DORA compliance with Cloudi-Fi: identity, network access control, device visibility, and audit evidence for financial institutions.
Financial services depend on connected people, devices, and locations. A bank branch may accommodate employees, visiting customers, maintenance contractors, printers, and building systems, each with different connectivity needs. Clear access rules help protect business operations while allowing these connections to serve their intended purpose.
The Digital Operational Resilience Act (DORA) places those decisions within a broader approach to managing information and communication technology (ICT) risk. For financial institutions, network access is one practical area where policy, implementation, and evidence can be brought together. Cloudi-Fi supports this work through authentication, device context, centralized policies, and access records.
What is DORA?
DORA, formally Regulation (EU) 2022/2554, has applied since January 17, 2025. It establishes a common EU framework for digital operational resilience in the financial sector. Its scope includes banks, payment institutions, investment firms, insurers, and other specified financial entities, subject to the regulation’s exclusions and proportionality provisions. ESMA’s DORA overview explains the framework and links to the applicable rules.
DORA brings together several areas of responsibility:
- ICT risk management, including protection, detection, response, and recovery
- Management and reporting of major ICT-related incidents
- Digital operational resilience testing, with advanced testing for selected entities
- ICT third-party risk management, contractual requirements, and oversight of designated critical providers
- Voluntary sharing of cyber threat information under defined conditions
The management body retains responsibility for ICT risk and must oversee the relevant arrangements. Where a financial entity also falls within NIS2 scope, DORA provides the sector-specific EU framework for the relevant ICT risk-management and incident-reporting requirements. DORA, Articles 1 and 5, establish this relationship and governance responsibility. The related Cloudi-Fi article on NIS2 compliance and network access explains the broader cybersecurity context.
Why DORA makes network access a business priority
Financial institutions need continuity across branches, offices, and operational sites. Shared passwords, unclear device ownership, and inconsistent access settings complicate that objective. Security teams need to establish which connection belongs to which identity, what access is appropriate, and whether the configured controls work in practice.
A branch illustrates the customer perspective. Visitors need internet connectivity. A contractor may need access to a specific service. Employee devices and building equipment have separate business purposes. Applying distinct access policies helps maintain those boundaries. The financial institution’s assessment determines how each service supports business functions and how a disruption could affect operations.
The joint European Supervisory Authorities’ first annual DORA incident report provides useful context. Its analysis of 2025 records:
- 3,383 major ICT-related incidents in the dataset
- 29% attributable to a failure at a third-party provider
- 1,056 major incidents with cross-border impact
These findings reinforce the relevance of understanding dependencies and retaining usable evidence. They describe financial-sector operations and do not establish Wi-Fi as an incident’s cause or measure the effectiveness of any product. The report also notes that incident counts alone are not a risk indicator.
How Cloudi-Fi supports DORA compliance
Cloudi-Fi supports selected technical controls within a financial institution’s wider DORA program. The detailed ICT risk-management rules address logging, network security, identity, and access control. Delegated Regulation (EU) 2024/1774, Articles 12, 13, 20, and 21, provides the relevant requirements. The mapping below illustrates possible contributions and the evidence that teams can assess.
1. Establish identity before granting access
Cloudi-Fi Cloud NAC supports 802.1X authentication, including certificate-based EAP-TLS and directory-based methods. Compatible switches, access points, and controllers apply the resulting access decisions.
For external users, the Cloudi-Fi Captive Portal supports methods including sponsor approval, SMS, and SAML integration. Selecting authentication according to the purpose and sensitivity of the connection creates a more accountable approach than relying on a shared credential across different populations.
2. Add device context to asset records
Cloudi-Fi’s IoT capabilities use DHCP fingerprinting to help classify devices by attributes such as type, operating system, and manufacturer information. Cloud DHCP provides visibility into IP leases and subnets across participating sites.
Correlating this information with asset owners, approved uses, and business dependencies can support investigations and reviews. Profiling provides context; the institution’s asset register and business-impact assessment establish ownership and criticality. Sensitive access also requires suitable identity assurance.
3. Apply access policies according to business need
Cloudi-Fi Cloud NAC can return VLAN assignments, roles, and access-control lists for compatible infrastructure to enforce. Guest, employee, contractor, and equipment connections can therefore receive different permissions.
A useful validation checks the resulting connectivity: which services a device can reach, which connections are restricted, and how changes affect existing sessions. Effective segmentation depends on the combined configuration of authentication services, switches, access points, firewalls, and other enforcement components.
4. Retain evidence for investigations and reporting
Cloudi-Fi’s compliance capabilities include access logging, data-retention features, and SIEM integration. These records can help link an observed connection with available user, device, and session context.
Operational reviews should assess log coverage, retention, access permissions, and correlation with other systems. DORA incident procedures must also distinguish incident awareness, classification, and reporting milestones. Delegated Regulation (EU) 2025/301 specifies the notification and report timelines, including applicable exceptions. Access logs contribute evidence to that process; incident classification and regulatory submissions remain part of the institution’s procedures.
5. Maintain consistent controls and test dependencies
Centralized authentication and policy management support a common access approach across supported locations and infrastructure. This can make policy reviews and changes easier to coordinate as branches or offices evolve.
Resilience testing should include the access service’s dependencies. Relevant scenarios may include loss of WAN connectivity, an unavailable identity provider, or an authentication-service disruption. Reviewing configured fallback behavior, recovery procedures, and supporting records helps establish how the complete deployment behaves under stress.
Assessing ICT providers within the DORA program
Financial entities remain responsible for compliance when using ICT third-party services. DORA requires a register of contractual arrangements and sets requirements for supplier assessment and contracts, with additional provisions for services supporting critical or important functions. DORA, Articles 28–30, establishes these responsibilities.
For a Cloudi-Fi deployment, procurement, risk, and security teams can assess the proposed service architecture, processing locations, subcontracting arrangements, service levels, incident cooperation, audit provisions, and exit planning. Contractual commitments and supporting documentation need to match the institution’s requirements and the service’s assessed role.
Cloudi-Fi contributes to identity, access policies, device context, and evidence across the network. A complete DORA program also requires governance, business continuity, recovery, testing, supplier oversight, and incident reporting. Bringing these activities together helps financial institutions maintain useful, reviewable controls throughout everyday operations.
Cloudi-Fi’s Zero Trust Network Access checklist provides a starting point for assessing network access controls within that wider resilience program.