurable back-office workload?
What the sources establish
CISA's vendor risk guide for small and medium-sized businesses addresses risk created by physical or logical vendor access. NIST Cybersecurity Framework 2.0 treats identity management and access control as cybersecurity outcomes. Applying those sources requires an inventory that connects each vendor, account, system, business owner, and review decision.
Operational analysis
Count active vendor accounts, privileged roles, accounts without a named owner, expired contracts with remaining access, unanswered attestations, and days to closure. Review volume alone is weak evidence unless the team also records exceptions and owner response time.
Staffing boundary
Compliance support can maintain the inventory, request attestations, and route exceptions. System owners must approve access, remove privileges, investigate anomalies, and accept any residual risk.
Conclusion
The useful capacity signal is a recurring exception queue with measured handling time and a named reviewer. Compliance support can maintain the inventory, request attestations, and route exceptions. System owners must approve access, remove privileges, investigate anomalies, and accept any residual risk.