Most organisations start in the same place. There is a server list from an inventory tool, a spreadsheet of applications somewhere else, and the most important systems are missing exactly what a regulator asks for: who owns the asset, what it depends on, and how long it may stay out of service. Nobody keeps the spreadsheets current, because it is work that never shows.
Asset tree in a sample organisation: regulated service, primary and supporting assets.
Questions people ask when they start
These are the questions we hear most often from organisations building an asset inventory.
- Where do we start and what exactly has to be recorded?
- How do we decide which systems are important, in a way that holds up in an audit?
- How do we prove the impact analysis was really done and that management reviewed it?
- Who keeps it current when nobody works on compliance full time?
Observa answers them like this.
What the rules require
The Czech Cybersecurity Act (Act No. 264/2025 Coll.), which transposes the NIS2 directive, has been in force since 1 November 2025. Section 12 requires a provider of a regulated service to define the scope of cybersecurity management: identify all primary assets, assess which of them relate to the regulated service, and identify the supporting assets they depend on. Assets in scope must be recorded, and so must primary assets excluded from scope, together with the reason. The scope has to be reviewed and updated regularly. Asset management is a security measure in its own right under both obligation regimes (Section 14 of the Act).
Decree No. 409/2025 Coll. adds the detail for the higher regime. Its Section 7 requires a methodology for identifying assets and a methodology for valuing them, including the levels used, at least to the extent set out in Annex 1 to the decree. It also requires records of asset guarantors, valuation of primary assets in terms of confidentiality, integrity and availability, records of dependencies between assets, and valuation of supporting assets derived from those dependencies. For each asset level the organisation then sets protection rules, from handling of assets to disposal of data carriers.
Impact analysis sits in Section 15 of the decree, under business continuity management. The organisation defines a methodology, carries out the impact analysis, takes the risk assessment into account, and on that basis sets the minimum acceptable service level, the recovery time objective and the recovery point objective. Senior management must demonstrably review the results of the impact analysis (Section 4 of the decree). For the lower obligation regime the scope of measures is set by Decree No. 410/2025 Coll.
Financial entities under the DORA regulation face the same substance in different words. As part of managing risk in information and communication technology they need an overview of their information assets and dependencies and must identify which functions are critical or important. Where an ICT service provider supports such a function, the regulation requires specific contractual provisions (Article 30 of DORA). Whether a particular obligation applies to your organisation is always its own assessment, with legal support where needed.
How Observa keeps the inventory
Four levels and the terms you already use
The inventory has four levels in Observa. At the top is the service the organisation provides, which must have a guarantor. Below it are primary assets, meaning information systems, applications and data directly linked to the service. Those depend on supporting assets (infrastructure, environments, people, suppliers) and on technical assets, meaning hardware, software and network devices. The level names follow the terminology you use: the legal terms of the Czech act, DORA terminology, ISO/IEC 27001 terminology, or plain language. The organisation chooses, and so can each user for their own screens, while reports follow the organisation setting.
A dependency map instead of guesswork
Every service and every asset has a dependency map: a graph of what depends on what, with a filter by relationship type and a list of relationships with explanations. This is usually the first thing an auditor asks for, and also what a colleague in operations needs when deciding whether a system can be restarted during business hours.
Asset valuation and impact analysis
Primary assets are classified in terms of confidentiality, integrity and availability. A fourth axis, authenticity, is switched on automatically for organisations with a service under Section 18(1) of the act and for trust services, and others can enable it. Supporting and technical assets inherit the strictest values from the primary assets they are linked to, and inheritance can be turned off. The scale has three, four or five levels with your own names, the default being four levels in line with Annex 1 to the decree.
Impact analysis runs on primary assets, following either the decree methodology or ISO. Observa asks about the impact of data loss and data alteration in scenarios, about outage and data loss durations for each impact level, and about the maximum tolerable period of disruption. The result is a proposal that is written to the asset once it is confirmed. A deviation from the proposal can only be saved with a justification, so the documentation keeps the reason for a different decision. Operational parameters RTO and RPO (how quickly a system must be restored and how much data may be missing) are inherited from parent assets and services, while availability SLA is recorded on the asset.
Documents, recovery plans and access records
Assets carry documents with versions, approval and a review date: uploaded files, an application design document generated from the inventory, recovery and continuity runbooks, supplier exit strategies and records of plan tests. Output is to PDF and DOCX. The Access tab shows who accesses the asset, under which account, with what type of access and until when. This is a record only, Observa does not enforce access. Supporting and technical assets record the operating model, the country and region of the data, backups and replicas, which feeds the overviews of where the data sits and of transfers outside the European Economic Area. An asset with history is never deleted, it is retired with a reason and can be restored.
