Branch and head office staff
Moving between roles and buildings constantly
Third-party access
Supplier access, on the record
DORA moved third-party access from a facilities question to a regulatory one. Every third party in your buildings, time-bound, approved and reportable.
Banking & Finance
DORA third-party physical access governance for financial entities
Supplier access is now a board-level report
Who is on your sites
ICT third parties
In comms rooms and data rooms, often out of hours
Cash-in-transit and vault access
Dual control, tightly defined, heavily scrutinised
Regulators and auditors
Asking for the review you have not run yet
What you are held to
DORA · NIS2 · regulator inspection
- Physical and environmental protection of the ICT assets that run the business
- Third-party ICT providers governed, including their physical access
- Access reviews performed, evidenced and repeatable on demand
Where it breaks today
- An engineer from an ICT supplier was granted comms room access in 2021 and still has it
- Branch staff accumulate access as they move roles, and nothing ever takes the old rights away
- The third-party access review is assembled by hand each time the regulator asks
The regulator asks which of your ICT suppliers can physically reach your systems, and when you last checked. The answer has to be a report you can run on the spot.
Banking & Finance
Scenario
A supervisory review of third-party access
The regulator asks for every ICT supplier with physical access to critical systems, and evidence that it has been reviewed.
Held against the supplier
Access is held against the contracting company and its contract. The question can be answered by supplier in one filter.
Reviewed on a cycle
The owner of each comms room re-confirms who should still hold access, on schedule, and the confirmation is recorded.
Anything unconfirmed drops
Access nobody re-confirms simply expires, instead of quietly staying open.
The evidence is the by-product
The review record, the approvals and the reasons export as the submission, without a project to assemble them.
What changes
- Third-party physical access is reportable by supplier and by contract, on demand
- Access reviews run on a schedule, instead of arriving as a response to a regulator's letter
- Rights stop accumulating as people move roles, because the role is what grants them
Delivered
Already running in this sector
6,000badges swapped
A European financial institution
6,000 badges swapped at the machine in a few weeks.
The old badge collected, the new one printed, personalised and encoded to MIFARE DESFire EV3, without anybody at a desk.
Named references are shared under a non-disclosure agreement.
Questions
Frequently asked questions
How does Axxession help with DORA physical access requirements?
Physical access to ICT assets is held against the contracting company and its contract, as well as the individual. The owner of each room reviews it on a schedule, and it is exported as evidence. Access nobody re-confirms simply expires.
Can we report third-party access by supplier?
Yes. Access is anchored to the contracting company and contract. The question 'which ICT suppliers can physically reach our critical systems' is answered with 1 filter, without starting an investigation.
How do access reviews work?
The owner of each zone re-confirms who should still hold access on a defined cycle. The confirmation, the approver and the reason are recorded, and anything unconfirmed expires.
The first step
Start with 1 site and 1 population.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay