Topic starter
02/01/2026 11:31 am
TL;DR: DORA pushes financial firms to prove identity controls, continuity, and governance can withstand severe disruption, and RSA Security frames that test around visibility, risk-based access, failover, phishing-resistant authentication, and lifecycle automation for CISOs and IAM leaders. The real issue is not whether controls exist, but whether identity operations remain governable under outage, credential theft, and audit pressure.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “A Practical CISO Playbook for DORA: Identity, Continuity and Controls”.
Key questions
Q: What breaks when identity governance still depends on periodic certification?
A: Periodic certification breaks when identities change faster than the review cycle can capture.
Q: Why does DORA make phishing-resistant authentication a resilience issue?
A: Because credential theft is not only an account security problem.
Q: How do teams know if IAM lifecycle controls are working?
A: They should be able to prove that accounts are provisioned and removed on schedule, that access changes are logged, and that stale entitlements are rare.
Practitioner guidance
- Map identity services to DORA control areas Document where access control, authentication, continuity, and incident response rely on manual intervention, legacy tooling, or a single operating dependency.
- Prioritise phishing-resistant authentication Move workforce and customer access paths that are most exposed to credential theft onto phishing-resistant factors and reduce reliance on push or OTP alone.
- Test identity failover under disruption Validate that authentication, governance, and reporting still function when the primary cloud, data centre, or network path is unavailable.
Bottom line: DORA elevates identity from a control domain to a resilience obligation, which means access, authentication, and governance must survive operational stress.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:56 am
DORA turns identity into a resilience control, not a support layer. The regulation does not merely ask whether access controls exist. It asks whether the organisation can still authenticate users, govern privileges, and evidence control when systems are under stress. That shifts IAM, IGA, and authentication from operational tooling into board-relevant resilience capability.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Which frameworks align most closely with DORA-driven identity resilience work?
A: NIST Zero Trust Architecture and the NIST Cybersecurity Framework both fit the identity resilience problem because they emphasise continuous verification, recovery, and governance. Financial firms should use them to structure controls around authentication, access decisions, and operational continuity rather than treating identity as a standalone compliance silo.
👉 Read our full editorial: DORA exposes the identity controls financial CISOs must harden