Can CMDB Accuracy for DORA Compliance in Brussels’ Financial Market Infrastructure Be Proven?

CMDB accuracy for DORA compliance across the Brussels financial market infrastructure became a board-level question the moment shared settlement rails slowed on 27 February 2025. On that day, a major incident hit TARGET2-Securities (T2S) and T2. A defective hardware component slowed both services and then made them unavailable from 08:07 CET and 10:15 CET, respectively, as recorded in the ECB’s T2S operational status history and related incident materials. For several hours, no settlement instructions, payments, ancillary system instructions, or liquidity transfers between TARGET Services could be processed, and CSD reporting ran late. Participants’ position and liquidity management in the international CSDs were affected on 27 and 28 February.

The European Central Bank later traced the root cause to hardware failure in a storage sub-system that disrupted application-to-application traffic. The incident landed after Regulation (EU) 2022/2554 (DORA) had applied from 17 January 2025. Connected operators still faced one operational question first: which of our functions depend on these services. Could they prove the answer from maintained records when supervisors and boards ask for evidence?

A configuration management database can hold part of that proof by recording assets, relationships, ownership, and freshness alongside the wider DORA programme controls. The sections below cover Belgian supervision, dependency obligations, measured gaps, failure modes, what discovery-sourced records supply, and how far accuracy proof can go.

Who DORA Covers in Belgian Market Infrastructure, and Who Supervises It

The National Bank of Belgium oversees payment systems and securities clearing and settlement systems, including TARGET-BE, CLS, Bancontact, and Mastercard Europe. Under the Central Securities Depositories Regulation, the NBB is the sole competent supervisory authority for Euroclear Bank and Euroclear Belgium, consulting the Financial Services and Markets Authority (FSMA) on defined market aspects per the Bank’s 2024 securities clearing and settlement report. Daily settlement for Euroclear Belgium and NBB-SSS runs on T2S under Eurosystem oversight, so a TARGET incident reaches many Belgian post-trade firms at once.

DORA names central securities depositories, central counterparties, trading venues, and trade repositories among the financial entities in scope under Article 2. In Belgium, the NBB leads prudential and FMI supervision, with the FSMA holding market-authority duties already reserved under the CSDR.

On registers of information, the FSMA collected 2025 registers through a FiMiS survey and forwarded them to the European Supervisory Authorities. For 2026, it announced a limited update in which only a limited number of companies must submit new data, unchanged registers may be confirmed, and changed arrangements can be updated or replaced.

Where DORA Asks About Dependencies Between Operators

Article 8 of DORA requires financial entities to identify all sources of ICT risk. That identification includes exposure to other financial entities and exposure from other financial entities. For market infrastructure operators, the practical reading is direct. Shared rails, shared platforms, and participant connections belong on the risk map with the rest of the ICT estate.

The same article requires mapping of ICT assets, including configuration, links, and interdependencies. Classification of critical or important functions and the supporting ICT assets must be kept current and reviewed at least yearly. Article 5 places ultimate responsibility for the ICT risk management framework with the management body. Board accountability therefore sits on top of whatever technical record the organisation maintains.

DORA requires the ICT risk management framework to be maintained on an ongoing basis across the entity. That programme obligation is separate from any vendor discovery product. Discovery-sourced inventory work in this article is framed as scheduled, high-frequency refresh of records that operations and compliance can both query.

Operators who track IT asset management for financial services already see the same pressure: asset lists need dependency context, and dependency context needs ownership and freshness before the management body can defend the map to supervisors.

What Regulators and Surveys Have Measured So Far

The European Supervisory Authorities ran a dry run on registers of information before formal 2025 reporting. Workshop materials published by the European Banking Authority reported that 6.5% of submitted registers passed all data quality checks. Half of the remaining registers failed fewer than five of 116 checks. The ESAs treated that outcome as consistent with a best-efforts exercise ahead of official reporting and critical-provider designation. Identifier quality, list values, and formats drove many failures, which sit outside CMDB scope. The CMDB accuracy case applies to the asset and dependency records behind Article 8.