The Access tab of an asset: who accesses it, under which account and until when.
What Observa does on its own
- It raises risks from gaps in the records. A vulnerability found on an asset, an overused or expired licence, and a valuation scale that does not match the decree all lead to an automatically identified risk. The scale compliance risk closes itself once compliance is restored.
- It links assessment frameworks. An answer in one framework proposes the answer for related requirements in other frameworks, and the user accepts or rejects it. The application holds 11 frameworks, 970+ requirements and more than 1 800 mappings between them. Mapping between frameworks is an Enterprise feature.
- It assigns the task to whoever can act on it. A vulnerability on an asset creates a task for the asset owner with a deadline based on severity. Notifications also cover upcoming document reviews and expiring certificates.
- It works through the consequences of a critical function under DORA. Suppliers that support the function through access or an asset inherit that support, and the provider guarantor receives a task to complete the contractual provisions required by the regulation.
- It inherits values where they belong. Supporting and technical assets take the strictest classification from primary assets, and RTO and RPO are inherited from parent records. For services with key roles, Observa flags a role that has only one holder.
A person always decides. Observa prepares the proposal and records in the history who confirmed it.
Connecting your other systems
A quick start usually means an import from an Excel workbook or CSV with a template and a file check that first shows what will be created, changed and skipped. Import, CSV export and PDF reports are available from the Starter plan. The REST API comes with Professional: new servers from your inventory system arrive in the asset register on their own, and findings from vulnerability scanners (Nessus, Qualys, OpenVAS) can be imported without duplicates. In Enterprise, single sign-on and SCIM add that user accounts are created and removed in line with your corporate directory, so access records do not keep identities that no longer exist.
Security, simplicity and clarity
Data is encrypted in transit and at rest including the database, files and attachments with each organisation key, organisations are separated from each other, and two factor authentication is available in every plan. The service runs in data centres in the European Union and every change to a record is in the audit trail. Simplicity means the regulatory profile of the organisation determines which requirements, methodologies and deadlines apply to you, and that a guide, import templates and in-app help are there at the start. Clarity means services, assets, dependencies, valuations and evidence sit in one place, and a report for management or an auditor is one click away.
What you get
An inventory that can actually be maintained, because the application takes over part of the work. A defensible asset valuation and impact analysis with justified deviations. A dependency map you can use during an incident and when planning maintenance. And audit evidence that builds up as you go, instead of three weeks before the deadline.
Frequently asked questions
Which plan includes the asset inventory
All of them, including the 7 day trial. The number of services and assets is limited by plan and unlimited in Enterprise. Observa pricing starts at CZK 2 990 per month. Prices are shown excluding VAT.
Can we move data from the spreadsheets we already have
Yes. Assets and services are imported from an Excel workbook or CSV using a template, available from the Starter plan. The file check shows in advance what will be created and what will change.
Who works with the inventory
A contributor creates, edits and imports assets. A manager retires and restores records. A module administrator maintains the code lists, the scale and the impact analysis methodology. A user with permission to a single service sees the assets of that service, and guarantors and owners see their own records.
Do we have to use the legal terminology
No. The organisation chooses between the terms of the Czech act, DORA, ISO/IEC 27001 or plain language. Reports, exports and e-mails follow the organisation setting.
How long does it take to get started
One service, a handful of primary assets and their dependencies are a single afternoon in the trial. Impact analysis is worth doing together with the asset guarantors, and that is something we help with as part of our regulatory advisory work.
Try Observa for free
Create an account at observa.cypheron.cz/register and try Observa for 7 days free of charge, with no card required. The feature scope and plan prices are in the Observa price list. Interested, or have questions? Get in touch and we will walk you through Observa using your own examples.
Related reading: the introduction to Observa, our article on ICT asset records under DORA for smaller financial firms and our security assessment service.
Next Monday we look at suppliers and the supply chain: keeping a supplier register, evidencing supplier assessments and staying on top of contract reviews.
Sources: Act No. 264/2025 Coll. on cybersecurity, Sections 12 and 14 · Decree No. 409/2025 Coll., Sections 4, 7 and 15 · Decree No. 410/2025 Coll., lower obligation regime · Regulation (EU) 2022/2554 (DORA) · NUKIB, guidance on the Czech act