Topic starter
18/08/2026 2:10 pm
TL;DR: Invalid or missing LEI codes and blank sub-outsourcing templates showed that first-wave DORA Register submissions still struggle with dependency chains and vendor-of-vendor data, according to Kusari. Inventory records need provenance and supplier links to support filings, audits, and resilience decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “DORA, PCI DSS and NYDFS all now require a software inventory. Most banks cannot produce one.”.
Key questions
Q: Why do sub-outsourcing chains matter for resilience and accountability?
A: They show which vendors sit behind material services, so the organisation can trace dependence, ownership, and failure paths.
Q: How do source-built inventories improve third-party risk governance?
A: They reconcile source, build, and supplier data into one evidence chain, which makes it easier to prove composition, provenance, and ownership.
Q: What are the best practices for handling legal entity identifiers in regulated inventories?
A: Keep legal entity identifiers attached to the asset or service record, not in a separate spreadsheet, and validate them before filing.
Practitioner guidance
- Replace scanner-only inventories with governed source-built records Capture source, build, and supplier data in one inventory process so the record can support DORA, PCI, and resilience reporting without manual reconstruction.
- Track sub-outsourcing chains to the material-supplier level Map vendor-of-vendor dependencies explicitly, including the contractual and service relationships that sit behind material sub-contractors.
- Add provenance attestation to inventory workflows Use signed build evidence and artifact verification so teams can compare released software against the source that produced it.
Bottom line: Scanner-led inventories can miss the dependency and supplier-chain detail that DORA now expects.
Glossary terms: Dependency graph, Transitive Dependency, Provenance Attestation, Sub-outsourcing Chain
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:03 pm
Scanner-built inventory is not governance-grade inventory. Discovery tooling is valuable, but it is designed to observe artefacts, not to prove lineage, ownership, or sub-outsourcing depth. Once regulators ask for vendor-of-vendor relationships and material dependencies, the control boundary moves from visibility to evidence. Practitioners should treat scanner output as a feed into governed records, not as the record itself.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between a manifest and a provenance record?
A: A manifest says what a package claims to contain, while a provenance record shows how that package was built, signed, and released. In regulated environments, provenance is the stronger control because it can expose drift or tampering that a manifest will never show on its own.
👉 Read our full editorial: DORA register errors expose the limits of scanner-built inventories