Topic starter
17/08/2026 4:40 pm
TL;DR: Teleport says DORA’s January 17, 2025 deadline puts static credentials, standing privileges, and fragmented infrastructure under scrutiny because auditability and incident response depend on access that can be controlled, monitored, and revoked quickly. Static access models no longer match the operational resilience expectations DORA imposes on financial firms and their ICT providers.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “The 2025 DORA Deadline is Here: Simplify Compliance with Teleport”.
Key questions
Q: What breaks when infrastructure access still depends on static credentials under DORA?
A: Static credentials break the control model because they are hard to bound, hard to revoke quickly, and hard to prove as limited in time or scope.
Q: Why do standing privileges increase operational risk in infrastructure teams?
A: Because they let the same identity retain broad rights across changing contexts, including when the task no longer needs them.
Q: How can security teams tell whether infrastructure access is actually auditable?
A: Access is auditable when the organisation can answer who accessed what, when, for how long, and under which approval context without stitching together fragmented evidence from multiple tools.
Practitioner guidance
- Audit static infrastructure credentials Inventory passwords, SSH keys, and static tokens across on-prem and cloud estates, then classify where each one still enables persistent access paths that cannot be cleanly time-bounded or revoked.
- Replace standing privilege with session-scoped access Move administrative and operational access to short-lived certificates or equivalent controls so privilege exists only for the approved task and terminates automatically at session end.
- Unify access logs for audit and response Consolidate infrastructure access events into one monitoring and reporting stream so incident teams can reconstruct who accessed what, when, and under which approval context.
Bottom line: DORA pushes infrastructure access out of the admin-only category and into the compliance and resilience agenda.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- How Teleport maps specific infrastructure access controls to DORA’s five-pillar compliance model
- Detailed explanation of ephemeral certificates, session expiry, and audit logging for regulated access
- Examples of how the platform reduces manual administration across hybrid and cloud environments
- The vendor's discussion of productivity and compliance trade-offs for engineering teams
👉 Read Teleport's analysis of DORA compliance and static infrastructure access →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Static infrastructure access is now a regulatory liability, not just an operational shortcut. DORA exposes the mismatch between long-lived credentials and resilience requirements that assume rapid control, traceability, and revocation. The compliance issue is not whether access exists, but whether it can be bounded tightly enough to satisfy incident response and oversight. Practitioners should treat static access as a governance problem with direct regulatory consequences.
A question worth separating out:
Q: What should teams do when third-party ICT providers cannot match internal access controls?
A: Treat that mismatch as a contractual and resilience issue, not just a technical one. DORA requires firms to manage third-party risk and terminate non-compliant arrangements where necessary, so providers that cannot demonstrate equivalent access control, monitoring, and revocation discipline may need escalation, remediation, or exit planning. Governance must extend beyond internal infrastructure.
👉 Read our full editorial: DORA compliance exposes the limits of static infrastructure access