DORA compliance exposes the limits of static infrastructure access

At a glance

What this is: This is Teleport’s analysis of how DORA compliance exposes the weakness of static infrastructure access, especially where passwords, SSH keys, and standing privileges make auditability and rapid response harder.

Why it matters: It matters because IAM, PAM, and NHI teams supporting regulated environments must align access design with resilience, incident reporting, and third-party oversight rather than treating infrastructure access as a purely operational concern.

👉 Read Teleport's analysis of DORA compliance and static infrastructure access

Context

DORA is the EU’s digital operational resilience regime for financial institutions and their technology providers, and this article argues that its compliance burden lands directly on infrastructure access. The core governance problem is not whether access controls exist, but whether they can be controlled, monitored, and revoked fast enough to satisfy resilience and reporting demands.

The article frames the issue around mixed infrastructure, ephemeral cloud components, and third-party service dependencies. In that environment, static credentials and standing privileges create audit gaps, slow incident handling, and make it harder to prove that access is bounded to need, role, and time.

Key questions

Q: What breaks when infrastructure access still depends on static credentials under DORA?

A: Static credentials break the control model because they are hard to bound, hard to revoke quickly, and hard to prove as limited in time or scope. Under DORA, that creates friction for incident response, audit evidence, and unauthorized-access reduction. The problem is not just exposure, but the inability to demonstrate resilient control at the speed regulators expect.

Q: Why do standing privileges increase operational risk in infrastructure teams?

A: Because they let the same identity retain broad rights across changing contexts, including when the task no longer needs them. That persistence creates exposure if the identity is misused, misconfigured, or simply used correctly in a way that has wider impact than expected. Temporary access and narrow scope reduce that risk.

Q: How can security teams tell whether infrastructure access is actually auditable?

A: Access is auditable when the organisation can answer who accessed what, when, for how long, and under which approval context without stitching together fragmented evidence from multiple tools. If logs are split across environments or lack session context, the control exists in name but not in operational proof. In a DORA programme, that is a governance gap, not a reporting inconvenience.

Q: What should teams do when third-party ICT providers cannot match internal access controls?

A: Treat that mismatch as a contractual and resilience issue, not just a technical one. DORA requires firms to manage third-party risk and terminate non-compliant arrangements where necessary, so providers that cannot demonstrate equivalent access control, monitoring, and revocation discipline may need escalation, remediation, or exit planning. Governance must extend beyond internal infrastructure.

Technical breakdown

Why static credentials conflict with DORA access expectations

Static credentials such as passwords, SSH keys, and long-lived tokens assume access can be provisioned once and reused safely until manually changed. In regulated infrastructure, that assumption fails because the control objective is not just authentication, but provable limitation, revocation, and traceability. DORA’s ICT risk management and incident response expectations become harder to meet when the same credential can outlive the task, the session, or the operator’s need. The issue is structural: static access is durable by design, while resilience programmes need access to be transient, attributable, and auditable.

Practical implication: treat long-lived infrastructure credentials as a compliance risk, not just an admin convenience.

How standing privilege undermines least-privilege access

Standing privilege keeps access available before it is needed, which means the effective blast radius is larger than the actual operational requirement. DORA’s emphasis on minimizing unauthorized access risk fits poorly with persistent admin rights, especially across hybrid environments where policy enforcement is already uneven. Dynamic, certificate-based access changes the security model by binding privilege to a live session and removing it automatically when the session ends. That is not just a tooling choice; it is the difference between an access model that can be audited after the fact and one that exists continuously without clear business justification.

Practical implication: replace persistent admin access with time-bound, session-scoped authorization for infrastructure tasks.

Why monitoring and reporting depend on unified access trails

DORA places real weight on incident reporting, operational continuity, and evidence of control. In fragmented infrastructure, access events are often scattered across clouds, on-prem systems, and third-party environments, which makes it difficult to reconstruct who accessed what, when, and under which approval context. Unified access logging matters because auditability is not a passive recordkeeping exercise; it is the proof layer for response, oversight, and regulatory reporting. Without that layer, firms may have controls in theory but still struggle to demonstrate them under scrutiny.

Practical implication: centralize infrastructure access logs so incident response and compliance reporting use the same source of truth.

NHI Mgmt Group analysis

Static infrastructure access is now a regulatory liability, not just an operational shortcut. DORA exposes the mismatch between long-lived credentials and resilience requirements that assume rapid control, traceability, and revocation. The compliance issue is not whether access exists, but whether it can be bounded tightly enough to satisfy incident response and oversight. Practitioners should treat static access as a governance problem with direct regulatory consequences.

