Topic starter
21/08/2026 4:51 pm
TL;DR: DORA makes identity controls, monitoring, and third-party access governance part of operational resilience for financial institutions and critical ICT providers, according to KOBIL. The regulatory shift is that access reviews, MFA, logging, and incident reporting are no longer separate IAM tasks but resilience controls that must stand up under disruption.
Editorial analysis by NHI Mgmt Group, based on content published by KOBIL: “Guide: DORA – What companies should consider”.
Key questions
Q: What breaks when financial access controls are not resilient under DORA?
A: When access controls cannot survive disruption, the organisation may keep systems running but lose the ability to prove who had access, who changed rights, or whether privileged actions were authorised.
Q: Why do privileged and third-party accounts matter so much in DORA programmes?
A: They matter because both paths can create outsized operational exposure if access is excessive, opaque, or hard to revoke.
Q: How do you know whether identity monitoring is good enough for DORA?
A: It is good enough only if logs, alerts, and access-change records are usable during incident handling, not just available for after-the-fact review.
Practitioner guidance
- Assess critical access paths first Map the systems, accounts, and third-party interfaces that would most quickly disrupt a regulated service if they failed or were abused.
- Enforce MFA on all critical and external access Require strong authentication for privileged users, remote administrators, and external providers that touch regulated systems or data.
- Review privileged accounts on a resilience cadence Tie privileged access review to operational resilience reviews so admin rights are reassessed alongside continuity and recovery readiness.
Bottom line: DORA makes identity governance a resilience requirement, not a separate compliance task, for regulated finance and critical ICT support.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:09 pm
Identity governance becomes part of operational resilience when regulatory continuity depends on it. DORA does not merely ask financial firms to protect access, it asks them to prove that access control still works during disruption. That moves MFA, privileged access review, and logging into the same resilience conversation as backup and recovery. For practitioners, the boundary between IAM and operational resilience has effectively disappeared.
A question worth separating out:
Q: How should financial institutions align IAM and third-party access with DORA?
A: They should treat IAM, PAM, and NHI controls as part of the regulated ICT risk framework, not as separate technical tools. That means documenting access ownership, tightening supplier credential lifecycles, and ensuring incident reporting can trace identity-related failures across internal and external systems. DORA expects governance evidence, not just security intent.
👉 Read our full editorial: DORA turns identity controls into a resilience requirement for finance