Identity Controls for DORA

The EU Digital Operational Resilience Act (DORA) applies to financial entities and their critical ICT providers, and it makes strong identity and access management an explicit operational-resilience requirement. It began to apply in January 2025.

What DORA expects of identity

DORA's ICT risk-management requirements translate into concrete identity controls:

Strong authentication and access management for ICT systems, with least privilege and segregation of duties.
Privileged access controls, since privileged accounts are the highest operational risk.
Logging and monitoring that supports incident detection and reporting, with tight timelines.
Third-party (ICT provider) access governance, because DORA extends scrutiny to your supply chain.

What good looks like

Phishing-resistant MFA for workforce and especially privileged access.
IGA for least privilege, segregation of duties, and evidenced access reviews.
PAM with session recording and just-in-time elevation.
ITDR feeding the monitoring and incident-reporting obligations.
Governed, time-bound access for third-party providers, with full audit.

Common pitfalls

Treating DORA as a documentation exercise rather than implementing detection and response.
Ignoring third-party and ICT-provider access, which DORA explicitly covers.
Privileged access without monitoring, incompatible with the resilience and reporting expectations.

Financial services vertical, insurance vertical. Vendors: PAM, ITDR, IGA.

What makes DORA different from a checklist

DORA is a resilience regulation, not a control catalogue, so the question is not whether a control exists but whether you can demonstrate it works under stress. For identity that translates into three testable claims:

You can revoke access fast enough to matter. Not just disable an account, but revoke refresh tokens and sessions, including for third-party ICT providers, and evidence the timeline.
You can detect identity-based incidents within your reporting window. DORA's initial notification timelines are tight, and an intrusion that authenticates normally produces no alert unless something watches identity behaviour specifically.
You can operate during degradation. If your identity provider is unavailable, what happens? A tested break-glass path is an operational resilience control, not an IT convenience.

Third-party ICT access is the exposure

DORA extends scrutiny to critical ICT providers, and vendor access is consistently the least governed path in a financial institution: standing accounts, shared credentials, and remote sessions nobody records.

Practical shape: time-bounded access granted through an approval workflow, session recording for anything touching production, an owner per provider, and an inventory you can produce on request. The August 2026 N-able compromise, where attackers used a management platform's own remote session capability to reach downstream customer networks, is the concrete version of this risk.

Evidence to keep

Access review output with revocation rates, privileged session recordings, the MFA exemption list with review dates, third-party access grants and their expiry, and incident timelines showing detection to notification. See access certification and zero standing privileges.