DORA puts identity governance at the center of financial resilience

At a glance

What this is: This is RSA Security’s DORA analysis, arguing that identity governance, authentication resilience, and access review discipline are now core financial resilience controls rather than back-office IAM tasks.

Why it matters: It matters because financial institutions must prove that identity controls keep working during outages and incidents, which raises the bar for IAM, PAM, and lifecycle governance across the whole operating model.

By the numbers:

• 2025 marks the year where compliance now passes into enforcement stages, meaning organisations that do not comply with DORA face fines of either 2% of average global turnover or 1% of average daily turnover, with daily fines continuing until compliance is achieved.
• An asset manager in the article had €40 billion AUM when it experienced a credential-based attack targeting its fund administration platform.

Context

DORA is the EU’s operational resilience regime for financial entities, and this article frames identity governance as one of the controls that now sits directly in scope. The question is no longer whether identity supports security in general, but whether access, authentication, and review processes can keep critical operations available under stress.

RSA Security’s examples show why fragmented IAM, manual certification, and weak authentication no longer look like administrative inefficiencies. Under DORA, those gaps become continuity and reporting problems because identity services have to remain trustworthy during incidents, outages, and regulatory scrutiny.

Key questions

Q: What breaks when access governance is still based on periodic reviews under DORA?

A: Periodic reviews miss access that changes between certification cycles, especially in organisations with suppliers, delegated administration, and machine identities. That creates blind spots in audit evidence and incident response because the current control state is unknown when an issue appears. Under DORA, that is a resilience failure, not just an IAM weakness.

Q: Why does DORA make access governance a resilience issue?

A: DORA ties operational resilience to the ability to withstand, respond to, and recover from ICT disruptions. Access governance sits at the centre of that because compromised or poorly managed identities determine how far an incident spreads and how quickly it can be contained. If you cannot answer who had access, resilience claims are weak.

Q: Where do identity programmes most often fail under financial resilience requirements?

A: They fail at the seams between access review, authentication availability, and incident evidence. Legacy IAM tools may record entitlements, but they often cannot sustain timely certification, hybrid failover, or tamper-resistant audit trails when the environment is under stress. Those gaps create both security exposure and regulatory reporting friction.

Q: How do financial firms know whether identity controls are strong enough for DORA?

A: Look for evidence, not policy language. Strong controls produce complete identity inventories, current privilege maps, fast revocation, logged third-party access, and incident records that can be reconstructed quickly. If access data is fragmented across tools, the programme is not yet ready for the reporting and resilience expectations DORA creates.

Technical breakdown

Real-time access governance under DORA

DORA turns access governance into a live control requirement rather than a periodic audit exercise. Regular access reviews matter, but the article goes further by tying real-time access rights management to the ability to prevent privilege creep and unauthorized access across critical functions. In practice, that means identity decisions need to reflect current context, not just historical entitlement records. For financial institutions, the technical issue is not simply who has access, but whether the access model can adapt fast enough to preserve operational continuity and evidence generation when systems are under pressure.

Practical implication: Treat access certification, provisioning, and revocation as continuously governed controls, not calendar-based admin tasks.

Authentication resilience and hybrid failover

The article makes clear that strong authentication alone is insufficient if the service itself becomes unavailable during an outage or cyber incident. DORA’s continuity expectations force identity architectures to support failover, so that authentication remains available when cloud connectivity, on-premises systems, or a provider dependency fails. This is a resilience problem as much as an authentication problem. If access cannot be validated at the moment it is needed, the business cannot prove that critical functions remain continuously available.

Practical implication: Design authentication with redundant paths and recovery objectives, not a single availability assumption.

Identity-related anomalies as incident signals

DORA links monitoring to rapid detection, response, and recovery, which makes identity telemetry a first-class operational signal. The article’s service-account example shows how unusual geolocation, atypical access patterns, and accelerated deprovisioning can reveal compromise early enough to change the reporting and containment outcome. This is where identity logging becomes more than compliance evidence: it becomes the mechanism that distinguishes a contained incident from a prolonged business disruption. For regulated environments, the quality of identity telemetry directly affects both response speed and reporting accuracy.

Practical implication: Use identity anomalies as triggers for containment, classification, and regulatory reporting workflows.