Deloitte’s European DORA survey found that 46% of financial entities named the register of information the most challenging requirement. That survey spans financial services entities generally and still shows where programme effort concentrates after the application date.

Flexera’s 2026 State of ITAM Report (512 technology professionals worldwide) reported complete IT estate visibility at 36%, a global ITAM measure that shows how multi-environment estates lose dependency freshness.

In November 2025, the ESAs designated the first critical ICT third-party providers under DORA, using registers of information and a criticality assessment with competent authorities. Many market-infrastructure operators share those providers, so concentration risk appears in both the register exercise and day-to-day dependency maps.

Article 5 keeps the management body ultimately responsible for the ICT risk framework. When exposure answers take hours of cross-team calls, the board still needs evidence the organisation can produce on a fixed timetable.

Four Places Interconnected Operators Lose Track of Dependencies

Shared market infrastructure often sits only in runbooks and tribal knowledge, with no typed relationship on a configuration item. When T2S, T2, or another shared service degrades, the first hour goes to confirming which internal functions consume that service from tickets, spreadsheets, and calls unless the relationship is already on the record.

Cut-off and schedule dependencies often live outside the CMDB entirely. The ECB’s market consultation materials on cut-off delays note that long cut-off delays weigh on participants who may be unable to delay their own local systems to the same degree. When those schedule links are missing from the record, local adjustments are improvised under time pressure.

Provider-hosted components that support a critical or important function are sometimes inventoried as contracts only. The technical join from function to hosted component to provider is incomplete. Establishing exposure then takes hours because ownership, environment, and supporting assets must be reconstructed.

Where an operator is designated for threat-led penetration testing, test scope is still sometimes assembled from slide decks. Commission Delegated Regulation (EU) 2025/1190 sets detailed TLPT requirements under DORA. Scope that is not grounded in a current asset and dependency record needs rework before the authority can treat it as ready. Each of these failure modes applies where the operator’s own estate and connections make them relevant. They are operational patterns, not accusations against any named firm.

What Discovery-Sourced Records Supply to an Operator

CMDB accuracy for DORA compliance in Brussels financial market infrastructure starts with treating the CMDB as the record layer. Discovery populates and refreshes configuration items. Service definitions supplied by the operator allow dependency maps to be built against that infrastructure. The compliance mechanism remains the organisation’s ICT risk framework, testing programme, register process, and management-body oversight.

High-frequency scheduled discovery covers on-premises, network, and cloud estates that the operator controls or can credential. Virima’s published catalog includes hypervisors such as VMware, Microsoft Hyper-V, and Nutanix; network and infrastructure sources such as Aruba, Cato, Cisco Meraki, Juniper, and NetApp; cloud coverage for AWS and Azure; and container platforms including Kubernetes, OpenShift, AWS EKS, Azure AKS, and Docker. Agent-based and agentless methods are chosen by estate design. Refresh runs on a schedule the operator sets, described here only as scheduled discovery cycles.

Once service definitions are provided, ViVID™ service mapping builds application-to-infrastructure dependency maps from discovered relationships so impact paths are available when a shared component or internal tier fails. The map is where “which functions depend on this” should already be answered before the incident bridge opens. ITSM platforms remain systems of engagement, with bidirectional sync published for ServiceNow, Jira Service Management, Ivanti, Halo, Xurrent, Hornbill, and TeamDynamix, plus a REST API for custom joins. Partner integration paths are listed on Virima’s integrations catalog.

Four Dimensions of Provable Accuracy

Accuracy for audit and supervisory conversations breaks into four checks that together form a Coverage-Relationship-Freshness-Ownership model CMDB audit practice already uses.

• Coverage asks whether the estate that supports critical or important functions is present.
• Relationship accuracy asks whether links between assets, services, and shared infrastructure match reality.
• Freshness asks for a last-confirmed discovery or reconciliation date on each material record.
• Ownership asks who is accountable for correcting the record when discovery and human review disagree.

These four checks turn “proven” into an operational standard the organisation can defend.

