Understanding the Digital Operational Resilience Act (DORA) MFA requirement
UserLock supports DORA MFA requirements while simplifying implementation in on-premises and hybrid Active Directory environments.
Updated February 17, 2025)
)
)
)
The Digital Operational Resilience Act (DORA) is a European Union (EU) regulation that aims to strengthen cyber resilience of digital systems in the financial sector. Part of Europe’s push for tighter cybersecurity measures, one standout requirement is stronger user authentication through multi-factor authentication (MFA).
If you’re managing an Active Directory environment in that space, here’s what you need to know about DORA’s MFA requirement, some AD integration challenges you may face, and how UserLock can simplify compliance.
First, let's break down DORA’s MFA requirement and show you how UserLock can help you achieve DORA compliance without turning daily operations upside down.
In Article 9.3 DORA emphasizes "strong authentication." In practice, DORA's aim is for EU financial entities and their ICT providers to:
Implement at least two factors to verify user logins (for example, something you know, something you have, or something you are).
Prioritize MFA for high-risk access or privileged accounts.
Continuously monitor user authentication to address threats as they evolve.
Since DORA is in full effect as of 17 January 2025, financial entities and ICT providers working with them that don’t meet these requirements may face penalties or enforcement measures.
Passwords alone are not enough to protect access to user accounts. From phishing scams to credential stuffing, attackers have countless ways to obtain or crack simple credentials. By enforcing multi-factor authentication, you immediately strengthen your frontline defense, forcing attackers to bypass multiple security barriers instead of just one.
One compromised account can trigger a chain reaction, disrupting services and undermining confidence in your organization. MFA helps you:
Minimize downtime: Fewer successful breaches mean fewer crises to manage.
Safeguard critical data: Only verified individuals can modify essential systems or access sensitive information.
Because DORA specifically mentions stronger authentication, MFA is no longer just a best practice for the EU's financial sector — it’s also a compliance requirement. By deploying MFA systematically, you can directly address Article 9's "strong authentication" requirement and demonstrate a proactive approach to protecting critical infrastructure.
Overly complex or slow authentication methods can frustrate users and disrupt productivity. You need an MFA solution that’s both effective and user-friendly, ensuring better adoption rates and minimal friction for employees.
Financial institutions typically rely on a patchwork of legacy systems, cloud platforms, and third-party applications. Making all these systems work well with MFA requires careful planning, robust APIs or connectors, and centralized policy enforcement.
When thousands of users login simultaneously every day, your authentication service must handle peak demand without lag. Poorly performing systems can slow down critical operations and undermine user confidence in security controls.
With DORA’s application date in the rearview mirror, organizations looking to implement MFA for the first time or roll it out across all users need to act quickly.
UserLock extends the native capabilities of Windows Active Directory to provide centralized access management and multi-factor authentication.
Designed for organizations that need to secure large, distributed user bases, UserLock helps you layer MFA with contextual access controls on:
Who can log on (based on AD users, groups, and OUs).
Where they can log on (workstations, servers, remote connections, IP address, geolocation).
When they can log on (enforce time-based rules).
UserLock offers flexible authentication methods to accommodate different risk profiles and user preferences, including:
Push notifications
Authenticator apps
Hardware tokens or keys
With the option to choose up to two MFA methods per user, IT can tailor security levels to user roles and systematically implement DORA Article 9 requirements across all users.
With UserLock, you can:
Define MFA policies for all users, both privileged and non-privileged.
Set customized MFA policies and frequency by:
Protected account
)
Connection type
)
Session type
)
Monitor real-time status to see who’s logged on, from where, and with which authentication factors.
)
)
)
)
)
)
)
)
)
)
)
)
)
This centralized, granular approach ensures consistency and allows you to implement security without frustrating your end users (or IT!).
With UserLock, IT can monitor user sessions in real time and can remotely respond to suspicious activity:
Alert administrators so IT can investigate and respond immediately.
)
Logoff or block users to stop suspicious access and prevent lateral movement.
)
)
)
)
)
)
)
These features align with DORA’s focus on continuous monitoring and rapid containment of security incidents.
Whether you manage a small office or thousands of users across multiple sites, AD admins appreciate UserLock’s scalability. Implementation is easy, and you can easily set access policies according to the AD user groups and OUs you already have, ensuring you can deploy MFA broadly without extensive downtime or disruption.
With UserLock, you get an MFA solution specifically tailored for Windows Active Directory environments. Its user-friendly workflows, scalable architecture, and comprehensive policy controls ensure you can meet Article 9 head-on — without overwhelming your IT team or disrupting your users.