What it asks for. Article 8 requires financial entities to identify, classify and document their ICT supported business functions, information assets and ICT assets, their roles and dependencies, and all sources of ICT risk. Inventories must be maintained and updated, including dependencies on ICT third party service providers.
In practice. The entity maps business functions to supporting assets and suppliers, keeps inventories current, identifies which functions are critical or important, and performs ICT risk assessments when major changes occur. Network and infrastructure configurations and interconnections are documented. Evidence includes inventories, dependency maps, criticality assessments and risk assessment records.
Common gaps. Inventories frequently miss the links between business functions and the assets or suppliers behind them. Updates after major changes are often irregular.