Topic starter
18/08/2026 2:10 pm
TL;DR: Roughly a third of first-wave DORA Register of Information submissions returned invalid or missing LEI codes, while blank sub-outsourcing templates were common, showing that manual, scanner-led inventories still fail when institutions must map dependency chains and vendor-of-vendor relationships, according to Kusari. The real issue is not filing quality but governance blindness across source, build, and supplier data.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “DORA, PCI DSS and NYDFS all now require a software inventory. Most banks cannot produce one.”.
Key questions
Q: What are the best practices for handling legal entity identifiers in regulated inventories?
A: Keep legal entity identifiers attached to the asset or service record, not in a separate spreadsheet, and validate them before filing.
Q: Why do sub-outsourcing chains matter for resilience and accountability?
A: They show which vendors sit behind material services, so the organisation can trace dependence, ownership, and failure paths.
Q: How do source-built inventories improve third-party risk governance?
A: They reconcile source, build, and supplier data into one evidence chain, which makes it easier to prove composition, provenance, and ownership.
Practitioner guidance
- Replace scanner-only inventories with governed source-built records Capture source, build, and supplier data in one inventory process so the record can support DORA, PCI, and resilience reporting without manual reconstruction.
- Track sub-outsourcing chains to the material-supplier level Map vendor-of-vendor dependencies explicitly, including the contractual and service relationships that sit behind material sub-contractors.
- Add provenance attestation to inventory workflows Use signed build evidence and artifact verification so teams can compare released software against the source that produced it.
Bottom line: Scanner-led inventories can miss the dependency and supplier-chain detail that DORA now expects.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:03 pm
Scanner-built inventory is not governance-grade inventory. Discovery tooling is valuable, but it is designed to observe artefacts, not to prove lineage, ownership, or sub-outsourcing depth. Once regulators ask for vendor-of-vendor relationships and material dependencies, the control boundary moves from visibility to evidence. Practitioners should treat scanner output as a feed into governed records, not as the record itself.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between a manifest and a provenance record?
A: A manifest says what a package claims to contain, while a provenance record shows how that package was built, signed, and released. In regulated environments, provenance is the stronger control because it can expose drift or tampering that a manifest will never show on its own.
👉 Read our full editorial: DORA register errors expose the limits of scanner-built inventories