DORA-Art7-P1

ICT Asset Inventory Register COMMON

Structured register of all ICT assets including hardware, software, network components, and data assets, with classification, ownership, and dependency information as required by DORA Article 7.

Formats: CSV JSON
Evidence Class: ict-asset-inventory
Availability: COMMON
Update Frequency: quarterly
Typical Author: IT Asset Manager
Approval Chain: IT Asset Manager → CIO

Content Sections

Expected Fields

Common Quality Issues

Incomplete coverage of shadow IT assets
Stale entries for decommissioned assets
Missing dependency mappings between assets
Inconsistent classification taxonomy

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

CSV — Inline Preview

asset_id,asset_name,asset_type,classification,criticality,owner,department,location,vendor,dependencies,last_updated,status
AST-HW-001,Core Banking Server Cluster,Hardware,Confidential,Critical,Lars Eriksson,IT Infrastructure,Zurich DC-1,Dell Technologies,"AST-SW-001,AST-NW-001",2025-01-08,Active
AST-HW-002,Payment Processing Appliance,Hardware,Confidential,Critical,Lars Eriksson,IT Infrastructure,Zurich DC-1,IBM,"AST-SW-003,AST-NW-001",2025-01-08,Active
AST-HW-003,Database Server Cluster,Hardware,Confidential,Critical,Lars Eriksson,IT Infrastructure,Zurich DC-1,Oracle,"AST-SW-002,AST-NW-001",2025-01-08,Active
AST-HW-004,Disaster Recovery Server Cluster,Hardware,Confidential,Critical,Lars Eriksson,IT Infrastructure,Geneva DC-2,Dell Technologies,"AST-SW-001,AST-NW-002",2025-01-08,Active
AST-HW-005,Network Firewall Pair,Hardware,Internal,Critical,Marta Novak,Network Operations,Zurich DC-1,Palo Alto Networks,AST-NW-001,2025-01-08,Active
AST-HW-006,Employee Workstations (1247 units),Hardware,Internal,Standard,Henrik Dahl,End User Computing,Multiple Offices,Lenovo,AST-SW-010,2024-12-15,Active
AST-HW-007,ATM Fleet (89 units),Hardware,Confidential,Important,Annika Berglund,Retail Banking,Nationwide,NCR Corporation,"AST-SW-004,AST-NW-003",2024-12-20,Active
AST-SW-001,Temenos T24 Core Banking System,Software,Confidential,Critical,Johan Lindberg,Core Banking,Zurich DC-1,Temenos AG,"AST-HW-001,AST-HW-003",2025-01-10,Active
AST-SW-002,Oracle Database 19c Enterprise,Software,Confidential,Critical,Lars Eriksson,IT Infrastructure,Zurich DC-1,Oracle Corporation,"AST-HW-003",2025-01-10,Active
AST-SW-003,SWIFT Alliance Gateway,Software,Strictly Confidential,Critical,Petra Hoffman,Payment Services,Zurich DC-1,SWIFT,"AST-HW-002,AST-NW-001",2025-01-10,Active
AST-SW-004,ATM Management Platform,Software,Confidential,Important,Annika Berglund,Retail Banking,Zurich DC-1,NCR Corporation,"AST-HW-007,AST-NW-003",2024-12-20,Active
AST-SW-005,Internet Banking Portal,Software,Confidential,Critical,Thomas Andersen,Digital Banking,AWS eu-central-1,Internal Development,"AST-SW-001,AST-CL-001",2025-01-12,Active
AST-SW-006,Mobile Banking Application,Software,Confidential,Critical,Thomas Andersen,Digital Banking,AWS eu-central-1,Internal Development,"AST-SW-001,AST-CL-001",2025-01-12,Active
AST-SW-007,Anti-Money Laundering System,Software,Strictly Confidential,Critical,Ingrid Solberg,Compliance,Zurich DC-1,NICE Actimize,"AST-HW-003,AST-SW-002",2025-01-05,Active
AST-SW-008,Regulatory Reporting Platform,Software,Confidential,Important,Ingrid Solberg,Compliance,Zurich DC-1,Wolters Kluwer,"AST-HW-003,AST-SW-002",2025-01-05,Active
AST-SW-009,SIEM Platform (Splunk Enterprise),Software,Internal,Critical,Katrin Halvorsen,Information Security,Zurich DC-1,Splunk,"AST-HW-001,AST-NW-001",2025-01-10,Active
AST-SW-010,Microsoft 365 Suite,Software,Internal,Important,Henrik Dahl,End User Computing,Cloud (Microsoft),Microsoft,"AST-CL-002",2024-12-15,Active
AST-NW-001,Primary Data Centre Network,Network,Internal,Critical,Marta Novak,Network Operations,Zurich DC-1,Cisco Systems,"AST-HW-005",2025-01-08,Active
AST-NW-002,DR Data Centre Network,Network,Internal,Critical,Marta Novak,Network Operations,Geneva DC-2,Cisco Systems,"AST-HW-005",2025-01-08,Active
AST-NW-003,Branch Office WAN,Network,Internal,Important,Marta Novak,Network Operations,Nationwide,Swisscom,"AST-NW-001",2024-12-20,Active
AST-NW-004,Customer-Facing DMZ,Network,Internal,Critical,Marta Novak,Network Operations,Zurich DC-1,Palo Alto Networks,"AST-HW-005,AST-NW-001",2025-01-08,Active
AST-CL-001,AWS Cloud Infrastructure,Cloud,Confidential,Critical,Lars Eriksson,IT Infrastructure,AWS eu-central-1,Amazon Web Services,"AST-SW-005,AST-SW-006",2025-01-12,Active
AST-CL-002,Microsoft Azure AD,Cloud,Internal,Important,Henrik Dahl,End User Computing,Cloud (Microsoft),Microsoft,"AST-SW-010",2024-12-15,Active
AST-DA-001,Customer Master Data,Data Asset,Strictly Confidential,Critical,Thomas Andersen,Digital Banking,Zurich DC-1,N/A,"AST-SW-001,AST-HW-003",2025-01-10,Active
AST-DA-002,Transaction Records,Data Asset,Strictly Confidential,Critical,Johan Lindberg,Core Banking,Zurich DC-1,N/A,"AST-SW-001,AST-HW-003",2025-01-10,Active
AST-DA-003,Regulatory Reports Archive,Data Asset,Confidential,Important,Ingrid Solberg,Compliance,Zurich DC-1,N/A,"AST-SW-008,AST-HW-003",2025-01-05,Active

