DORA compliance in practice exposes identity control gaps

At a glance

What this is: This is an analysis of how DORA turns access governance, auditability, and privilege control into operational requirements for financial institutions and their service providers.

Why it matters: It matters because IAM, PAM, and infrastructure teams must show evidence of controlled access and monitoring, not just policies, to satisfy resilience and audit expectations across regulated environments.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read Teleport's webinar summary on DORA compliance in practice

Context

DORA pushes financial institutions and their service providers to prove operational resilience through access governance, not just through written controls. For identity and access management teams, that means evidence of who accessed infrastructure, under what privilege, and with what audit trail becomes part of the control itself.

In practical terms, the gap is between policy-based compliance and technical proof. Access has to be time-bound, visible, and attributable across human administrators and service providers, which makes privileged access management, session logging, and lifecycle controls central to the programme.

This is a human IAM and infrastructure access governance problem first, and a broader identity lifecycle problem second. The webinar’s starting point is typical for regulated organisations that already have policy intent but still lack operational evidence at scale.

Key questions

Q: How should financial institutions implement just-in-time access for regulated infrastructure?

A: Start by restricting elevation to a specific task, resource, and time window. Pair approval workflows with automatic expiry, session recording, and central logging so the organisation can prove who used privileged access and why it existed. The goal is not convenience, but controlled exposure with evidence.

Q: Why does standing privilege create problems for DORA compliance?

A: Standing privilege leaves no clear justification boundary between access granted and access actually needed. Under DORA, that makes it harder to prove accountability, minimise blast radius, and support incident investigations. Persistent rights also increase the chance that access exists long after the operational need has ended.

Q: How can teams tell whether their access logs are audit-ready?

A: Audit-ready logs tie identity, privilege elevation, and session activity together in one searchable record. If investigators must jump between infrastructure logs, authentication logs, and manual screenshots, the control is fragmented. A good test is whether you can reconstruct a session without asking a person to explain it.

Q: Who is accountable when third-party administrators access regulated systems?

A: The regulated organisation remains accountable for proving that third-party access was controlled, scoped, and revoked on time. The provider may operate the system, but the customer still needs evidence of approval, session visibility, and offboarding. In DORA terms, accountability cannot be outsourced with the access itself.

Technical breakdown

Why DORA turns access into evidence

DORA does not stop at asking whether access is authorised. It pushes organisations toward provable accountability, which means access decisions, session activity, and administrative actions need to be logged in a way that can stand up to audit and incident review. In practice, that shifts IAM from a provisioning function into an evidence system. The control objective is not merely that a user or provider had access, but that the organisation can demonstrate the access boundary, timing, and purpose after the fact.

Practical implication: teams need access controls that produce durable audit evidence, not just approval records.

Just-in-time access and standing privilege reduction

Just-in-time access is a privilege elevation pattern where access exists only for the task window and then expires automatically. That matters under DORA because standing administrative access creates an exposure window that is difficult to justify when the environment must be continuously accountable. The technical issue is not only whether access is temporary, but whether elevation, session scope, and revocation are all tied to a traceable identity and resource set.

Practical implication: replace persistent admin entitlements with task-scoped elevation and automatic expiry.

Session recording and unified audit trails

Session recording captures what happened during an interactive administrative session, while a unified audit trail ties those actions to identity, resource, and time. Under DORA, those controls matter because accountability is not complete if logs are fragmented across infrastructure silos. The technical challenge is correlation: organisations need to connect authentication, privilege assignment, command execution, and exportable logs into one reviewable record that supports investigations and reporting.

Practical implication: consolidate authentication and session telemetry into a single reviewable control plane.

NHI Mgmt Group analysis

DORA makes access governance an operational resilience control, not a documentation exercise. The article’s core message is that regulated institutions must prove who accessed what, when, how, and why. That shifts identity governance from policy intent to audit-ready evidence. Practitioners should treat access control design as part of resilience architecture, not an after-the-fact compliance layer.

Standing privilege is harder to defend once access itself becomes reportable evidence. Persistent admin rights create a gap between entitlement and justification that DORA exposes. The more privileged access is left in place by default, the more difficult it becomes to demonstrate necessity, scope, and accountability during review or incident response. Practitioners need to re-evaluate where persistent access still exists across infrastructure and service-provider pathways.

