MaRisk and DORA make identity controls central to outsourcing governance

At a glance

What this is: This is an Imprivata analysis of how MaRisk and DORA shift outsourcing governance toward identity, access, and audit controls rather than paperwork alone.

Why it matters: It matters because IAM, PAM, and NHI governance now sit inside regulatory evidence for outsourced IT and cloud services, not just inside internal security practice.

Context

MaRisk turns outsourcing governance into a question of control, not just supplier selection. For financial institutions, the real test is whether outsourced IT and cloud services can still be supervised, audited, and exited without losing access visibility or accountability.

The article ties that governance problem to identity controls because regulators expect evidence around authenticated access, privileged accounts, audit trails, and the ability to challenge third-party access. DORA raises the bar further by making digital operational resilience part of the same operational reality, so IAM and PAM are no longer side controls in outsourcing programmes.

In practice, this shifts outsourcing reviews away from contract language alone. Institutions need to show that access governance remains enforceable when functions, data, and operators sit beyond the perimeter.

Key questions

Q: What breaks in outsourcing governance when identity ownership is unclear?

A: Governance breaks when the institution can no longer prove who owns external access, who can revoke it, and whether those changes are auditable. That uncertainty weakens contract enforcement, exit readiness, and regulatory evidence because the control problem has shifted from service scope to authority over credentials and privileged paths.

Q: Why do privileged accounts matter so much in MaRisk and DORA reviews?

A: Privileged access is where outsourced control becomes measurable. If elevated sessions are not tightly authenticated, recorded, and reviewed, the institution cannot demonstrate that critical systems remain under effective supervision. Regulators focus on this area because it reveals whether governance is real in operation or only documented in policy.

Q: How should banks test whether their outsourcing exit plans really work?

A: They should rehearse identity offboarding, not just service transition. That means verifying that accounts, tokens, delegated admin paths, and supplier access can be revoked or reassigned before the relationship changes. If the institution cannot remove access quickly and prove it, the exit plan is incomplete.

Q: Which controls prove outsourced IT remains governable under MaRisk and DORA?

A: The strongest evidence comes from access governance, privileged access management, audit logging, and clear ownership of third-party identities. Together, those controls show that the institution can still steer, inspect, and terminate access after work is outsourced. Without that evidence, the outsourcing model becomes hard to defend to auditors and supervisors.

Technical breakdown

AT 9 outsourcing control depends on governed access paths

AT 9 in MaRisk is about keeping outsourced activities within the institution's steering, control, and audit reach. That becomes difficult when the outsourced environment includes cloud administrators, vendor operators, and shared service channels that can create access paths the institution does not directly own. Identity and access controls become the measurable layer of control because they show who can act, under what authority, and whether that authority is still auditable. For regulators, the question is not whether the supplier is trusted in general, but whether access scope and review remain provable across the outsourcing relationship.

Practical implication: Tie outsourcing approval to explicit identity control evidence for access scope, privilege assignment, and audit logging.

Privileged access is the regulatory stress point in outsourced services

Privileged access is where outsourcing risk becomes operationally visible. If a vendor, managed service provider, or cloud operator can administer systems without strong session control, the institution loses practical oversight even if the contract contains inspection rights. PAM matters here because it narrows who can reach critical systems, records what they do, and makes privileged activity reviewable after the fact. In outsourced environments, the audit question is not only whether access exists, but whether elevated access can be constrained, traced, and revoked fast enough to keep control meaningful.

Practical implication: Require PAM evidence for every outsourced administrative path that can affect critical or important functions.

Exit planning fails when identity ownership is unclear

MaRisk and DORA both make exit and back-transfer scenarios part of governance, but those scenarios only work if identity ownership is already clear. If accounts, tokens, or delegated administrator paths are left with the supplier, the institution may not be able to revoke access quickly or reconstruct what the supplier could still reach. That turns exit planning into an identity lifecycle problem as much as a procurement problem. The control issue is persistent authority after the contract ends, not just transition logistics.

