Book an initial call
Book an initial call

The challenge

Unequal rules for non‑human identities

The DORA RTS covers service accounts, technical users and AI agents in more places than many institutions assume. Only one obligation applies to employees alone, and that is exactly where audit discussions begin.

Book an initial call

The challenge

Where unequal rules become a problem

  • Shared service accounts

    An account used by three teams does not breach the unique user account requirement. That requirement only applies to employees.

  • No accountability

    If the log cannot tell apart the actions of a shared account, the accountability required by Article 21(c) is missing.

  • No access reviews

    Technical accounts are often left out of access reviews because they are not people. The regulation gives no grounds for this.

  • Not a legal term

    Service account, technical user and non-human identity do not appear in the regulation. BAIT and VAIT, which covered technical users, no longer apply under DORA.

  • Impact

    A gap in the wording

    Obligations for technical accounts follow from articles written in general terms. In the audit, both sides argue over this wording.

    • Shared accounts without a named owner
    • Actions not traceable to a user
    • Access remains after the purpose is gone
    • Technical accounts missing from access reviews
    • No answer when the auditor asks
  • Our approach

    Same rules for every account

    Every non-human identity is treated the way the regulation requires for all accounts. We close the one gap ourselves: a dedicated account, a named owner and access reviews on the same cycle as for employees.

    • A dedicated account per non-human identity and per agent
    • Owner under Article 21(e)(i)
    • Lifecycle management for all accounts, automated where possible
    • Access reviews annually, every six months for critical functions
    • Logs with synchronized timestamps
REQUIREMENTPROVISIONEMPLOYEESSYSTEM, AGENTUnique identification and authenticationArt. 20(1)Unique user account per identityArt. 20(2)(a)Lifecycle management of all accountsArt. 20(2)(b)Access based on need-to-know and least privilegeArt. 21(a)Limit generic accounts, ensure accountabilityArt. 21(c)Review access rights annually, critical ones semiannuallyArt. 21(e)(iv)Logging of access control and identity managementArt. 12(2)(c)Six of seven requirements apply regardless of account type. Only one is worded for employees alone.REQUIREMENTEMPL.SYSTEM,AGENTUnique identificationArt. 20(1)Unique account per identityArt. 20(2)(a)Lifecycle management of all accountsArt. 20(2)(b)Need-to-know accessArt. 21(a)Limit generic accountsArt. 21(c)Access reviewsArt. 21(e)(iv)LoggingArt. 12(2)(c)Only one obligation appliesto employees alone.

Results

What the same rules for all accounts achieve

  • Clear legal basis

    For every requirement on technical accounts, the provision in the DORA RTS is named. The auditor sees what each control is based on.

  • Traceable actions

    Every action can be traced to an account and therefore to an owner, as Article 21(c) requires.

  • Reviews on schedule

    Technical accounts go through the same access reviews as employee accounts, annually and every six months for critical functions.

  • End-to-end traceability

    Synchronized timestamps under Article 12 make a chain of actions across several systems traceable.

Abstract digital network icon

Approach

From gap analysis to audit

All ICT systemsat least annuallyCritical or importantfunctions, semiannuallyStart6 mo.12 mo.Access reviewafter 12 monthsall account typesAccess reviewafter 6 monthsall account typesAccess reviewafter 12 monthsall account typesSAME CYCLE FOREmployeesService accountsAI agentsApplies within the DORA RTS framework
  1. 01

    Inventory

    An inventory of all service accounts, technical users and AI agents with purpose, target systems and last use.

  2. 02

    Map to the regulation

    For each account type, we check which articles of the DORA RTS apply and where gaps exist today.

  3. 03

    Split shared accounts

    Shared accounts are split until every action can be traced to one account and one owner.

  4. 04

    Link to access reviews

    Technical accounts join the same review cycle as employee accounts, with revocation as soon as the purpose is gone.

  5. 05

    Audit evidence

    An overview per requirement with the provision and the control in place.

Ready for the next step

Talk to us about your technical accounts

Tell us briefly about your project. We will get back to you and discuss where your IAM stands today.

    Thank you for your inquiry.

    Your message has been sent successfully. Our team will get back to you shortly.