Auditability now has to extend across human administrators and third-party access paths. The webinar’s emphasis on identity governance and third-party risk reflects a broader market shift: regulated environments are being asked to treat external access with the same traceability expectations as internal privileged access. That means access lifecycle, session evidence, and exportable logs must work across organisational boundaries. Practitioners should assume third-party access is in scope for the same control model as internal admin access.

Identity and access management is becoming the control plane for resilience evidence. DORA does not eliminate the need for process, but it raises the bar for technical proof. Centralised visibility, task-scoped elevation, and replayable sessions are no longer convenience features when auditors and regulators want factual accountability. Practitioners should measure whether their IAM stack can produce evidence on demand, not merely policy alignment.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
• The operational next step is to align lifecycle controls with Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs so access evidence and revocation are governed together.

What this signals

Access evidence will become a board-level governance requirement in more regulated environments. The teams that win here will be the ones that can show a complete control chain from approval to session replay to revocation, not just a policy sign-off. That is why DORA should be read as a forcing function for identity governance maturity across infrastructure and third-party access.

Centralised visibility is becoming the baseline for both audit and operational response. Fragmented logs create fragmented accountability, and that is exactly the kind of gap regulators are moving to expose. Practitioners should expect more pressure to integrate privileged access tooling, session evidence, and exportable audit trails into one reviewable workflow.

Identity lifecycle discipline matters because regulated access rarely fails at the moment of grant. It fails when access outlives the purpose for which it was approved, or when a provider relationship changes and offboarding is incomplete. Teams should treat revocation, expiry, and evidence retention as one connected programme rather than separate controls.

For practitioners

• Map regulatory asks to evidence-producing controls Translate DORA obligations into concrete signals such as access history, privilege elevation, session replay, and exportable logs. Build the mapping around what an auditor can verify from telemetry rather than what a policy document claims.
• Eliminate standing admin access where tasks are time-bound Identify infrastructure roles that remain active beyond a discrete maintenance or support window. Replace them with short-lived access requests and automatic expiry so that privilege exists only while the task is active.
• Unify session logging across infrastructure and providers Correlate authentication, privileged action, and audit events into one traceable record for internal teams and third-party operators. Make sure the record can be exported cleanly for incident reporting and compliance review.
• Review third-party access as part of the same lifecycle Apply joiner-mover-leaver style governance to external administrators and service providers so access does not outlive the business need. Offboarding should remove credentials, sessions, and residual entitlements across every system they touched.

Key takeaways

• DORA pushes access governance into the resilience domain, where proof matters as much as policy.
• Standing privilege, fragmented logs, and weak third-party offboarding are the control gaps most likely to fail under audit.
• The practical response is lifecycle-based, evidence-producing access control that can show who did what and when.

Key terms

• JIT — Just-in-Time Access: A security approach that grants access permissions only for the duration needed to complete a specific task, then automatically revokes them. JIT access eliminates standing privileges for NHIs, dramatically reducing attack surface.
• Session Recording: Session recording is the capture of user activity during a privileged session, such as commands, queries, or administrative actions. It gives security and audit teams a verifiable record of what happened after authentication, which is essential when access itself is not enough to prove control.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Audit Trail: An audit trail is a record of who accessed a system, what they did, and when they did it. For PHI environments, it provides the evidence needed to investigate incidents, support breach determinations, and demonstrate that access was attributable to a specific identity or workflow.

What's in the full article

Teleport's full blog post covers the operational detail this post intentionally leaves for the source:

• A live webinar walkthrough of how RBAC, JIT access, and session recording map to DORA requirements.
• Examples of how short-lived certificates and passwordless access reduce standing privilege in regulated infrastructure.
• A practical explanation of how audit logs and session timelines support incident reporting and compliance evidence.
• The webinar framing used to translate Articles and RTS points into operational controls.

👉 Teleport's full post shows how its webinar mapped DORA requirements to access control, session evidence, and auditability.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or privileged access programme, it is worth exploring.