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

ict_asset_inventory_status — fs-ict-asset-inventory

{
  "factId": "c1d2e3f4-a5b6-7890-cdef-100000000004",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-100000000004",
  "evidenceClassId": "ict-asset-inventory",
  "factType": "ict_asset_inventory_status",
  "data": {
    "inventory_date": "2025-01-08",
    "total_assets": 26,
    "classified_assets": 26,
    "unclassified_assets": 0,
    "has_dependency_mapping": true,
    "critical_assets_count": 14,
    "last_full_review_date": "2025-01-08"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-15T09:00:00Z",
  "supersededBy": null
}

ict_asset_classification_status — fs-ict-asset-classification

{
  "factId": "c1d2e3f4-a5b6-7890-cdef-100000000005",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-100000000005",
  "evidenceClassId": "ict-asset-classification",
  "factType": "ict_asset_classification_status",
  "data": {
    "scheme_version": "2.0",
    "effective_date": "2025-01-06",
    "criticality_levels_defined": 4,
    "sensitivity_tiers_defined": 4,
    "aligned_with_iso27001": true,
    "covers_cloud_assets": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-15T09:00:00Z",
  "supersededBy": null
}

ICT Asset Classification Scheme PARTIAL

XML-structured classification scheme defining asset categories, criticality levels, and data sensitivity tiers used to classify ICT assets per DORA Article 8.

