--- title: "Article 8 — Identification" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 8 — Identification" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 8 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. As part of the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework referred to in [Article 6(1)](6.md), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset) supporting those functions, and their roles and dependencies in relation to [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk). Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation. 2. Financial entities shall, on a continuous basis, identify all sources of [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk), in particular the risk exposure to and from other financial entities, and assess [cyber threats](https://www.headlesslaw.com/definitions/dora/cyber-threat) and ICT [vulnerabilities](https://www.headlesslaw.com/definitions/dora/vulnerability) relevant to their ICT supported business functions, [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset). Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them. 3. Financial entities, other than [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise), shall perform a risk assessment upon each major change in the [network and information system](https://www.headlesslaw.com/definitions/dora/network-and-information-system) infrastructure, in the processes or procedures affecting their ICT supported business functions, [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) or [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset). 4. Financial entities shall identify all [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset), including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset) and the links and interdependencies between the different [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset). 5. Financial entities shall identify and document all processes that are dependent on [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider), and shall identify interconnections with [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider) that provide services that support [critical or important functions](https://www.headlesslaw.com/definitions/dora/critical-or-important-function). 6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs. 7. Financial entities, other than [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise), shall on a regular basis, and at least yearly, conduct a specific [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) assessment on all [legacy ICT systems](https://www.headlesslaw.com/definitions/dora/legacy-ict-system) and, in any case before and after connecting technologies, applications or systems. *** [Chapter II — ICT risk management](../chapters/ii.md) › Section II · [← Article 7](7.md) · [Article 9 →](9.md)