Identity and access management Explicit identity management requirements (Art. 20 RTS RMF) BaFin notes that BAIT/VAIT already implied identity management, but DORA now makes it an explicit, documented discipline. What DORA now explicitly requires Under Art. 20 RTS RMF, financial entities must have documented identity management guidelines and procedures that ensure: Impact vs. BAIT/VAIT “Need-to-use” principle and strengthened access management (Art. 21 RTS RMF) The access management part in RTS RMF adds one new principle and tightens some frequencies, otherwise it mostly re-labels BAIT/VAIT ideas. 1. The new principle: “need-to-use” Art. 21 RTS RMF introduces the “need-to-use” principle as a complement to: from BAIT/VAIT Chapter … Continue reading Identity and access managementRead More →