Formats: XML
Evidence Class: ict-asset-classification
Availability: PARTIAL
Update Frequency: annual
Typical Author: Information Security Officer
Approval Chain: Information Security Officer → CISO

Content Sections

Expected Fields

Common Quality Issues

Classification scheme not aligned with industry standards (ISO 27001)
Missing criteria for cloud-hosted assets
No mapping between classification levels and required controls
Outdated sensitivity tiers not reflecting current data types

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

XML — Inline Preview

<?xml version="1.0" encoding="UTF-8"?>
<AssetClassificationScheme
    schemeVersion="2.0"
    effectiveDate="2025-01-06"
    institution="Nordvik Bank AG"
    alignedWithISO27001="true"
    coversCloudAssets="true"
    lastReviewDate="2025-01-06"
    approvedBy="Katrin Halvorsen, CISO">

  <!-- ═══════════════════════════════════════════════════════════════════════
       CRITICALITY LEVELS
       Defines the criticality classification tiers for ICT assets.
       ═══════════════════════════════════════════════════════════════════════ -->
  <CriticalityLevels count="4">
    <Level id="CL-01" name="Critical" numericValue="4">
      <Description>Assets whose failure or compromise would cause severe disruption
        to critical business functions, significant financial loss, or regulatory
        breach. Includes core banking systems, payment processing, and customer
        data stores.</Description>
      <RequiredControls>
        <Control>Redundant deployment (active-active or active-passive)</Control>
        <Control>Real-time monitoring with automated alerting</Control>
        <Control>RTO ≤ 4 hours, RPO ≤ 1 hour</Control>
        <Control>Quarterly vulnerability assessment</Control>
        <Control>Annual penetration testing</Control>
        <Control>Encryption at rest and in transit</Control>
      </RequiredControls>
      <ReviewFrequency>quarterly</ReviewFrequency>
    </Level>

    <Level id="CL-02" name="Important" numericValue="3">
      <Description>Assets supporting important business functions whose disruption
        would cause material operational impact but would not immediately threaten
        the institution's viability. Includes regulatory reporting, branch
        operations, and internal communication systems.</Description>
      <RequiredControls>
        <Control>Redundant deployment or rapid recovery capability</Control>
        <Control>Monitoring with alerting during business hours</Control>
        <Control>RTO ≤ 24 hours, RPO ≤ 4 hours</Control>
        <Control>Semi-annual vulnerability assessment</Control>
        <Control>Encryption at rest for sensitive data</Control>
      </RequiredControls>
      <ReviewFrequency>semi-annual</ReviewFrequency>
    </Level>

    <Level id="CL-03" name="Standard" numericValue="2">
      <Description>Assets supporting standard business operations whose disruption
        would cause limited operational impact. Includes office productivity tools,
        non-critical internal applications, and development environments.</Description>
      <RequiredControls>
        <Control>Standard backup and recovery procedures</Control>
        <Control>Basic monitoring</Control>
        <Control>RTO ≤ 72 hours, RPO ≤ 24 hours</Control>
        <Control>Annual vulnerability assessment</Control>
      </RequiredControls>
      <ReviewFrequency>annual</ReviewFrequency>
    </Level>

    <Level id="CL-04" name="Low" numericValue="1">
      <Description>Assets with minimal operational significance whose disruption
        would have negligible impact on business operations. Includes test
        environments, archived data, and deprecated systems pending
        decommissioning.</Description>
      <RequiredControls>
        <Control>Standard access controls</Control>
        <Control>Periodic backup</Control>
      </RequiredControls>
      <ReviewFrequency>annual</ReviewFrequency>
    </Level>
  </CriticalityLevels>

  <!-- ═══════════════════════════════════════════════════════════════════════
       DATA SENSITIVITY TIERS
       Defines the data sensitivity classification for information assets.
       ═══════════════════════════════════════════════════════════════════════ -->
  <SensitivityTiers count="4">
    <Tier id="ST-01" name="Strictly Confidential" numericValue="4">
      <Description>Data whose unauthorised disclosure would cause severe harm to
        the institution, its customers, or counterparties. Includes customer PII,
        authentication credentials, cryptographic keys, and transaction records
        subject to banking secrecy.</Description>
      <HandlingRequirements>
        <Requirement>AES-256 encryption at rest</Requirement>
        <Requirement>TLS 1.3 encryption in transit</Requirement>
        <Requirement>Access restricted to named individuals with business need</Requirement>
        <Requirement>Full audit trail of all access events</Requirement>
        <Requirement>Data loss prevention (DLP) controls active</Requirement>
        <Requirement>No storage on removable media without CISO approval</Requirement>
      </HandlingRequirements>
    </Tier>

