IAM TechDORA (Digital Operational Resilience Act)
In force since January 2025 for EU financial entities — with strict expectations around Information and Communication Technology (ICT) access control and third-party risk.
What is DORA?
The Digital Operational Resilience Act is an EU regulation requiring financial entities — and increasingly their UK counterparts operating in the EU — to demonstrate robust ICT risk management, including strong controls over access to critical systems.
DORA places particular emphasis on third-party and ICT vendor risk: financial firms must be able to show they govern not just their own staff's access, but every vendor, contractor, and service provider touching critical systems.
How IAM Tech helps
Third-party access governance and privileged access management are exactly where DORA's expectations bite hardest — and exactly where we spend most of our time.
- Third-party and vendor access lifecycle governance
- Privileged access management for critical system access
- Access certification evidence mapped to ICT risk requirements
- Non-human identity governance for service accounts and integrations
See our full approach to IAM for Financial Services & Banking →