In a nutshell: DORA compliance is not synonymous with security – digital resilience emerges only through consistent, centrally controllable security architecture beyond checklists.
The Digital Operational Resilience Act (DORA) mandates banks and insurers to implement governance, processes, and third-party controls – yet formal compliance does not guarantee actual resilience against cyberattacks. The absence of consistent technical governance remains a critical risk.
Since its adoption, DORA has established a binding European framework for managing ICT risks, cyberattacks, and dependencies on third-party service providers. Financial institutions in the EU have responded by adapting their governance structures: they document policies, establish reporting processes, and maintain outsourcing registers. From a regulatory perspective, these structures are assessed as meeting requirements – a checkbox in the compliance process.
In practice, however, significant gaps emerge between formal compliance and operational security. Even when DORA requirements are met on paper, the grown legacy system landscape of many institutions severely complicates consistent technical governance: certificates are distributed across different applications, cryptographic keys are managed decentrally, identity and authorization concepts are not consistently implemented. In cloud and third-party environments, transparency regarding the actual implementation of security-relevant processes is often lacking. These structures may be compliant with regulations, but they increase complexity and thus the demands on control and responsiveness considerably.
Consistent security architecture does not emerge from checklists or isolated measures, but through a centrally controllable, permanently auditable system landscape. Central governance of digital identities is a core element: in modern, borderless infrastructures with external actors, security decisions shift to the identity layer. Zero-Trust approaches capture this reality by ensuring authentication and authorization consistently based on defined identities – not on traditional network boundaries.
For CISOs this means: meeting DORA is necessary, but not sufficient. Parallel to compliance, consistent technical architecture must be built that enables central control over identities, cryptography, and access rights and remains transparent.
Source: www.it-daily.net · Published 3 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification via Lumi News Pipeline v1.7.2.