DP003Data discovery and inventory

The location of regulated or sensitive data across the estate, as distinct from where policy assumes it is.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP003/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, the inventory is to be complete, accurate, up to date, and consistent, and changes to its entries are recorded so that they can be traced.