Topic starter
20/08/2026 5:50 pm
TL;DR: DORA creates a single EU cyber resilience framework for financial entities and their critical third-party ICT providers, with 24-hour, 72-hour, and 30-day incident reporting expectations plus mandatory resilience testing, according to Expel. The practical shift is from ad hoc security oversight to documented, auditable operational resilience across the supplier chain.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “How the Digital Operations Resilience Act (DORA) will affect your business”.
By the numbers:
- Financial entities are expected to notify relevant authorities within 24 hours of detecting a significant incident.
- They must share an intermediate report within 72 hours on impact and planned recovery measures.
- The final report is due within 30 days and must include root cause analysis, learnings and resolution.
Key questions
Q: What fails when third-party access is not tied to identity governance under DORA?
A: The control gap is usually not the supplier contract, but the unmanaged credentials and privileges that remain after the business relationship changes.
Q: Why does DORA make supplier risk a regulatory issue instead of just a security issue?
A: Because a supplier can now affect whether a regulated firm can detect, report and recover from an ICT incident on time.
Q: Where do financial organisations most often fall short on third-party resilience?
A: They usually have supplier lists and contracts, but weak evidence of control execution.
Practitioner guidance
- Strengthen third-party access inventories Document every external ICT supplier, the access paths it uses, and the business service it supports.
- Align incident reporting playbooks to DORA timelines Map detection, triage, intermediate reporting and final root-cause closure into one workflow so the team can meet 24-hour, 72-hour and 30-day obligations without reconstructing events after the fact.
- Test supplier recovery and access revocation Include critical third parties in tabletop exercises and resilience tests that validate whether privileged access can be removed, monitored and evidenced during an incident.
Bottom line: DORA makes third-party ICT oversight a regulated responsibility for financial entities, which pushes supplier access and incident accountability into the same control chain.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:30 pm
DORA turns third-party access into a governed control domain, not a procurement afterthought. The article is clear that third-party ICT providers are inside the compliance perimeter, which means access, monitoring and recovery responsibilities have to be contractually and operationally defined. That is especially relevant to IAM and PAM programmes, where external accounts often exist without the same lifecycle rigour as internal access. Practitioners should treat supplier access as a controlled part of the resilience model.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Which is harder under DORA, passing a questionnaire or proving recovery readiness?
A: Proving recovery readiness is harder, and regulators will care more about it. A questionnaire may show intent, but DORA expects practical evidence that access can be controlled, incidents can be reported on time, and recovery steps can be executed across the supplier chain.
👉 Read our full editorial: DORA turns third-party cyber risk into a compliance requirement