Achieve Digital Operational Resilience Act (DORA) compliance

The European Union's Digital Operational Resilience Act (DORA) aims to improve operational resilience of digital systems in the financial sector. The EU cyber legislation seeks to tighten ICT risk management, incident reporting, and business continuity practices.

IS Decisions solutions, UserLock and FileAudit, help in-scope organizations comply with DORA requirements thanks to effective access security, auditing, and reporting that touch each of the 5 DORA pillars.

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, sets a cybersecurity framework for financial entities and the ICT providers who support them. The EU regulation entered into force on 16 January 2023 and applies as of 17 January 2025.

DORA breaks down cyber resilience into 5 pillars: 

1. Robust ICT risk management: You must identify, assess, and manage security risks thoroughly.

2. ICT incident management, classification, and reporting: You must report significant ICT incidents to relevant authorities.

3. Operational resilience testing: You should have tested procedures in place to maintain essential services.

4. ICT third-party risk management: Your governance framework should ensure ongoing compliance and oversight.

5. Information sharing: You should actively share and exchange relevant cyber threat intelligence, vulnerabilities, and best practices with competent authorities, peers, and other stakeholders to support coordinated detection and response to potential threats.

User identity and access management (IAM) is a cornerstone of DORA compliance for organizations using on-premises or hybrid Active Directory.

DORA applies to all financial entities that operate in or with the EU and their third-party ICT providers. This includes: 

• Banks and credit institutions

• Payment and e-money institutions

• Investment firms and asset managers

• ICT service providers working with EU financial institutions

Even if you are an ICT provider outside the EU, if you support or have contracts with EU-based financial institutions, you may still fall under DORA’s scope. DORA also includes financial institutions providing ICT services to other financial entities. 

The financial sector is a top target for cyberattacks because of the high-value data it handles. DORA seeks to improve the operational resilience of financial digital infrastructures by setting standardized rules to manage and mitigate security risks. Non-compliance can expose financial entities to severe operational failures, damage customer trust, and bring heavy regulatory fines.

Maintaining secure access controls and real-time visibility into who is accessing what data is essential, especially in Active Directory environments that form the backbone of many financial institutions' legacy identity and access management systems.

DORA’s five pillars lay out a framework for achieving operational resiliency at the EU’s financial institutions. If your organization is looking to achieve and maintain DORA compliance, here’s how UserLock and FileAudit can help.

Organizations must identify, assess, and manage security risks comprehensively. DORA emphasizes proactive risk assessments, strong identity and access management (IAM), and the application of least-privilege principles within the AD environment.

While DORA doesn't specifically call out multi-factor authentication (MFA), it does mandate policies and protocols for strong authentication. In practice, implementing MFA for DORA compliance aligns with the regulation's aim to mitigate risks tied to unauthorized access, reinforcing the protection of customer data and the security of critical financial infrastructure.

With UserLock and FileAudit, you can strengthen your organization’s ability to assess, detect, and mitigate critical security risks, meeting a key element of the first DORA pillar.

DORA mandates that significant ICT incidents be classified, documented, and reported to relevant authorities. Effective incident management requires detailed audit logs that expedite root-cause analysis.

By implementing UserLock and FileAudit, you gain the visibility and logging capabilities necessary to classify incidents accurately, report promptly, and prevent further damage.

To maintain essential services during disruptions, DORA calls for regular testing of systems and processes, including penetration testing, tabletop exercises, and scenario-based assessments.

UserLock and FileAudit support operational resilience testing thanks to a centralized audit log and detailed reports that help demonstrate access control strength and incident response capabilities.

DORA emphasizes governance frameworks that address risks posed by third-party ICT providers. This includes ensuring those providers adopt the same security standards, especially when integrated with your AD environment.

To manage third-party access with UserLock and FileAudit, each third-party user must be created locally and added as a protected account. Once added, you can configure the desired access restrictions for each user.

With UserLock and FileAudit, you can demonstrate control over third-party access to systems and data, helping you to meet DORA’s stringent third-party governance requirements.

DORA encourages cooperation and information exchange between financial entities and authorities to strengthen collective resilience. Sharing threat intelligence and incident data can limit the spread of attacks across the entire ecosystem.

With accurate, centralized security logs, your organization can quickly share threat information with authorities and peer financial institutions, fulfilling DORA’s information-sharing obligations.

Although the exact penalties for non-compliance may vary by jurisdiction and supervisory authority, financial institutions could face:

• Significant monetary fines

• Operational bans or restrictions

• Damage to reputation and customer trust

With regulatory scrutiny increasing, ensuring compliance with DORA is a strategic priority, not just a regulatory checkbox.

1. Assess current security measures: Conduct a gap analysis of your AD environment and identify critical areas for improvement.

2. Implement IAM best practices: Enforce strong authentication, session controls, and least-privilege principles.

3. Introduce continuous auditing: Monitor user access to critical files and folders in real time to reduce dwell time and unauthorized activity.

4. Refine incident response plans: Develop classification workflows and align them with DORA’s mandatory reporting guidelines.

5. Engage with suppliers: Ensure that third-party vendors and service providers align with your security standards and DORA requirements.

UserLock and FileAudit provide the essential layers of identity and file access security required to align with DORA’s requirements.

• Multi-factor authentication (MFA) for AD user logins

• Granular access policies and session controls to manage when, where, and how users can log in

• Real-time alerts and remediation to lock or log off suspicious sessions instantly

• Detailed session auditing for compliance reporting

• Complete file access visibility with real-time monitoring across Windows file servers

• Automated alerts on unauthorized or suspicious file access

• Centralized auditing to streamline reporting and incident response

• Historical access trails for thorough forensic investigations

By combining these two solutions, you can tightly control who has access to critical data, detect anomalies, and share actionable intelligence with regulators — all key to maintaining resilience and meeting DORA’s stringent compliance mandates.