Art.8 Identification

Financial entities identify, classify and document their business functions that rely on ICT, the related roles and responsibilities, the information and ICT assets behind them and their dependencies, reviewing that classification at least yearly; they identify sources of ICT risk continuously (including risk flowing to and from other financial entities), assess cyber threats and vulnerabilities, review risk scenarios at least yearly, map critical assets, configurations and interdependencies, document processes that depend on ICT third-party providers, and keep inventories updated after every major change. Two duties apply only to entities other than microenterprises: a risk assessment on each major change to network and information systems or to the processes behind ICT-supported functions (Art. 8(3)), and an ICT risk assessment of legacy systems at least yearly and before and after connecting new technologies or systems (Art. 8(7)). Applied in proportion to size, risk profile and complexity under Article 4(1). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.

Source: DORA (Regulation (EU) 2022/2554), Art.8. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.