DORA and identity governance: what financial teams need to fix

TL;DR: Financial firms preparing for DORA must treat identity governance as part of operational resilience, because access visibility, third-party oversight, and continuous monitoring sit at the centre of incident reporting and risk management, according to Veza’s analysis. The practical shift is from periodic review to continuously governed access paths across internal and external identities.

NHIMG editorial — based on content published by Veza: an analysis of DORA and the role of identity security in compliance

By the numbers:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.

Questions worth separating out

Q: How should financial institutions govern privileged access for DORA compliance?

A: They should treat privileged access as part of resilience design, not a separate admin function.

Q: Why do third-party access paths create DORA risk?

A: Because outsourced access often combines elevated privilege with weaker lifecycle control.

Q: What breaks when identity evidence is retained too broadly?

A: Broad retention expands the attack surface and increases privacy risk, especially when biometric or documentary evidence is stored beyond the period needed for verification or audit.

Practitioner guidance

• Map all third-party access paths to named business owners Catalogue external users, delegated roles, service accounts, and API tokens, then assign explicit owners and expiry conditions for each access path.
• Move from periodic certification to continuous access monitoring Monitor entitlements, privilege changes, and anomalous use in near real time, especially for financial applications and administrative functions.
• Automate lifecycle controls for supplier identities Provision, review, rotate, and revoke third-party credentials through workflow, not manual ticketing, so offboarding and access changes are enforceable.

What's in the full article

Veza's full article covers the operational detail this post intentionally leaves for the source:

• A practical breakdown of how its Access Graph maps identity relationships across applications and infrastructure
• Examples of continuous governance workflows for access review, monitoring, and remediation
• The way the platform frames third-party access oversight and audit evidence for DORA-aligned programmes
• Implementation guidance for organisations building a phased identity security rollout

👉 Read Veza's analysis of DORA-driven identity security requirements →

DORA and identity governance: what financial teams need to fix?

Explore further

View Full Forum →  |  NHI Foundation Course →