DORA: access management at the heart of financial resilience
Banks and insurers have applied DORA since January 2025. Supervisors look closely at entitlements, privileged accounts and third-party access.
The EU Digital Operational Resilience Act (DORA) has applied to financial entities since 17 January 2025. Its technical standards set precise expectations on access control: least privilege, strong authentication, regular reviews and traceability.
What supervisors check
- Permissions granted on a need-to-know and least-privilege basis.
- Periodic, documented access reviews.
- Strong authentication for critical and remote access.
- Strict management of privileged accounts and their sessions.
- Control over access granted to ICT third-party providers.
The classic pitfall: evidence
Many institutions already apply these principles but struggle to prove it. Excel exports, incomplete reviews, permissions inherited from old internal moves: this is where findings concentrate. A well-integrated IGA solution turns compliance into a tooled, auditable process.
We handle this in the field
- We support major banks and insurers on their IAM programmes.
- We automate user access reviews on SailPoint, Saviynt, One Identity or Usercube.
- We secure third-party and administrator access with PAM solutions.
Got a technical question on this topic? Our experts will be glad to help you find the answer.