Topic starter
25/06/2026 3:24 pm
TL;DR: Financial institutions face overlapping compliance pressure from DORA, NIS2, GDPR, and related identity governance demands, and Omada Identity’s white paper frames identity governance and administration as the control layer that helps evidence access, reduce privilege creep, and support audit readiness. The practical issue is less about policy intent than proving who has access, why they have it, and when it should be removed.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “White Papers”.
Key questions
Q: What breaks when identity governance is not aligned to NIS2?
A: NIS2 compliance becomes hard to defend when access changes, revocation, and audit evidence remain manual or fragmented.
Q: Why do entitlement sprawl and standing access create compliance risk in financial services?
A: They increase the number of access decisions that must be explained later.
Q: How can IAM teams tell whether access review coverage is actually meaningful?
A: They should measure what was excluded as well as what was approved.
Practitioner guidance
- Map regulatory requirements to entitlement evidence Create a single entitlement evidence model that ties request, approval, recertification, and revocation records to DORA, NIS2, and GDPR obligations.
- Prioritise high-risk access reviews Start with privileged accounts, third-party access, and long-lived exceptions because those entitlements are hardest to defend in an audit or incident review.
- Tighten offboarding and exception expiry Track leaver events, role changes, and temporary access approvals so stale entitlements do not survive past their business need.
Bottom line: Identity governance is doing more of the work that used to be treated as back-office administration, because regulators now expect provable access control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:55 pm
Identity governance is becoming the evidentiary layer for regulated access control. Financial institutions do not just need access policies, they need provable lifecycle records that show approvals, reviews, and removals. DORA and NIS2 make that distinction operationally important because unproven control is often treated as weak control. The practical conclusion is that IGA has moved from support function to compliance-critical infrastructure.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should financial institutions do when access review findings keep repeating?
A: Treat repeated findings as a design problem, not a reviewer problem. Recurrent exceptions usually mean role models are too broad, approval paths are inconsistent, or offboarding is lagging behind business change. The fix is to reduce the number of entitlements that require judgement in the first place.
👉 Read our full editorial: Identity governance for DORA and NIS2 compliance in financial institutions