Threat narrative

Attacker objective: The attacker aimed to use compromised identity access to move laterally inside a financial environment and disrupt or expand control over critical systems.

1. Entry began with an adversary-in-the-middle phishing campaign that compromised a service account used in fund administration.
2. Credential abuse then enabled lateral movement within the environment because the compromised account had usable access beyond its intended purpose.
3. Impact was contained only after anomalous authentication was detected and the service account was deprovisioned, preventing wider disruption and helping the firm meet DORA reporting obligations.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is now a resilience control, not a back-office hygiene task. DORA pushes identity into the same operational conversation as continuity, incident response, and executive accountability. That shift matters because the question is no longer whether access is formally approved, but whether the organisation can keep proving and enforcing access decisions when systems are degraded. Financial institutions should treat identity governance as part of resilience design, not as a separate compliance workflow.

Manual access reviews are too slow for the operational tempo DORA assumes. The article’s thirty-day review cycle example shows why certification cadence can lag the risk environment by an entire control cycle. When privilege changes happen faster than reviews, compliance evidence becomes retrospective rather than protective. That is a governance failure in a regulated environment, and practitioners should regard slow certification as a control exposure, not just an efficiency issue.

Identity continuity is the overlooked DORA dependency. The regulation is not only asking whether authentication is strong, but whether it still works during disruption. That makes failover, recovery, and service availability core identity design requirements. For financial services teams, the decisive question is whether identity services can survive the same outage conditions they are supposed to help manage.

Real-time anomaly detection is now part of incident classification. The article’s service-account example shows that identity telemetry can determine how quickly an organisation recognises and reports a major incident. This elevates detection from a SOC function to a governance input. Institutions that cannot interpret identity anomalies quickly will struggle to meet DORA timelines and to defend the quality of their incident classification.

Access governance under DORA exposes a legacy assumption gap. Many IAM programmes still assume access can be reviewed later, after business activity stabilises. DORA breaks that assumption because identity must remain trustworthy while operations, reporting, and continuity obligations are all active at once. The implication is that financial institutions need governance models that are designed for sustained operational pressure, not just steady-state administration.

From our research library:

• 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.

What this signals

Identity continuity is now a board-level resilience issue. DORA changes the evidentiary burden for financial institutions. Teams need to show that authentication, access control, and identity logging still function during outages and incidents, not just in normal operations.

Manual IAM governance will struggle to satisfy a regime built around continuous operational proof. Access reviews, provisioning, and reporting have to move closer to event time if the organisation wants to avoid gaps between control design and regulatory expectation. That is the practical shift DORA forces across financial services identity programmes.

For practitioners

• Align identity governance to DORA control evidence Map access review, provisioning, authentication, and incident logging processes directly to the DORA obligations the business must prove, especially for critical functions and regulated workflows.
• Build authentication failover into continuity planning Test whether identity services keep operating when cloud connectivity, on-premises infrastructure, or a provider dependency fails, and document recovery objectives for authentication separately from application recovery.
• Shorten certification cycles for privileged access Replace slow, spreadsheet-driven access reviews with automated certification workflows for privileged and business-critical accounts so entitlement changes are visible before they become audit exceptions.
• Use identity anomalies as incident triggers Feed unusual login patterns, geolocation changes, and access to unexpected systems into detection and response workflows so identity signals can accelerate containment and reporting decisions.
• Document third-party identity dependencies Inventory external authentication and identity service dependencies so contractual resilience obligations and reporting responsibilities are clear before an outage or incident tests them.

Key takeaways

• DORA turns identity governance into a resilience requirement for financial institutions, not just a compliance task.
• The article shows that fragmented IAM, slow access review cycles, and weak authentication create both operational and regulatory exposure.
• Financial teams need identity controls that stay available, evidence-ready, and responsive during incidents, outages, and recovery.

Key terms

• Digital Operational Resilience Act: DORA is an EU regulatory framework that requires financial entities and their critical ICT providers to prove they can withstand, respond to, and recover from disruption. For identity teams, it turns authentication, access, and recovery into evidence-bearing controls rather than background IT functions.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Hybrid Failover: A continuity design that allows authentication or identity services to switch between cloud and on-premises paths when one environment fails. For regulated organisations, it is a resilience requirement because access must remain available even when core infrastructure is disrupted.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.