Compliance

DORA: Article 8 requires a complete ICT asset register.

The Digital Operational Resilience Act has applied directly in all EU member states since January 17, 2025. Around 22,000 financial entities are affected, roughly 3,600 of them in Germany. LOGINventory provides the technical inventory layer that all further DORA obligations build on.

Discovery call (15 min)

last_check: 09:47:12

ICT asset	Function	Criticality	Third party
SRV-CORE-DB-01	Production	Critical	.
SAAS-PAYMENT-PSP	Production	Critical	Stripe Inc.
SRV-RECON-02	Production	Important	.
VM-DEV-TEST-04	Development	Standard	.
SAAS-MAILSEC	Support	Important	Mimecast

What you get

What Article 8 requires. Documented straight from the inventory.

Asset register

Art. 8(1), (4), (5).

Agentless discovery of Windows, Linux, macOS, network devices, VMs, and cloud instances. 1,117 data points per asset. Including configuration, connections, and installed software.

Classification & criticality

Art. 8(4).

Custom properties for “Critical / Non-Critical” per the DORA definition. The built-in “FunctionalRole” property (Production / HotStandby / Development / Testing) as a starting point.

Third-party vendors. Tech layer

Art. 8(6).

Software inventory with vendor, name, version, platform. The “Microsoft Deployment Summary” and “Windows Server Environment Details” reports as a starting basis. Contract layer handled separately.

How it works

Article 8 is the foundation. Not just one obligation among many.

Anyone who doesn’t know their ICT landscape can’t report on anything else.

Article 8 of the DORA regulation requires identifying and classifying all ICT assets that support business functions, including their roles and dependencies. With appropriate documentation. Configuration and connections must be captured, third-party dependencies documented. The inventory must be updated regularly and whenever a material change occurs. The minimum review happens annually.

Anyone who doesn’t satisfy Article 8 also can’t correctly classify incidents (Art. 18) or reliably report third-party dependencies (Art. 28). LOGINventory provides the technical layer: hardware, software, and configuration data, agentlessly and updated daily. You keep the contract and risk layer for third parties on top of that in your GRC system.

Article 50 obliges member states to impose effective, proportionate, and dissuasive sanctions. BaFin fines can reach up to €5 million. Or, if higher, 10% of annual revenue.

DORA chapters at a glance

The regulation’s chapters. Where we deliver, and where we don’t.

II / ICT risk management

Articles 5–16. Asset identification, classification, ongoing documentation. Article 8 as the operational core.

→ Inventory layer via LOGINventory

III / Incident management

Articles 17–23. DORA’s own reporting timelines: initial notification · 72h intermediate report · final report after investigation. Requires a dedicated IRS.

○ External solution required

IV / Resilience testing

Articles 24–27. Vulnerability assessments, network security testing, gap analyses. TLPT (Art. 26–27) only for significant entities.

○ Specialized security testing

V / Third-party risk

Articles 28–44. Full register of information including contracts, SLAs, and exit clauses under EBA ITS. Critical ICT third-party providers fall under direct oversight.

◐ Tech layer yes · Contract layer no

+ / Vulnerabilities (optional)

Cyber Insight integration from V2025.2: daily CVE matching on servers in Germany. Separate contract, server location Germany.

Build your ICT asset register before BaFin asks.

Choose whatever fits your week. Every path is no-obligation.

Whitepaper

DORA Art. 8 for IT managers.

What Article 8 requires, what you need to provide, what LOGINventory contributes.

Discovery call

15 minutes. With a technician.

We’ll go over your ICT asset register requirements together and see whether LOGINventory fits.

Schedule a time →

Trial license

30 days. Full feature set.

Full network size, all modules, no credit card. Setup in under 30 minutes.

Request trial license →