    <Tier id="ST-02" name="Confidential" numericValue="3">
      <Description>Data whose unauthorised disclosure would cause material harm
        to the institution's operations or competitive position. Includes internal
        financial data, strategic plans, risk assessments, and vendor contracts.</Description>
      <HandlingRequirements>
        <Requirement>Encryption at rest on all storage media</Requirement>
        <Requirement>Encrypted transmission channels</Requirement>
        <Requirement>Role-based access control</Requirement>
        <Requirement>Audit trail for write/delete operations</Requirement>
      </HandlingRequirements>
    </Tier>

    <Tier id="ST-03" name="Internal" numericValue="2">
      <Description>Data intended for internal use that is not publicly available.
        Includes internal policies, procedures, organisational charts, and general
        operational documentation.</Description>
      <HandlingRequirements>
        <Requirement>Access restricted to authenticated employees and authorised contractors</Requirement>
        <Requirement>Standard network security controls</Requirement>
        <Requirement>No external sharing without management approval</Requirement>
      </HandlingRequirements>
    </Tier>

    <Tier id="ST-04" name="Public" numericValue="1">
      <Description>Data approved for public disclosure. Includes published
        financial statements, press releases, and public-facing website content.</Description>
      <HandlingRequirements>
        <Requirement>Integrity controls to prevent unauthorised modification</Requirement>
        <Requirement>Approval required before publication</Requirement>
      </HandlingRequirements>
    </Tier>
  </SensitivityTiers>

  <!-- ═══════════════════════════════════════════════════════════════════════
       ASSET CATEGORIES
       Defines the taxonomy of ICT asset types.
       ═══════════════════════════════════════════════════════════════════════ -->
  <AssetCategories>
    <Category id="AC-01" name="Hardware">
      <SubCategories>
        <SubCategory id="AC-01-01" name="Servers" />
        <SubCategory id="AC-01-02" name="Network Equipment" />
        <SubCategory id="AC-01-03" name="Storage Systems" />
        <SubCategory id="AC-01-04" name="End User Devices" />
        <SubCategory id="AC-01-05" name="Specialised Appliances" />
      </SubCategories>
    </Category>
    <Category id="AC-02" name="Software">
      <SubCategories>
        <SubCategory id="AC-02-01" name="Operating Systems" />
        <SubCategory id="AC-02-02" name="Business Applications" />
        <SubCategory id="AC-02-03" name="Databases" />
        <SubCategory id="AC-02-04" name="Security Tools" />
        <SubCategory id="AC-02-05" name="Middleware and Integration" />
      </SubCategories>
    </Category>
    <Category id="AC-03" name="Network">
      <SubCategories>
        <SubCategory id="AC-03-01" name="LAN Infrastructure" />
        <SubCategory id="AC-03-02" name="WAN Connectivity" />
        <SubCategory id="AC-03-03" name="Internet-Facing Infrastructure" />
        <SubCategory id="AC-03-04" name="Wireless Networks" />
      </SubCategories>
    </Category>
    <Category id="AC-04" name="Cloud Services">
      <SubCategories>
        <SubCategory id="AC-04-01" name="IaaS" />
        <SubCategory id="AC-04-02" name="PaaS" />
        <SubCategory id="AC-04-03" name="SaaS" />
      </SubCategories>
    </Category>
    <Category id="AC-05" name="Data Assets">
      <SubCategories>
        <SubCategory id="AC-05-01" name="Customer Data" />
        <SubCategory id="AC-05-02" name="Financial Records" />
        <SubCategory id="AC-05-03" name="Operational Data" />
        <SubCategory id="AC-05-04" name="Regulatory Data" />
      </SubCategories>
    </Category>
  </AssetCategories>