Standing privilege creates an access model that is too persistent for modern resilience expectations. When privilege is always on, least privilege becomes a theoretical label rather than a time-bound control. In hybrid and cloud-heavy estates, that persistence widens exposure and weakens the evidentiary chain regulators expect to see. The practitioner conclusion is straightforward: access must be provisioned for the task, not preserved for convenience.

Dynamic, certificate-based access is really about making privilege auditable at the moment of use. DORA’s demands around monitoring and incident reporting reward systems that can prove who had access, for how long, and under which conditions. That shifts emphasis from static approval records to runtime access evidence. The practical takeaway is that governance now depends on session-level control, not just identity records.

Unify access logging or accept fragmented compliance evidence. DORA does not just ask firms to secure infrastructure, it asks them to demonstrate resilience under disruption. Separate logs across tools, environments, and vendors make that evidence harder to assemble and slower to trust. The field lesson is that compliance and response are converging on the same control surface: the access trail.

Identity security for regulated infrastructure is moving toward just-in-time privilege by necessity. DORA validates a broader market shift away from static access assumptions and toward controls that expire with the session. That direction affects human admin access, NHI-style service access, and third-party operational access alike. The practitioner conclusion is to design for ephemeral authority wherever infrastructure risk is regulated.

What this signals

Static access is the control that DORA most obviously pressures. Financial institutions that still rely on passwords, SSH keys, and standing privileges will find that compliance work quickly becomes access redesign work. The practical shift is toward controls that can be proven at runtime, not merely documented in policy.

Unified access evidence is becoming as important as access itself. If a programme cannot reconstruct who accessed infrastructure, when, and under what conditions, it will struggle with both incident reporting and audit response. That makes logging, privilege scoping, and revocation part of the same operational conversation.

Regulated infrastructure is moving toward ephemeral authority. The strongest signal in this article is that resilience requirements favour access that expires with the task, not access that lingers in anticipation of future use. Teams should expect their identity and access models to be measured against that expectation more directly over time.

For practitioners

• Audit static infrastructure credentials Inventory passwords, SSH keys, and static tokens across on-prem and cloud estates, then classify where each one still enables persistent access paths that cannot be cleanly time-bounded or revoked.
• Replace standing privilege with session-scoped access Move administrative and operational access to short-lived certificates or equivalent controls so privilege exists only for the approved task and terminates automatically at session end.
• Unify access logs for audit and response Consolidate infrastructure access events into one monitoring and reporting stream so incident teams can reconstruct who accessed what, when, and under which approval context.
• Map third-party access to contract and compliance obligations Verify that ICT providers, software vendors, and service partners can prove the same access, logging, and revocation discipline your DORA programme expects internally.
• Test revocation against real operational disruption Exercise access removal during an active maintenance or incident scenario to confirm the environment can preserve continuity while privilege is withdrawn fast enough to satisfy resilience goals.

Key takeaways

• DORA pushes infrastructure access out of the admin-only category and into the compliance and resilience agenda.
• Static credentials and standing privileges weaken auditability, revocation speed, and incident reporting in mixed infrastructure estates.
• The most defensible response is session-scoped access, unified logging, and third-party control parity across regulated environments.

Key terms

• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Ephemeral certificate: A short-lived digital credential issued for a current session rather than stored for long-term reuse. In connected OT environments, ephemeral certificates reduce the value of stolen credentials and provide a cleaner control point for remote authentication and revocation.
• ICT Risk Management: ICT risk management is the process of finding, assessing, and controlling risks that could affect information and communications technology services. It covers threats to systems, networks, applications, data, and supporting people and processes. In practice, it uses governance, controls, monitoring, and response planning to reduce likelihood and impact.
• Session-Scoped Access: Session-scoped access is permission that exists only for a defined task or time window and is expected to end when the task ends. For NHI governance, it reduces lingering authority and makes AI-driven activity easier to review, revoke, and investigate when behaviour changes.

What's in the full article

Teleport's full blog post covers the operational detail this post intentionally leaves for the source:

• How Teleport maps specific infrastructure access controls to DORA’s five-pillar compliance model
• Detailed explanation of ephemeral certificates, session expiry, and audit logging for regulated access
• Examples of how the platform reduces manual administration across hybrid and cloud environments
• The vendor's discussion of productivity and compliance trade-offs for engineering teams

👉 Teleport's full post covers the DORA control mapping, monitoring approach, and access model details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.