Practical implication: Map every outsourced identity to an owner, revocation path, and offboarding trigger before the contract is signed.

NHI Mgmt Group analysis

Outsourcing governance now depends on identity evidence, not contractual assurance alone. MaRisk and DORA push financial institutions to prove that outsourced access remains governable in practice, not just on paper. The central issue is whether access rights, privileged sessions, and delegated administration can still be audited after functions move outside the enterprise boundary. Practitioners should treat identity evidence as a regulatory artefact, not an IT detail.

AT 9 exposes a governance gap when third-party access outlives operational ownership. Outsourcing becomes difficult to govern when the institution can no longer show who owns an external account, who can revoke it, and how quickly that revocation happens. That is not a tooling problem first, it is an accountability problem. The implication for programme design is that access governance must be built into vendor oversight, exit planning, and control testing from the start.

Privileged access is the point where outsourcing risk becomes inspectable. MaRisk scrutiny lands hardest where vendors can administer systems, approve changes, or bypass standard user flows. That makes PAM a control evidence layer for both governance and resilience, especially where cloud and managed services blur the line between internal and external operations. Institutions should expect privileged session traceability to become one of the clearest signals of control maturity.

Sub-outsourcing creates identity blast radius, not just supplier depth. Every additional layer of subcontracting expands the number of parties that may hold credentials, tokens, or administrative relationships the institution never directly issued. That widens the operational blast radius if ownership, auditability, and offboarding are not explicitly governed. The practical conclusion is that outsourcing registers must track identity dependencies, not only service dependencies.

MaRisk + DORA are converging on one expectation: controlled access must survive change. Whether the change is a supplier switch, a cloud migration, or an exit event, the institution still has to demonstrate who had access and who could remove it. That expectation aligns governance, IAM, and resilience into one control problem. Security teams should assume every outsourced identity will be tested at the moment of change, not at steady state.

What this signals

Outsourcing programmes are increasingly judged on whether identity evidence survives operational complexity. When third parties, sub-suppliers, and cloud operators sit inside the same service chain, the control question is no longer whether access exists, but whether the institution can still explain, constrain, and remove it.

Identity governance debt: outsourcing creates control debt when access rights, privileged paths, and offboarding obligations are not tracked with the same discipline as service performance. That debt surfaces at audit, exit, and incident time, so programme owners should treat identity ownership as part of the outsourcing operating model.

For practitioners

• Map outsourced identity dependencies Inventory every external account, token, privileged session path, and delegated administrator relationship tied to outsourced services, then assign a business owner and revocation path to each one.
• Evidence privileged access controls Collect proof of strong authentication, session recording, privileged approval, and access review for all supplier-operated administrative paths that can affect critical or important functions.
• Embed identity checks into exit testing Run exit and back-transfer exercises that verify credential revocation, access reconfiguration, and administrative handover before the outsourcing relationship changes.
• Extend the outsourcing register to access governance Record which suppliers, sub-suppliers, and managed service providers can create, hold, or inherit access so the register reflects identity risk as well as service scope.

Key takeaways

• MaRisk and DORA make outsourced identity control a governance issue, not a narrow security task.
• The hardest evidence problem is proving who owns privileged access and how that access is revoked across supplier and sub-supplier chains.
• Institutions that test exit scenarios against identity offboarding will be better positioned to defend outsourced services during supervisory review.

Key terms

• Outsourcing governance: The set of controls used to keep delegated services under management control, legal accountability, and audit scrutiny. In regulated environments it covers ownership, access, review, monitoring, and exit readiness, not just contract administration or vendor oversight.
• Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
• Exit Readiness: The degree to which an organisation can leave a vendor without disrupting operations, losing evidence, or paying disproportionate switching costs. It combines technical portability, contractual clarity, and governance discipline, and it should be measured before a renewal becomes urgent.
• Session Auditability: Session auditability is the ability to reconstruct user actions after access has been granted. It usually relies on logs or recordings that show what commands were run, when they occurred, and which identity performed them. This supports investigation, compliance, and accountability for privileged access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.