  <!-- ═══════════════════════════════════════════════════════════════════════
       CLASSIFICATION MAPPING RULES
       Rules for assigning criticality and sensitivity to assets.
       ═══════════════════════════════════════════════════════════════════════ -->
  <MappingRules>
    <Rule id="MR-01">
      <Condition>Asset supports a critical business function as defined in the BIA</Condition>
      <AssignedCriticality>Critical</AssignedCriticality>
    </Rule>
    <Rule id="MR-02">
      <Condition>Asset processes or stores Strictly Confidential data</Condition>
      <MinimumCriticality>Important</MinimumCriticality>
    </Rule>
    <Rule id="MR-03">
      <Condition>Asset is a single point of failure for any Critical asset</Condition>
      <AssignedCriticality>Critical</AssignedCriticality>
    </Rule>
    <Rule id="MR-04">
      <Condition>Cloud-hosted asset processing customer data</Condition>
      <MinimumSensitivity>Confidential</MinimumSensitivity>
      <AdditionalRequirement>Third-party risk assessment required</AdditionalRequirement>
    </Rule>
  </MappingRules>

</AssetClassificationScheme>

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

ict_asset_inventory_status — fs-ict-asset-inventory

{
  "factId": "c1d2e3f4-a5b6-7890-cdef-100000000004",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-100000000004",
  "evidenceClassId": "ict-asset-inventory",
  "factType": "ict_asset_inventory_status",
  "data": {
    "inventory_date": "2025-01-08",
    "total_assets": 26,
    "classified_assets": 26,
    "unclassified_assets": 0,
    "has_dependency_mapping": true,
    "critical_assets_count": 14,
    "last_full_review_date": "2025-01-08"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-15T09:00:00Z",
  "supersededBy": null
}

ict_asset_classification_status — fs-ict-asset-classification

{
  "factId": "c1d2e3f4-a5b6-7890-cdef-100000000005",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-100000000005",
  "evidenceClassId": "ict-asset-classification",
  "factType": "ict_asset_classification_status",
  "data": {
    "scheme_version": "2.0",
    "effective_date": "2025-01-06",
    "criticality_levels_defined": 4,
    "sensitivity_tiers_defined": 4,
    "aligned_with_iso27001": true,
    "covers_cloud_assets": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-15T09:00:00Z",
  "supersededBy": null
}

ict_asset_inventory_status

Schema ID: fs-ict-asset-inventory
Control: DORA-Art7-P1

Valid Ranges

inventory_date: within last 6 months
classified_assets: should equal total_assets for full compliance
unclassified_assets: should be 0 for full compliance

Related Schemas

JSON Schema

{
  "properties": {
    "classified_assets": {
      "minimum": 0,
      "type": "integer"
    },
    "critical_assets_count": {
      "minimum": 0,
      "type": "integer"
    },
    "has_dependency_mapping": {
      "type": "boolean"
    },
    "inventory_date": {
      "format": "date",
      "type": "string"
    },
    "last_full_review_date": {
      "format": "date",
      "type": "string"
    },
    "total_assets": {
      "minimum": 0,
      "type": "integer"
    },
    "unclassified_assets": {
      "minimum": 0,
      "type": "integer"
    }
  },
  "required": [
    "inventory_date",
    "total_assets",
    "classified_assets",
    "has_dependency_mapping"
  ],
  "type": "object"
}

ict_asset_classification_status

Schema ID: fs-ict-asset-classification
Control: DORA-Art7-P1

Valid Ranges

effective_date: within last 18 months
criticality_levels_defined: typically 3-5 levels

Related Schemas

JSON Schema

{
  "properties": {
    "aligned_with_iso27001": {
      "type": "boolean"
    },
    "covers_cloud_assets": {
      "type": "boolean"
    },
    "criticality_levels_defined": {
      "minimum": 1,
      "type": "integer"
    },
    "effective_date": {
      "format": "date",
      "type": "string"
    },
    "scheme_version": {
      "type": "string"
    },
    "sensitivity_tiers_defined": {
      "minimum": 1,
      "type": "integer"
    }
  },
  "required": [
    "scheme_version",
    "effective_date",
    "criticality_levels_defined",
    "sensitivity_tiers_defined"
  ],
  "type": "object"
}

Evidence Profiles

ICT Asset Inventory Register COMMON

Content Sections

Expected Fields

Common Quality Issues

View Example

Expected Structured Facts

ICT Asset Classification Scheme PARTIAL

Content Sections

Expected Fields

Common Quality Issues

View Example

Expected Structured Facts

Fact Schemas

ict_asset_inventory_status

Valid Ranges

Related Schemas

JSON Schema

ict_asset_classification_status

Valid Ranges

Related Schemas

JSON Schema