DORA & Privileged Access

The Digital Operational Resilience Act (DORA) has applied to EU financial entities since 17 January 2025. For ICT third-party providers the requirements take effect indirectly – through the contractual terms DORA mandates; providers designated as critical are additionally subject to direct EU oversight. Privileged access (administrators, maintenance accounts, external providers reaching critical ICT systems) sits at the centre of it: it is an attacker's most effective lever, and therefore a direct focus of DORA's ICT risk management.

Article 9 (Protection and prevention) requires financial entities to limit access to ICT systems to what is necessary (least privilege, Art. 9(4)(c)) and to protect it with strong authentication mechanisms (Art. 9(4)(d)). The related Regulatory Technical Standards (Delegated Regulation (EU) 2024/1774) make this concrete for identity and access management: privileged access only on a need-to-use/ad-hoc basis, every action attributable to an identifiable person, restriction of generic and shared accounts, and logging of security-relevant events (RTS Art. 12 and Art. 21).

In practice this means four things for privileged access: no permanently open standing access, but access on demand and time-limited; strong authentication (MFA) before every session; a recording of what actually happens inside the session; and a tamper-proof record of who did what and when – auditable for the supervisory authority and external auditors.

DORA explicitly obliges financial entities to actively manage the risk arising from ICT third-party providers (Article 28) and to keep a register of information covering all ICT service contracts. The most critical touchpoint is the technical access that external providers obtain to productive, critical ICT systems – for maintenance, support or operations.

Precisely this remote access must be controlled, observable and interruptible at any time. A provider reaching a core banking system through a permanently open VPN tunnel or shared administrative credentials conflicts with the DORA/RTS requirements: there is no clear attribution to the acting person (the RTS require identifiability and the restriction of shared accounts), no traceability of the session, and no ability to intervene immediately if something looks wrong.

As an ICT provider you are affected too – through the contractual DORA requirements of your financial clients and, where designated as critical, through direct EU oversight. You must be able to demonstrate that your access to client systems is controlled, traceable and interruptible. A controlled, recorded access layer is therefore relevant to both sides of the contract.

DORA and the RTS require privileged activity to be logged and made available for supervision and audit. A pure network or login log is not enough: it shows that access happened, but not what took place in the session. Session recording closes this gap by making the privileged session itself reconstructable.

Decisive for auditability is actor accuracy: every security-relevant action must be attributed to the actual human – not to a technical shared or service account behind which several people disappear. Attribution therefore happens centrally at the gateway, tamper-proof and time-stamped.

These recordings are not an end in themselves: during a supervisory review or after a security incident they provide the evidence of effective control – for DORA as well as for NIS2, ISO 27001 and (for OT systems) IEC 62443. The evidence comes from the system, not from policy documents written after the fact.

The Blackfort Privileged Access Bridge (PAB) is the control layer that anchors exactly these DORA requirements structurally in the access process – instead of documenting them afterwards. It brokers privileged access to IT, OT and cloud systems as an agentless, hardened jump server: the user works in a recorded remote session, without anything being installed on the target system or the endpoint.

The DORA-relevant controls are therefore not additional work but part of the access itself: time-limited, on-demand access instead of permanently open tunnels; strong authentication before the session; session recording; live supervision from which a critical session can be terminated immediately; and a tamper-proof, actor-accurate audit trail as auditable evidence.

The PAB is operated in an EU-sovereign manner, either on-premises at the financial entity or as a managed service by Blackfort – including a break-glass model in which the operator retains no standing administrative access. This fits DORA's logic: controlled, demonstrable access without creating a new uncontrolled dependency.