Topic starter
24/06/2026 10:26 pm
TL;DR: DORA turns identity security into a regulatory control for financial services, requiring real-time access governance, strong authentication, resilient identity services, and fast incident reporting, according to RSA Security. The compliance question is now whether IAM, PAM, and lifecycle processes can sustain continuity under stress, not just pass an audit.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “DORA, Digital Risk, and the New Identity Mandate in Financial Services”.
By the numbers:
- 2025 marks the year where compliance now passes into enforcement stages, meaning organisations that do not comply with DORA face fines of either 2% of average global turnover or 1% of average daily turnover, with daily fines continuing until compliance is achieved.
Key questions
Q: What breaks when access governance is still based on periodic reviews under DORA?
A: Periodic reviews miss access that changes between certification cycles, especially in organisations with suppliers, delegated administration, and machine identities.
Q: Why does DORA make access governance a resilience issue?
A: DORA ties operational resilience to the ability to withstand, respond to, and recover from ICT disruptions.
Q: Where do identity programmes most often fail under financial resilience requirements?
A: They fail at the seams between access review, authentication availability, and incident evidence.
Practitioner guidance
- Align identity governance to DORA control evidence Map access review, provisioning, authentication, and incident logging processes directly to the DORA obligations the business must prove, especially for critical functions and regulated workflows.
- Build authentication failover into continuity planning Test whether identity services keep operating when cloud connectivity, on-premises infrastructure, or a provider dependency fails, and document recovery objectives for authentication separately from application recovery.
- Shorten certification cycles for privileged access Replace slow, spreadsheet-driven access reviews with automated certification workflows for privileged and business-critical accounts so entitlement changes are visible before they become audit exceptions.
Bottom line: DORA turns identity governance into a resilience requirement for financial institutions, not just a compliance task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:07 am
Identity governance is now a resilience control, not a back-office hygiene task. DORA pushes identity into the same operational conversation as continuity, incident response, and executive accountability. That shift matters because the question is no longer whether access is formally approved, but whether the organisation can keep proving and enforcing access decisions when systems are degraded. Financial institutions should treat identity governance as part of resilience design, not as a separate compliance workflow.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: How do financial firms know whether identity controls are strong enough for DORA?
A: Look for evidence, not policy language. Strong controls produce complete identity inventories, current privilege maps, fast revocation, logged third-party access, and incident records that can be reconstructed quickly. If access data is fragmented across tools, the programme is not yet ready for the reporting and resilience expectations DORA creates.
👉 Read our full editorial: DORA puts identity governance at the center of financial resilience
This post was modified 1 day ago by NHI Mgmt Group