DORA physical security and HR policy requirements explained

What DORA requires for physical security and HR policy

Articles 18 and 19 of Delegated Regulation (EU) 2024/1774 require a physical and environmental security policy and a human resources policy, and the financial entity owns both. A bank, payment institution, insurer or ICT provider serving them must show, on premises and in its people processes, how ICT assets are protected. The regulation does not hand this to a vendor or consultant. The organization decides what the policies say, who approves them and how they are enforced. The depth expected scales with the entity's size, threat landscape and asset classification. A data centre hosting critical or important functions warrants more than a small office with no ICT assets of note. Article 18 asks for protection against attacks, accidents and environmental hazards in proportion to importance, covering ICT assets inside and outside premises, plus clear desk and clear screen rules. Article 19 asks that ICT security responsibilities are assigned, that staff and ICT third-party staff know the policies and the channels for reporting anomalous behaviour, and that ICT and information assets are returned on leaving. Confirm with your competent authority how it reads proportionality for your entity type. A partner such as DeployOpen can help prepare the policy drafts, the asset return checklists, the training records and the evidence that shows the controls operate, such as access logs and visitor records. Only the competent authority or an independent auditor assesses whether the result meets DORA. Before engaging help, ask for a written scope that names the premises, the staff and contractor groups, and the evidence each deliverable will produce.

What the physical and environmental security policy must cover

Article 18 of Delegated Regulation (EU) 2024/1774 sets the scope of the physical and environmental security policy. The four areas below are distinct: premises and data centres, ICT assets wherever they sit, desk and screen habits, and the proportionate baseline for simplified-framework entities. Each one needs its own evidence, and an assessor will ask for it separately.

Premises and data centre protection

The policy must protect premises and data centres against attacks, accidents and environmental hazards, with the level of protection set by how important each site is to critical or important functions. Check that the site risk assessment covers fire, flooding, power loss, climate control and intrusion, and that each finding has an owner and a date. Physical access logs, visitor records and badge reviews are the usual evidence. Confirm with your facilities provider which logs they keep and for how long, because a cloud or colocation provider may hold part of the evidence.

ICT assets inside and outside premises

Protection cannot stop at the building wall. The policy must secure ICT assets that leave the premises, including laptops, removable media and equipment installed at third-party sites such as branches, field offices or a provider's facility. The equipment register should record where each asset is, who holds it and whether it is encrypted and tracked. Ask for the register extract and the procedure for lost or stolen devices. Shared responsibility for hardware at a third-party site must be written into the contract.

Clear desk and clear screen rules

The policy must set clear desk and clear screen rules so that sensitive information is not left visible or unattended. In practice this means automatic screen locks after a defined period of inactivity, locked sessions when staff step away, and cleared desks at the end of the day. The evidence is the endpoint configuration showing the lock timeout, a sample of compliance checks or spot audits, and staff awareness records. Test the rule on the systems that hold the most sensitive data first.

Simplified framework measures

Entities under the simplified framework must still implement physical security measures, but the scope follows the threat landscape and the classification of each asset under Article 32 of the same regulation. Document why the chosen controls fit the entity's risk, and keep a record of the threat review that supports the decision. Assessors will expect the classification to be current and the measures to match it. Ask your advisers to confirm whether your entity qualifies for the simplified regime before you scale the measures down.

How clear desk and clear screen rules get tested

A clear desk and clear screen rule asks staff to leave no sensitive material exposed when they step away: no printed client data, credentials or hardware tokens left on desks, and workstations that lock automatically after a set period of inactivity. Article 18 of Delegated Regulation (EU) 2024/1774 requires the rule to exist within the physical and environmental security policy, so the organization must show it has been decided and written down, not just assumed. The parameters are the organization's own decisions: how long a screen may sit idle before locking, which document types count as sensitive, where printers and shredders sit, and how visitors are handled in shared areas. Confirm those parameters with your auditor or competent authority contact before you finalize the policy, because an assessor will test the rule against the wording you chose.

