Topic starter
11/07/2026 8:34 pm
TL;DR: DORA now requires financial entities to prove secure, traceable, continuously monitored third-party access across complex environments, and Appgate argues legacy VPN and perimeter models are not built for that level of accountability. The regulation turns access governance into an operational resilience problem, not just an audit exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “DORA and the New Mandate for Secure Access: Why International Banks Must Rethink Their Network Strategy”.
Key questions
Q: What breaks when third-party access is managed with legacy VPN and perimeter models under DORA?
A: Legacy VPN and perimeter models break auditability and segmentation because they grant broad network reach after login instead of proving narrow, session-specific authorization.
Q: Why does DORA make access governance a resilience issue?
A: DORA ties operational resilience to the ability to withstand, respond to, and recover from ICT disruptions.
Q: How can teams tell whether their access controls are actually DORA-ready?
A: A DORA-ready access control set should answer who accessed what, when and why, while also showing that the session was segmented, monitored and revocable.
Practitioner guidance
- Map third-party access paths Inventory every vendor, contractor and service-provider pathway into production systems, then classify which sessions require stronger segmentation, monitoring and revocation authority.
- Replace perimeter trust with contextual access decisions Use identity, device posture, location and risk signals to make each access request specific to the session instead of assuming network location implies trust.
- Instrument every external session for audit evidence Capture who accessed what, when and why, and retain session metadata that compliance teams can correlate with policy decisions and incident response.
Bottom line: DORA reframes third-party access as a regulated resilience problem, not a convenience issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:02 pm
Legacy perimeter access is now a governance liability, not a convenience layer. DORA turns access control into a proof problem, and proof is exactly what broad VPN-style trust makes difficult. When every external session must be segmented, monitored and attributable, network reachability stops being a useful proxy for authorised access. The practitioner conclusion is that legacy perimeter models no longer satisfy regulated access governance.
A question worth separating out:
Q: Who is accountable when third party privileged access is not governed properly under DORA?
A: Accountability sits with the organisation that grants and oversees access, even when contractors, partners, or service providers are involved. DORA expects firms to control third party risk, log privileged activity, and maintain evidence for reporting and review. Delegating access does not delegate responsibility for governance, monitoring, or regulatory outcome.
👉 Read our full editorial: DORA exposes the limits of legacy access models