When a vendor in your stack announces a breach, the clock starts on every credential that vendor could have seen. Most MSPs then spend the first hour working out what they hold before they can rotate any of it.
This inventory moves that work to a quiet afternoon. Start with your own tools: RMM, PSA, backup, documentation and password vault, email, cloud and AI services. Then work through each client tenant. For every secret, note where it is stored, what it grants, who rotates it and what has to be updated afterwards.
Rank each one. Priority 1 is anything with admin or global reach, such as RMM, backup and identity, and it must be rotated within an hour. Priority 2 is the same day, and priority 3 is this week.
Then rotate each one once and time it. The Status column marks anything with no owner or with steps nobody has run, and the Summary tab adds up the minutes for your priority 1 list. If that total is more than an hour, split the work across people or shrink the list now, not during an incident.
Keep the finished file in your password vault, not on a shared drive, and review it monthly and after every vendor breach notice.