An assessor usually works through four kinds of evidence. The first is the policy text itself, checked for a clear statement of the rule, named owners and an exception process. The second is technical configuration: directory group policy or mobile device management settings that enforce the idle lock, exported and compared against the parameters in the policy. The third is spot checks, where the assessor or internal audit walks the office or remote workspace at unannounced times and records what is visible. The fourth is awareness records showing that staff were trained on the rule and that training is part of the compulsory modules described elsewhere on this page. Keep the exported settings, dated spot-check logs and training attendance together so one request can be answered without reconstruction.

Writing the rule into policy matters because local habit does not survive turnover, hybrid working or a bad audit day. Teams that rely on informal norms tend to apply the rule differently across sites, and the difference only appears when someone checks. A written rule gives the security team a standard to enforce, gives managers a basis for corrective action and gives the organization something to show a regulator. An implementation partner can help configure the lock settings, prepare the spot-check checklist and assemble the evidence pack, but the rule, its parameters and the sign-off remain the organization's responsibility, and only the independent assessor reaches a conclusion on whether it works.

What the HR policy requires for staff, contractors and leavers

For staff employed by the financial entity, Article 19 of Delegated Regulation (EU) 2024/1774 expects the HR policy to do three things in practice: tie each person to clear ICT security responsibilities, require them to know and follow the ICT security policies that apply to their role, and give them a known route for reporting anomalous behaviour. The policy itself is only the start. An assessor will ask for proof that onboarding and role changes bring these duties to the person's attention and that the organization can show it did so.

Named responsibilities: Role descriptions or job profiles state which ICT security duties sit with the role, such as handling access requests, protecting devices or reporting incidents.
Policy acknowledgement: New joiners and staff who change roles confirm in writing or through a tracked system that they have read and will follow the relevant ICT security policies.
Reporting channels: Staff know how to report suspicious emails, lost devices, unusual system behaviour and possible insider activity, and they know who receives those reports out of hours.
Non-retaliation: The policy states that good-faith reports are protected, which encourages early reporting.
Disciplinary link: Breaches of ICT security policy are handled under the general disciplinary procedure, and the policy says so.

Check that acknowledgement records exist for every current employee, not only new joiners, and that reporting channels appear in the material staff actually receive.

How asset return on leaving gets evidenced

The sequence turns a departure into a documented trail: identity access ends, ICT and information assets come back, the asset inventory and identity records are reconciled, and a signed return record is kept for the retention period the organization sets. Article 19 of Delegated Regulation (EU) 2024/1774 requires staff and ICT third-party staff to return ICT and information assets when they leave, so each step below should leave a record an assessor can follow.

Issue the leaver notice from HR
HR or the line manager raises a leaver request that names the individual, the employing entity or contractor firm, the last working day and the managers responsible for handover. The request goes to IT, security and facilities at the same time, so each team starts from the same start date. The output is a dated leaver ticket in the workflow system, which becomes the first entry in the return record. Ask whether the process covers contractors and ICT third-party staff, since the Article 19 requirement applies to them as well as employees.
Disable accounts and revoke access
The identity team disables the individual's accounts, removes group memberships, revokes tokens and certificates, and closes privileged or shared-credential access the person held. Where the identity platform supports automated lifecycle actions, the leaver ticket should trigger them, with a manual check for systems outside the directory. The output is an access removal log showing each account, the time of disablement and the operator or automated job that performed it. Article 20 of the same Delegated Regulation expects the account lifecycle to be managed and recorded, so this log belongs with the identity records.
Collect ICT and information assets
The asset owner or facilities team collects laptops, phones, tokens, access cards, removable media and any paper or electronic information held by the leaver. Each item is checked against the asset inventory by serial number or asset tag, and anything not returned is logged as an open item with a named owner. The output is a return checklist marked item by item, including items recorded as not returned and why. Confirm with your own environment how private devices used for work are handled, since remote wipe and secure deletion rules apply to them.
Wipe, reassign or retire returned devices
Returned devices go through the defined handling path: secure deletion or re-imaging, reassignment in the inventory, or retirement and disposal. The person doing the work records the method and the result against the asset tag, and the inventory status changes to match. The output is a sanitization or disposal record linked to the asset. Ask providers of disposal services for certificates of destruction, and keep them with the return record.
Reconcile the asset inventory with identity records
Before sign-off, a reviewer compares the list of assets assigned to the leaver in the inventory with the list of accounts and entitlements removed from the identity system. Gaps in either direction are investigated: an asset with no matching account, or an account with no matching asset, usually signals a stale record in one system. The output is a reconciliation note with each discrepancy resolved or assigned. The inventory and identity records must agree at this point, because an assessor will test them against each other.
Obtain sign-off on the return record
The line manager and the asset owner confirm in writing that the returns are complete or that open items have an agreed route to closure. Security or the compliance lead reviews exceptions, such as lost devices or unreturned credentials, and records any incident that needs reporting under the incident process. The output is a signed return record covering the leaver, the checklist, the reconciliation note and any exceptions. Signing an incomplete record without a documented exception is the most common gap an assessor finds.
Retain the record for the set period
The signed return record, the access removal log, the sanitization certificates and the reconciliation note are filed together under the leaver's identity or employee reference, and linked to the asset records. The organization sets the retention period in its own policy, based on its risk assessment and applicable legal obligations, and the records are protected from unauthorized change. The output is a retained evidence bundle that can be produced for internal audit, a competent authority or an independent assessor. Ask the auditor which records they will sample and in what form they expect them.

