Topic starter
24/06/2026 10:50 pm
TL;DR: MaRisk and DORA together push German financial institutions to prove that outsourced IT and cloud services remain governable through strong identity, access, and audit controls, with AT 9 placing access rights, sub-outsourcing, and exit scenarios under scrutiny according to Imprivata. The real issue is not documentation volume but whether governance can still constrain privileged access, trace accountability, and keep control after outsourcing expands.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “MaRisk: Die Säulen des modernen Banken-Risikomanagements”.
Key questions
Q: What breaks in outsourcing governance when identity ownership is unclear?
A: Governance breaks when the institution can no longer prove who owns external access, who can revoke it, and whether those changes are auditable.
Q: Why do privileged accounts matter so much in MaRisk and DORA reviews?
A: Privileged access is where outsourced control becomes measurable.
Q: How should banks test whether their outsourcing exit plans really work?
A: They should rehearse identity offboarding, not just service transition.
Practitioner guidance
- Map outsourced identity dependencies Inventory every external account, token, privileged session path, and delegated administrator relationship tied to outsourced services, then assign a business owner and revocation path to each one.
- Evidence privileged access controls Collect proof of strong authentication, session recording, privileged approval, and access review for all supplier-operated administrative paths that can affect critical or important functions.
- Embed identity checks into exit testing Run exit and back-transfer exercises that verify credential revocation, access reconfiguration, and administrative handover before the outsourcing relationship changes.
Bottom line: MaRisk and DORA make outsourced identity control a governance issue, not a narrow security task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:39 am
Outsourcing governance now depends on identity evidence, not contractual assurance alone. MaRisk and DORA push financial institutions to prove that outsourced access remains governable in practice, not just on paper. The central issue is whether access rights, privileged sessions, and delegated administration can still be audited after functions move outside the enterprise boundary. Practitioners should treat identity evidence as a regulatory artefact, not an IT detail.
A question worth separating out:
Q: Which controls prove outsourced IT remains governable under MaRisk and DORA?
A: The strongest evidence comes from access governance, privileged access management, audit logging, and clear ownership of third-party identities. Together, those controls show that the institution can still steer, inspect, and terminate access after work is outsourced. Without that evidence, the outsourcing model becomes hard to defend to auditors and supervisors.
👉 Read our full editorial: MaRisk and DORA make identity controls central to outsourcing governance