IAM selection: the criteria that matter under NIS2 and DORA

Why it matters

SAML and OIDC cover modern applications, and that is where every vendor's catalog looks impressive. The applications that hurt in an audit are the others: the on-premises ERP with its own user table, the shared account on the shop floor, the tool that only speaks a header-based or Kerberos login. If the platform cannot reach them, those systems stay outside your access control and outside your evidence.

Why it matters

Push notifications and one-time codes are better than passwords, but attackers bypass both routinely through real-time phishing proxies and push fatigue. FIDO2 and passkeys bind the credential to the legitimate site, so a fake login page cannot harvest it. NIS2 Article 21 requires multi-factor authentication; it does not say which kind, so the quality of the factor is your decision, and your auditor will ask why you chose it.

Why it matters

Roles are how you turn "need to know" into something a system can enforce and an auditor can read. Without a role model, entitlements are granted one by one, copied from a colleague and never removed, and the answer to "who can approve payments" is a database query nobody can run. NIS2 and DORA both expect access to be granted on a documented, role-based basis.

Why it matters

Orphaned accounts are the quiet failure of most IAM deployments: the contractor who left in March still has a working login in September. Under NIS2 and DORA you must be able to show that access is granted on a need basis and removed when the need ends. That evidence only exists if the platform reads from an authoritative source, such as HR, and provisions and deprovisions downstream through SCIM or a connector without a ticket.

Why it matters

Almost every organisation still has an Active Directory or an LDAP directory that file servers, printers, VPNs and half the internal applications authenticate against. The new platform either becomes the source of truth for that directory, synchronises with it, or runs beside it, and each option decides where a disabled account is actually disabled.

Why it matters

The accounts that administer the identity platform can create any other identity, and the domain admins, database owners and cloud root accounts can undo every control below them. Standing privileges on those accounts are the target of every serious intrusion. Whether the platform can vault, rotate, elevate just in time and record those accounts, or hands that off to a separate PAM product, decides how many tools your privileged access story has.

Why it matters

Provisioning gives people access; governance proves that the access is still justified. Under NIS2 access control policies and under DORA access rights to critical systems have to be reviewed, and the auditor asks for the last review campaign with its decisions. If the platform cannot run a certification, where a line manager confirms or revokes each entitlement and the revocation is executed and logged, you buy a second product or run the review in a spreadsheet, which is the same as not running it.

Why it matters

Zero trust means every access decision considers who is asking, from which device, in what state, for what resource, every time, instead of trusting the network location. For the identity platform that translates into concrete features: device posture in the policy, continuous session evaluation, risk signals from the EDR, and policies per application instead of per network. Without them, the VPN remains the control and the identity platform a login page.

Why it matters

Under NIS2 and DORA the identity log is the evidence: who authenticated, from where, which entitlement was granted by whom, when an account was disabled. If the log lives only inside the vendor's console with a 90-day window, or if administrative changes and failed attempts are not in it, you cannot answer the auditor's question about last year, and you cannot feed the SIEM that has to correlate the incident.

Why it matters

The person who creates a supplier should not be the one who approves its invoice; the administrator who grants an entitlement should not be the one who certifies it. Separation of duties is how fraud and error are kept structurally hard, and DORA and every financial auditor expect it to be enforced by the system, not by a policy document. The identity platform is where the conflicting combinations are visible across applications.

Why it matters

The identity store holds every employee's name, role, device, location and authentication history. That is personal data under GDPR, and for a regulated organisation it is also the map of who can reach what. Where it is stored and from where it is administered decides your Schrems II exposure and your answer to the residency question in a DORA register of information.

Why it matters

The vendor's own security is your security: a breach of the identity provider is a breach of every application behind it. SOC 2 Type II and ISO 27001 are the attestations that let you put the vendor in your supplier file under NIS2's supply chain measure and DORA's third-party risk rules, provided the scope actually covers the service and region you buy.

Why it matters

NIS2 Article 21 names MFA and access control among the required measures; DORA expects identity and access management for critical systems to be demonstrable and the provider to sit in the register of information with the contract clauses Article 30 requires. Readiness is not a certificate the vendor holds, it is whether the platform produces the evidence and the contract carries the clauses.

Why it matters

Most intrusions today start with a valid credential. The identity platform sees every login and is the first place an impossible travel, a new device, a password spray or a session token replay becomes visible. If it does not raise those signals, or raises them only in a dashboard nobody watches, the attack is discovered by the EDR weeks later.

Why it matters

Applications talk to each other with tokens, not passwords, and the identity platform issues those tokens. How it handles OAuth 2.0 scopes, token lifetimes, client credentials for machine identities and the revocation of a leaked token decides whether your API estate is governed or whether every service holds a long-lived secret nobody rotates.

Why it matters

Workforce identities are only part of the population. External partners, customers, service accounts and machine identities usually outnumber employees, and vendors price them on different models. A platform that looks affordable for 500 staff can become expensive once 3,000 supplier logins and every API client count as billable identities.

Why it matters

Every application points at the identity platform, so moving in means re-integrating every one of them, migrating users, groups, credentials and MFA enrolments, and running old and new in parallel for months. The effort is measured in application count and legacy share, not in licence size, and it is where most IAM projects lose their first year.

Why it matters

An identity platform is the hardest system to leave, because every application points at it. The migration out costs the same as the migration in, plus the risk of losing credentials, group structures and audit history. DORA expects a documented exit strategy for critical ICT services, and this is one.

Why it matters

You sign for three years and the platform has to carry the acquisitions, the customer identity programme and the machine identity explosion that arrive in that time. Whether the vendor invests in the directions you will need, and whether the architecture scales to ten times the identities without a re-platforming, decides whether this decision has to be made again in year two.

Why it matters

A platform that users find slow or confusing is bypassed: passwords get shared, MFA prompts get approved blindly, and shadow accounts appear. A platform that administrators find clumsy is misconfigured, because the exception that took an hour to configure properly gets configured quickly instead. Adoption is where the security you paid for is either realised or lost.

Why it matters

IAM is licensed per user, per identity type, per feature module or in bundles, and the same organisation costs very different amounts under each model. External users, service accounts, customers and the MFA hardware all fall into different price lines, and the model that fits a 500-person company is rarely the one that fits a group with 30,000 identities and 200 applications.

Why it matters

The quote covers year one at today's user count and today's modules. The costs that surprise come later: the governance module that turned out to be needed for the audit, the log retention beyond the base window, the premium support tier the migration required, the price increase at renewal and the professional services nobody itemised.

Why it matters

At the end, the decision needs one number per vendor that can be compared: the quoted licence price for the configuration you will actually run, over the term you will actually sign. Every other criterion in this catalog feeds into how much that number is worth; this one makes sure it exists and that it is comparable.