Compulsory training under DORA

DORA asks for two kinds of training: compulsory resilience modules for staff and senior management, and a regular knowledge requirement for the management body. Assessors test both by asking for records, so each card names the record to keep and the check to run before the audit.

Compulsory modules for all employees

Article 13(6) of Regulation (EU) 2022/2554 makes ICT security awareness and digital operational resilience training compulsory for all employees and senior management. The module must cover the entity's own ICT policies, incident reporting routes and the physical and clear desk rules that apply to each role. Ask for the module content, the version date and the list of people assigned to it. A training catalogue alone does not show that every employee completed it.

Attendance and completion records

An assessor will ask who finished each module, when, and what happened to people who did not finish. Keep attendance logs from the learning platform, signed completion dates and a rule for overdue staff, such as access restrictions or manager escalation. Records should cover new joiners, contractors and staff who change role. Review the records against the current staff list, because leavers and movers often distort completion rates.

Third-party staff in scope

Article 30(2)(i) allows training obligations to extend to ICT third-party service providers where appropriate. Decide which providers have staff with privileged access, administrative tooling or contact with sensitive data, and write the training requirement into their contracts. Keep evidence that those staff completed the same resilience module. Where a provider refuses, record the risk assessment behind that decision.

Management body knowledge

Article 5(4) requires members of the management body to keep sufficient, up-to-date knowledge and skills to understand and assess ICT risk. The obligation calls for specific training at a regular interval that fits the risk the entity runs. Keep a training plan for each board or management member, the topics covered and the dates. Minutes showing the board questioned ICT risk reports also support the requirement.

Training content tied to policy

Training should match the policies it teaches, including the physical security policy, clear desk and clear screen rules and the reporting channels for anomalous behaviour. Assessors compare module content with the current policy version and look for gaps after policy changes. Record the policy version each module references, and retrain staff when a policy changes materially. Outdated slides are a common finding.

Effectiveness checks

Completion alone does not show that staff understand the rules. Some entities run short tests, simulated phishing or tabletop exercises for senior management and record the results. Use the outcomes to change the next module, and keep the findings. Ask your training provider to confirm which assessment evidence it can export, because the format of that evidence varies between learning platforms.

Who owns each physical and HR control

This table separates three roles for each physical and HR requirement under Article 18 and Article 19 of Delegated Regulation (EU) 2024/1774 and Article 13(6) of DORA: the organization that owns the control, the implementation partner that prepares drafts and evidence, and the competent authority or independent auditor that assesses it. Read each row to see where accountability stays inside the financial entity. The main takeaway is that outside help can draft and prepare, but the management body and staff remain accountable for the controls operating.

