Notifications
Clear all
Topic starter
21/08/2026 4:51 pm
TL;DR: DORA makes identity controls, monitoring, and third-party access governance part of operational resilience for financial institutions and critical ICT providers, according to KOBIL. The regulatory shift is that access reviews, MFA, logging, and incident reporting are no longer separate IAM tasks but resilience controls that must stand up under disruption.
NHIMG editorial — based on content published by KOBIL: DORA-compliant identity management and digital resilience
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should financial institutions govern privileged access for DORA compliance?
A: They should treat privileged access as part of resilience design, not a separate admin function.
Q: Why does DORA increase the importance of privileged access reviews?
A: Because privileged access can determine whether critical services stay running during an incident.
Q: What do security teams get wrong about monitoring for DORA compliance?
A: They often treat logging as a detection task only.
Practitioner guidance
- Classify every regulated system by resilience criticality Create a system-by-system register that marks which applications, data stores, and support services are in scope for DORA evidence, then map each one to access owners and recovery dependencies.
- Separate internal and third-party identity lifecycles Track external providers, support accounts, and partner certificates independently from employee accounts so offboarding, renewal, and review events are not hidden inside a single IAM process.
- Prove logging can reconstruct privilege changes Run a controlled test that forces a privileged login, a role change, and a third-party access event, then verify that the audit trail can be assembled without gaps.
What's in the full article
KOBIL's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step IAM implementation guidance for DORA-aligned authentication, monitoring, and reporting
- Practical examples of secure certificate and token-based authentication for regulated access paths
- Detailed handling of third-party access, including partner identities and external service provider controls
- Implementation-oriented security measures covering encryption, patching, backups, and incident response
👉 Read KOBIL's guide to DORA-compliant identity management and resilience →
DORA and IAM: what financial teams need to change now?
Explore further
21/08/2026 5:09 pm
Identity governance has become a resilience control, not a compliance afterthought. DORA effectively moves authentication, access review, and monitoring into the operational continuity conversation. Financial institutions cannot separate who has access from whether services stay available under attack or outage. The practical conclusion is that IAM, PAM, and reporting workflows now sit inside the resilience control plane.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how slowly lifecycle response can lag exposure.
A question worth separating out:
Q: What should organisations do if external providers still have broad system access?
A: Start by narrowing the access scope to the minimum operational need, then separate provider identities from employee identities in your governance process. After that, define explicit offboarding and renewal checks so external access cannot persist by default. In regulated environments, unmanaged supplier access is a continuity and accountability problem, not just an IAM issue.
👉 Read our full editorial: DORA turns identity controls into a resilience requirement for finance
