Separation of Vendors Management and the Software List

Currently, the software we use has to be maintained as part of the Vendor Management functionality. In my view, this is not factually correct and makes working with SECFIX unnecessarily complicated and less user-friendly than it needs to be.

There are several reasons why the software list should be separated from Vendors:

1. Software is an asset
   Software represents a supporting information asset in the context of ISO 27001. Therefore, it would be logical and appropriate to maintain the software inventory as part of the Assets section. Currently, this is not possible, as software has to be maintained within the Vendor Management as per the templates and our contact at Secfix.

2. Software information is not accessible to non-admin users
   Users without administrator permissions cannot access the Vendor Management section. They only see the “My Task” page. As a result, the software inventory maintained there is not visible to our regular users within the platform. This forces us to maintain a second software inventory outside of SECFIX, which defeats the purpose of having a centralized inventory within the platform. At the moment, it is actually easier for us not to use SECFIX for managing our software inventory at all. The current approach makes the process unnecessarily complicated and requires us to maintain the software inventory outside of SECFIX.

Suggested solution:
Provide a dedicated Software / Software Assets section within the Assets area. This inventory should be accessible to users according to their assigned permissions and should be managed independently from Vendor Management.

Vendor Management should remain focused on vendors and their associated risks, assessments, contracts, and security requirements, while the software inventory should be maintained as an independent asset inventory.