Requirement	Organization owner	Implementation partner typically prepares	Competent authority or independent auditor assesses
Physical and environmental security policy	Chief information security officer, with facilities and the management body approving	Policy draft mapped to premises, data centre and asset scope, plus site risk inputs and review schedule	Whether the policy exists, is approved, is proportionate to asset importance and is applied in practice
Clear desk and clear screen rules	Information security function and line managers, enforced by facilities and HR	Rule wording, staff guidance, screen lock settings baseline and spot-check checklist	Whether the rules are communicated, enforced and checked with recorded results
Human resources security policy	HR director and CISO jointly, with the management body accountable for approval	Draft policy assigning ICT security responsibilities, reporting channel design and contractor clauses	Whether responsibilities are assigned, staff and ICT third-party staff are bound by the policy and training is recorded
Offboarding and asset return	HR leavers process owner and IT asset manager	Leaver checklist, asset return form, evidence template linking account removal to device return	Whether returns of ICT and information assets are logged on departure and sampled records match actual leavers
Compulsory ICT security and resilience training	CISO for content ownership, HR for completion tracking, management body for its own training	Training modules for employees, senior management and relevant providers, completion report templates	Whether modules are compulsory for all staff and senior management, completion is tracked and content fits the entity's risks

How to get ready and when outside help makes sense

Before a supervisory review or an internal audit, the physical and HR side of DORA needs four things that exist on paper and in practice. First, the physical and environmental security policy and the HR policy must be approved by the right people and dated, with the clear desk and clear screen rules written into them. Second, the asset inventory must show which laptops, portable media, access cards and premises or data centre locations hold ICT assets, so that returns and physical controls can be traced to something. Third, training records must show that every employee, senior manager and relevant ICT third-party staff member completed the compulsory ICT security and digital operational resilience modules, and that management body members kept their knowledge current. Fourth, pull the offboarding files of the last several leavers and check that asset returns, account removals and reporting-channel reminders are recorded. Gaps in these four areas are usually easier to find internally than to explain to an assessor later.

Outside help makes sense when the gaps are in systems and evidence rather than in judgement. An implementation partner can review the policies against Articles 18 and 19 of Delegated Regulation (EU) 2024/1774, rebuild the inventory from access logs and asset records, set up training tracking, and prepare offboarding checklists that produce evidence each time. DeployOpen works this way: most engagements are fixed-scope, with the scope, deliverables and timeline agreed in writing before work starts. The organization keeps ownership of its policies, decisions and controls. Any quote follows from that written scope, so ask for the list of deliverables, the systems touched, the staff time you must provide and what happens if the scope changes.

Be clear about what no partner can give you. DORA sets no certification scheme, and competent authorities supervise compliance using their own powers under Article 50. The only authority-issued attestation the Regulation provides for concerns threat-led penetration testing under Article 26(7). A consultant or implementation partner cannot issue an attestation, report or certificate that your physical and HR controls comply with DORA. Where you want independent assurance, engage an auditor or assessor who is accepted in your supervisory context, and confirm with your competent authority what evidence it expects. Your partner's job is to make that review straightforward by having the policies approved, the records complete and the evidence ready before the assessor arrives.

Questions buyers ask about DORA physical and HR requirements

Does DORA require a physical security policy separate from the ICT security policy?

DORA requires a physical and environmental security policy, but the structure is your choice. What matters to an assessor is that the policy exists, has a named owner and covers the required content. Article 18 of Delegated Regulation (EU) 2024/1774 expects the policy to protect premises and data centres from attacks, accidents and environmental hazards in proportion to their importance. It also covers securing ICT assets inside and outside premises and setting clear desk and clear screen rules. Many organizations keep it as a separate document because facilities, security and IT teams often own different parts of it, and a separate file makes review and sign-off simpler. Whether you keep it standalone or fold it into a wider policy set is a structural decision. Confirm it with your competent authority and your assessor before you restructure your documents.

How far does the physical security rule reach into contractor premises?

The rule covers your premises, your data centres and the ICT assets you hold inside and outside them. Any equipment or data you keep at a contractor site is therefore in scope, even though the building belongs to someone else. You cannot write a provider's building controls into your policy as if you own them. Your obligations reach that site through the contract. Define the physical protection, environmental controls and asset handling you require, check them through due diligence or audit rights, and keep the evidence the provider gives you. Article 19 also expects ICT third-party staff to know and follow your ICT security policies and to return assets when they leave, so contractor onboarding and offboarding belong in the same process as your own staff. Where a provider runs critical or important functions, align these terms with your third-party risk requirements and confirm the scope with your assessor. Illustrative example: a colocation cage holding your payment systems is an asset you must protect, even though the provider runs the building.

