What breaks when identity governance is fragmented under DORA?

Where fragmentation breaks the identity governance chain

Fragmentation usually does not fail at a single control. It fails when request, approval, provisioning, review, and revocation live in separate tools or teams, so no one can show a continuous control story. That is why an identity and access governance baseline matters: it links entitlements, ownership, and review evidence into one accountable record.

When that chain is broken, the practical loss is traceability. You may still have logs, tickets, and spreadsheets, but they no longer prove that access was approved for the right reason, by the right owner, for the right period. Under DORA, that weakens the organisation's ability to show operational control over identity-related changes during normal operations and during incidents.

Why DORA makes disconnected identity evidence a resilience problem

DORA is not only about having controls, it is about demonstrating that critical ICT risk is governed consistently and can be evidenced under stress. A fragmented model turns resilience evidence into a reconstruction exercise, because teams must stitch together who approved access, which system created it, and whether the entitlement still matched the policy when the issue occurred. The governance problem becomes more visible when identity controls are mapped to DORA as part of the broader regulatory control set.

That matters most when access decisions cross operational, outsourced, or regulated boundaries. If the identity owner, the application owner, and the compliance reviewer all hold partial context, the organisation can end up with policy intent on one side and operational reality on the other. DORA amplifies that gap because evidence quality itself becomes part of operational resilience, not just an audit convenience.

What fragmented governance prevents you from proving

Fragmentation most often breaks three proofs: who had access, why they had it, and whether it was still justified at the point of use. Without a single governance view, recertification can miss stale entitlements, revocation can lag behind role change, and exceptions can survive past their intended expiry. An access model that keeps reviews, roles, and joiner-mover-leaver actions aligned with the access review and certification process gives you a cleaner evidentiary trail.

Fragmented control also weakens ownership. If no system clearly assigns accountability for a user, service account, or third-party access path, then remediation becomes ad hoc and review outcomes become hard to defend. That is why lifecycle governance is not a side issue here, and why the joiner-mover-leaver process is often where proof either holds together or falls apart.

Risk and Threat Considerations

Fragmented identity governance creates a soft target for both control failure and abuse. Stale or overbroad access can survive because no single team sees the full path from entitlement creation to revocation, and that creates opportunity for privilege creep, orphaned access, and delayed response when something looks wrong.

Failure mechanism: Control breaks occur when approval, provisioning, attestation, and offboarding are distributed across disconnected records or teams, so policy exceptions are not reconciled back to live access.

Impact: Attackers or insiders can exploit the resulting uncertainty to retain access longer, move laterally, or hide unauthorized use inside incomplete evidence, while defenders lose the ability to verify control effectiveness quickly.

Practitioner Guidance

What to verify: Confirm that every access entitlement has a traceable owner, approval path, expiry or review date, and revocation record. If any of those elements lives only in email, spreadsheets, or a local team workflow, treat the governance model as fragmented until proven otherwise.

Decision rule: If you cannot answer the access question from a single authoritative record set, prioritise governance consolidation before expanding more reviews. More attestations do not fix broken evidence chains if provisioning and deprovisioning still occur outside the control plane.

Practitioner takeaway: Under DORA, fragmented identity governance is a resilience defect, not just a reporting inconvenience, because the real failure is the loss of defensible proof over access change, ownership, and revocation.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• What breaks when social media accounts are not brought under identity governance?
• What breaks when identity governance architecture has fragmented connectors?
• What fails when third-party access is not tied to identity governance under DORA?