DORA: How an IAM system strengthens the digital resilience of financial companies

The Digital Operational Resilience Act (DORA) is a European Union regulation aimed at strengthening the digital operational resilience of companies in the financial sector against cyber attacks. It officially comes into force on January 17, 2025. The aim is to enable financial institutions to provide their digital services consistently even in the event of a cyber attack and to respond quickly to security incidents. DORA defines specific requirements that companies in the financial sector must meet in order to make their information and communication technology (ICT) more resilient. The regulations cover risk management, ICT incident reporting, stress testing, the management of risks posed by third-party ICT providers and information sharing within the sector.

Are you affected by DORA and need help with IAM at short notice?

IAM regulates access to systems and data

Identity and Access Management (IAM) plays a crucial role when it comes to complying with DORA regulations. IAM is a collective term for processes and technologies that support companies in managing digital identities and their access requests. Three basic functions can be distinguished:

• Identity Governance & Administration (IGA)

• Access Management (AM)

• Access management for users with high access rights (Privileged Access Management, PAM)

An IAM system ensures that only authorized persons have access to critical systems and data. Access is regulated via roles and authorizations. Multi-factor authentication (MFA) is a security-enhancing principle in this context. In addition, the IAM supports compliance with DORA reporting requirements by creating detailed logs of access attempts and activities.

Detect security gaps at an early stage

An effective risk management strategy is essential in order to comply with the provisions of the new EU directive. IAM systems make an important contribution to this. The continuous monitoring and evaluation of access rights ensures better management of companies’ IT risks. Comprehensive insights into all levels of system access enable potential security gaps to be identified and rectified at an early stage. DORA requires financial companies to report ICT incidents promptly and provide detailed reports on serious incidents.

The IAM also creates the conditions for managing user access throughout the entire lifecycle. As part of this user lifecycle management, access rights can be easily adjusted according to an employee’s role and responsibilities – for example, in the event of a promotion. It is equally important to revoke authorizations when an employee leaves the company. This prevents former employees from continuing to have access to sensitive information and posing a security risk.

Managing third-party risk

One of the biggest challenges for companies in the financial sector is managing security risks that arise from working with ICT third parties. DORA requires companies to ensure the digital resilience of their service providers and to apply the same standards as for internal systems.

In this respect, an IAM system enables companies to control and monitor third-party access to their own systems and data. By implementing strict access controls and regular checks, they ensure that third-party providers only access the information they need for their work.

Conclusion: Effective IAM strategy as a security factor

An effective IAM strategy makes a valuable contribution to meeting the DORA requirements. With the help of IAM systems, companies make their IT landscapes more resistant to cyber attacks and ensure operational continuity. Automated management and monitoring of access rights identifies potential security vulnerabilities at an early stage so that companies can take appropriate countermeasures. This minimizes the risk of security breaches and ensures that companies can continue to provide their services even in the event of a cyber attack.

In addition, IAM supports companies in meeting the requirements of DORA in terms of risk management, incident reporting and third-party risk management. By providing detailed reports and analytics, IAM helps to monitor and improve security protocols. This results in increased customer and partner confidence and greater business stability and resilience.