What a CMDB Does Not Do

• Contract commercial fields, legal entity identifiers, and exit plans for ICT providers belong in contract and third-party risk systems feeding the register of information.
• The operator classifies critical or important functions under its ICT risk framework and reviews that classification on the schedule Article 8 requires.
• The competent authority governs TLPT designation and scope approval under DORA and the TLPT delegated regulation.
• Availability and performance tooling watches runtime behaviour. The CMDB stores configuration and dependency truth those tools need for impact context.
• Provider-internal topology remains outside the operator CMDB. The record can still capture the operator’s side of a provider-hosted dependency when that component is known and linked under contractual and oversight arrangements.

Proof under DORA is the combination of accurate records, governed processes, testing, and management-body accountability. The CMDB supplies the record layer those controls use.

Two Market Disruptions, One Dependency Question

In both cases below, the first practical question for any connected firm was which functions run on the failing component. A maintained dependency record is where that answer lives when minutes matter.

On 27 to 28 November 2025, CME Group markets halted after a cooling issue at CyrusOne data centres. CNBC reporting quoted CME on the cooling issue at CyrusOne facilities and quoted CyrusOne on a chiller plant failure at its CHI1 facility that affected multiple cooling units. Globex futures and options, EBS, and BMD markets were impacted. Trading reopened in stages, with stock futures and options fully open at 08:30 ET according to the same report. Secondary write-ups disagree on exact multi-hour tallies, so this article stays with the cause and market impact those statements support.

In early 2023, ION Cleared Derivatives suffered a cybersecurity incident that the Futures Industry Association said was impacting trading and clearing of exchange-traded derivatives by ION customers across global markets. TechCrunch reported that banks reverted to manual processing and that Bloomberg had counted at least 42 clients affected. BankInfoSecurity covered the same disruption to EU derivatives workflows. The episode remains a reference point for vendor concentration ahead of DORA application.

Both cases show why dependency visibility is the first product a configuration record must deliver when shared infrastructure or a concentrated provider fails, without describing any Belgian operator’s internal response.

What a Better Record Can and Cannot Cut

A better dependency record cuts the time spent establishing exposure and the manual rework that follows an incomplete map, while vendor fees and technology spend allocation stay outside its scope. Finance systems own rates, journals, and chargeback mechanics. The CMDB and service maps supply owned services, supporting assets, and join keys those processes need.

Documented incidents already show the cost of thin records. Banks processing derivatives manually during the ION incident burned staff hours that automated clearing normally absorbs. TARGET participants facing extended cut-offs absorbed fails, reconciliation lag, and liquidity friction across multiple days. Those time and process costs are measurable inside the organisation.

A conservative CIO metric is simple. Measure time to identify affected critical or important functions before a record improvement programme and after it. Use tabletop exercises or real incident timelines, keep the metric internal to the organisation, and exclude vendor outcome numbers unless the organisation measured them on its own estate.

When decommissioning enters the conversation, the service owner and change authority decide what retires. Discovery and the CMDB only show what still depends on a candidate for removal, feeding that decision with blast-radius visibility under the change governance.

Five Steps Before the Next Register Cycle

Move dependencies known only to individual teams into a record with an owner and a last-confirmed date. Move register data assembled only at submission time into a maintained record that operations and compliance both query between cycles.

1. Trace one critical or important function by hand. Include shared market infrastructure, provider-hosted components, and internal tiers that support it.
2. Run discovery across the relevant estate and compare the result with the current register entries and the hand trace.
3. Score each material record on coverage, relationship accuracy, freshness, and ownership. Close gaps with named owners and dates.
4. Tag provider-hosted components and cut-off-dependent interfaces so schedule and concentration risk are visible in the same place as technical dependencies.
5. Set a review cadence that matches your competent authority’s register timetable and your internal Article 8 classification review. If the authority designates the entity for TLPT, add scope readiness checks against the current dependency map before slide-based scope freezes.

These steps stay inside the operator’s control and produce an evidence trail a management body can inspect without reconstructing history from chat logs, the same evidence trail covered in Before You Run AI Agents on ServiceNow, Answer These 5 Questions About Your CMDB.

See How Your Dependency Records Compare

To see how dependency maps are built from discovered infrastructure, start with Virima’s service mapping overview.

Frequently Asked Questions