The cryptographic controls required to protect data, identities, and critical services under DORA. They include documented encryption policy, key lifecycle management, certificate inventory, strong authentication, and evidence that controls align with risk and data classification. Under examination, the issue is not whether controls exist, but whether they can be proven.
Expanded Definition
DORA cryptographic controls are the documented, testable encryption and key-management measures that protect data in transit, data at rest, and the identities that access regulated systems. Under the EU Digital Operational Resilience Act (DORA), the question is not whether encryption exists, but whether it is governed, traceable, and proportionate to the risk and data classification it protects. In NHI environments, this extends beyond files and databases to service accounts, API keys, certificates, signing keys, and machine-to-machine trust paths. Definitions vary across vendors on where cryptographic ownership begins and ends, but the operational expectation is consistent: policies, inventories, rotation, revocation, and evidence must be auditable. That aligns closely with NHIMG guidance on governance, lifecycle visibility, and regulated evidence in the Ultimate Guide to NHIs — Standards. The most common misapplication is treating encryption as a one-time technical deployment, which occurs when teams cannot prove key custody, certificate renewal, or policy enforcement during review.
Examples and Use Cases
Implementing DORA cryptographic controls rigorously often introduces operational overhead, requiring organisations to weigh stronger assurance against more frequent renewals, audits, and ownership checks.
- Maintaining a certificate inventory for application-to-application authentication, then proving renewal dates, expiration monitoring, and revocation ownership during audit.
- Applying data classification rules so that customer records, backups, and regulated logs use stronger encryption and managed keys, with exceptions formally approved.
- Rotating API keys and service credentials on a defined schedule, then linking each secret to an accountable owner and a documented recovery path.
- Using signed binaries or signed deployment artifacts to protect software supply chains, while retaining evidence of key custody and signature verification.
- Documenting cryptographic decisions in the context of NHI governance, as described in the Ultimate Guide to NHIs — Regulatory and Audit Perspectives, alongside DORA obligations and implementation guidance in the DORA — Digital Operational Resilience Act.
Why It Matters in NHI Security
Cryptographic controls are foundational in NHI security because machine identities depend on secrets, certificates, and key material to authenticate and exchange data without human intervention. When those controls are weak, undocumented, or unowned, compromise can spread quickly across service accounts, automation, and third-party integrations. NHIMG notes that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, which underscores why proof of control matters as much as control design. That risk is amplified when certificates are not inventoried, keys are not rotated, or encryption exceptions are left unmanaged. DORA therefore turns cryptography into an evidence problem: teams must show who owns each key, how it is protected, when it is rotated, and why its strength matches the associated risk. That expectation is reinforced by the operational visibility and lifecycle concerns highlighted in the Ultimate Guide to NHIs — Standards. Organisations typically encounter cryptographic control failures only after a leak, expired certificate outage, or audit finding, at which point DORA cryptographic controls become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the technical controls, and DORA define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-1 | Addresses protection of data at rest using cryptographic safeguards and related governance. |
| NIST SP 800-63 | AAL2 | Supports authentication assurance expectations relevant to strong machine and service identity controls. |
| NIST Zero Trust (SP 800-207) | SC-12 | Zero trust relies on protected cryptographic channels and managed keys for trust decisions. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Secret and credential management is central to NHI cryptographic control failure modes. |
| DORA | DORA requires ICT risk controls, including cryptography, to be documented and demonstrable. |
Classify sensitive data and enforce approved encryption plus key management for all protected stores.