What offboarding evidence does an assessor expect when staff leave?

An assessor looks for proof that each leaver's access was removed and every ICT or information asset came back, recorded in a traceable way. Article 19 requires staff and ICT third-party staff to return ICT and information assets when they leave. Article 20 requires full account lifecycle management, with identity records kept after reorganisations or contract end. Useful evidence includes:

A dated asset return checklist signed by the line manager and the leaver, covering laptops, tokens, badges and removable media
Account disablement and removal records from the directory and key applications, linked to the ticket or workflow that triggered them
Revocation records for physical access credentials
Retained identity assignment records showing who held which account and for how long

Sample a set of recent leavers during your own review. Gaps usually appear where contractors or shared accounts are involved. Confirm with your assessor how long these records must be kept and in what form.

Must DORA security awareness training be repeated every year?

DORA leaves the repetition cycle to your own risk assessment, so the frequency is set by your organization and must be justified. Article 13(6) makes ICT security awareness and digital operational resilience training compulsory modules for all employees and senior management. Where appropriate, it extends to ICT third-party service providers. Members of the management body have a separate duty under Article 5(4) to keep up-to-date knowledge and skills in line with the ICT risk they oversee. Practical steps include keeping attendance records for each person, covering new joiners before they receive access, tracking completion for contractors where they are in scope, and updating content after significant incidents or major changes. Confirm the frequency you have chosen with your competent authority, because supervisors judge whether your cycle matches your risk profile.

How much effort does DORA physical and HR policy work take?

Effort depends mostly on headcount, the number of sites and how many usable records you already hold. Costs have three parts: internal time from HR, facilities, security and IT owners; any physical or environmental changes to premises or data rooms; and external help, such as an implementation partner working to a written scope. Some costs are one-time, such as writing the policies, building the asset return process and cleaning up historic accounts. Others recur, such as training cycles, periodic access reviews and evidence retention. The largest swing factors are how complete your asset inventory is, whether leavers and contractors already pass through a documented process, how many sites you run, and whether physical controls need hardware work. Ask any provider for a quote built from a written scope that lists sites, headcount bands, systems in scope and deliverables, and ask which items are one-time and which recur.

Can our own team handle DORA physical and HR requirements in-house?

Yes, many organizations run these requirements internally, and DORA does not require an outside firm. You own your controls. HR owns the employment and offboarding process, facilities and security own premises protection, and IT owns account and asset records. An implementation partner can help prepare systems and evidence, for example by building identity lifecycle workflows, consolidating asset records or setting up training modules, under a fixed scope agreed in writing. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and it runs security training. Its work centres on the systems, evidence and documentation of what it delivers, while your HR and facilities owners keep the decisions. DeployOpen does not issue audit reports. Only an independent auditor or your competent authority assesses compliance. Decide early which parts your team can sustain after handover, because the recurring work of reviews, training and leaver checks stays with whoever owns it.

How DeployOpen prepares physical and HR evidence

DeployOpen helps regulated financial entities prepare the physical security, environmental controls and HR records that DORA's ICT risk management standard expects, inside the client's own premises and data centers. We prepare systems, controls and evidence; the organization owns its policies, and an independent assessor or competent authority judges them.

How we scope

Engagements are fixed-scope, with the premises, data centers and staff groups in scope agreed in writing before work starts.
The written scope lists which policies, access records and training modules will be drafted, reviewed or configured.
Scope names the ICT third-party staff and contractors covered by the HR policy and who signs each document.

How we build

We draft the physical and environmental security policy around the organization's asset classification and threat assessment.
We configure identity lifecycle and asset return records in the client's own tooling so leaver evidence can be pulled on request.
We set up clear desk and clear screen checks, visitor logs and reporting channel procedures that staff can follow in practice.

How we hand over

Deliverables include the approved policy text, procedure documents, configuration records and a mapped evidence index.
We walk the organization's owners through each artifact so they can answer assessor questions without us present.
Training modules are delivered in a form the client can maintain and repeat for new staff and senior management.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Retainers can cover periodic reviews of access records, leaver checks and refresher training content as staff change.
Confirm with your competent authority or assessor which evidence formats and review cycles they expect before scoping.

DORA physical security and human resources policy requirements