Topic starter
02/02/2026 8:38 pm
TL;DR: DORA pushes financial entities and their ICT providers to prove operational resilience through visibility, testing, and recovery discipline, while identity systems remain a primary failure point in that model, according to Semperis. The practical shift is from compliance paperwork to testable identity control, because access recovery and privilege governance now sit inside resilience obligations.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “DORA Compliance and ITDR”.
Key questions
Q: What fails when identity systems are excluded from DORA recovery planning?
A: Recovery can look complete on paper while users still cannot authenticate, access rights are wrong, or dependent services stay unavailable.
Q: How should organisations prepare identity controls for DORA compliance?
A: They should treat identity systems as regulated dependencies and build evidence around them.
Q: What are the signs that identity recovery is not resilient enough for DORA?
A: Warning signs include recovery tests that skip directory services, access restorations that depend on manual fixes, and post-recovery environments that keep stale privileges or inconsistent delegation.
Practitioner guidance
- Map identity dependencies into critical service recovery plans Document which directories, authentication services, delegation chains, and access controls each critical business service depends on, then tie those dependencies to recovery objectives and ownership.
- Run end-to-end identity recovery drills Test full restoration paths rather than isolated components, including service dependencies, validation of group membership, and access to the systems that keep operations running.
- Reduce delegation drift in Active Directory Review group nesting, privileged role assignment, and inherited access so the recovered environment returns to a known-good authorization state instead of preserving old errors.
Bottom line: DORA pulls identity systems into the core resilience model because critical services cannot recover cleanly if access, authentication, and delegation are not restored with them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:40 pm
Identity resilience is now a compliance control, not a separate security goal. DORA forces financial entities to prove that the systems behind authentication and access can be recovered as part of business continuity. That shifts identity from an enabling layer to a regulated resilience dependency. The practical conclusion is that IAM, PAM, and directory recovery need to be measured with the same seriousness as service uptime.
A question worth separating out:
Q: How should teams align Zero Trust with DORA resilience goals?
A: Treat Zero Trust as an access model that still depends on trustworthy identity data and delegation. DORA requires more than verifying users at the edge; it requires that the underlying directory and privilege structures can be restored cleanly enough to support reliable access decisions.
👉 Read our full editorial: DORA compliance and identity resilience: what practitioners need