# Identity Controls for DORA

Source: https://startwithidentity.com/guides/compliance/identity-controls-for-dora/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

The EU Digital Operational Resilience Act (DORA) applies to financial entities and their critical ICT providers, and it makes strong identity and access management an explicit operational-resilience requirement. It began to apply in January 2025.

## What DORA expects of identity

DORA's ICT risk-management requirements translate into concrete identity controls:

- **Strong authentication and access management** for ICT systems, with least privilege and segregation of duties.
- **[Privileged access](https://startwithidentity.com/vendors/pam/) controls**, since privileged accounts are the highest operational risk.
- **Logging and monitoring** that supports incident detection and reporting, with tight timelines.
- **Third-party (ICT provider) access governance**, because DORA extends scrutiny to your supply chain.

## What good looks like

- Phishing-resistant [MFA](https://startwithidentity.com/vendors/mfa/) for workforce and especially privileged access.
- [IGA](https://startwithidentity.com/vendors/iga/) for least privilege, segregation of duties, and evidenced access reviews.
- [PAM](https://startwithidentity.com/vendors/pam/) with session recording and [just-in-time](https://startwithidentity.com/guides/implementation/zero-standing-privileges-rollout/) elevation.
- [ITDR](https://startwithidentity.com/vendors/itdr/) feeding the monitoring and incident-reporting obligations.
- Governed, time-bound access for third-party providers, with full audit.

## Common pitfalls

- Treating DORA as a documentation exercise rather than implementing detection and response.
- Ignoring third-party and ICT-provider access, which DORA explicitly covers.
- Privileged access without monitoring, incompatible with the resilience and reporting expectations.

## Related

[Financial services vertical](https://startwithidentity.com/verticals/financial-services/), [insurance vertical](https://startwithidentity.com/verticals/insurance/). Vendors: [PAM](https://startwithidentity.com/vendors/pam/), [ITDR](https://startwithidentity.com/vendors/itdr/), [IGA](https://startwithidentity.com/vendors/iga/).

## What makes DORA different from a checklist

DORA is a resilience regulation, not a control catalogue, so the question is not whether a control exists but whether you can demonstrate it works under stress. For identity that translates into three testable claims:

- **You can revoke access fast enough to matter.** Not just disable an account, but revoke [refresh tokens](https://startwithidentity.com/glossary/refresh-token/) and sessions, including for third-party ICT providers, and evidence the timeline.
- **You can detect identity-based incidents within your reporting window.** DORA's initial notification timelines are tight, and an intrusion that authenticates normally produces no alert unless something watches identity behaviour specifically.
- **You can operate during degradation.** If your identity provider is unavailable, what happens? A tested break-glass path is an operational resilience control, not an IT convenience.

## Third-party ICT access is the exposure

DORA extends scrutiny to critical ICT providers, and vendor access is consistently the least governed path in a financial institution: standing accounts, shared credentials, and remote sessions nobody records.

Practical shape: time-bounded access granted through an approval workflow, session recording for anything touching production, an owner per provider, and an inventory you can produce on request. The August 2026 N-able compromise, where attackers used a management platform's own remote session capability to reach downstream customer networks, is the concrete version of this risk.

## Evidence to keep

Access review output with revocation rates, privileged session recordings, the MFA exemption list with review dates, third-party access grants and their expiry, and incident timelines showing detection to notification. See [access certification](https://startwithidentity.com/glossary/access-certification/) and [zero standing privileges](https://startwithidentity.com/glossary/zero-standing-privileges/).

## Where to start