Background
Who the regulation applies to
DORA (Digital Operational Resilience Act) is the EU regulation on digital operational resilience in the financial sector. It applies directly to banks, insurance and pension companies, payment and e-money institutions, investment firms and a range of other financial entities – and indirectly to the IT providers delivering critical services to them.
Unlike NIS2, which is a directive and must be transposed into national law, DORA is a regulation: the requirements apply identically across the EU. Supervision sits with the financial authorities – in Denmark, the Danish FSA.
The requirements
Where DORA touches identity and access
- Access policies: documented policies for granting, changing and removing access to ICT systems.
- Least privilege: access must be limited to what the role requires and reviewed regularly.
- Strong authentication: requirements for strong authentication mechanisms, particularly for privileged and remote access.
- Privileged access: administrative rights must be managed, monitored and documented.
- Supplier access: third-party access falls under the same governance – including your IT providers'.
- Traceability: who has had access to what must be demonstrable to the supervisor.
From regulation to practice
The requirements map one to one onto the classic IGA and PAM disciplines: automated joiner, mover and leaver processes with HR as master, so access follows employment; recertification, so managers and system owners confirm at fixed intervals that access is still justified; and privileged access management with time-limited rights and a full audit trail.
The difference between DORA and an internal security project is the documentation: doing it is not enough – you must be able to prove it. An IGA platform produces that evidence as a by-product of the daily processes: who approved the access, when it was reviewed, and when it was closed.
Where should you start?
With a gap analysis: hold your current access processes up against DORA's requirements and find the holes – typically manual leaver processes, systems outside central governance and privileged access without time limits.
If you are already working on NIS2, the overlap is large: access management that satisfies DORA covers most of NIS2's access control requirements too. See also our article on NIS2 and access management.
Is your access management ready for inspection?
We map your identities and access processes and hold them up against DORA's requirements – with a prioritised plan for closing the gaps.
