In today’s digital landscape, financial institutions and critical infrastructure providers often rely on legacy systems such as IBM z/OS to run their core operations. Cybersecurity and regulatory compliance are now inseparable priorities. The European Union’s Digital Operational Resilience Act (DORA) and the NIS2 Directive introduce strict requirements for continuous, auditable, and measurable mainframe security practices. These audits assess how access controls, data protection, monitoring, and segregation of duties are implemented, ensuring critical systems operate securely and comply with regulations.

Bsecure’s DataPASS solution automates mainframe security audits, performing weekly reviews of all z/OS security data. This approach reduces risk, enhances compliance reporting, and ensures organizations can demonstrate adherence to DORA and NIS2. This article will explore what a mainframe security audit entails, how DORA and NIS2 influence mainframe operations, and how DataPASS transforms traditional manual audits into an efficient, continuous compliance model.

What is a Mainframe Security Audit?

A mainframe security audit is a thorough evaluation of how security controls are configured and enforced within IBM z/OS environments. Its primary purpose is to uncover vulnerabilities, misconfigurations, and governance gaps that could compromise data integrity, confidentiality, and availability.

Key areas typically covered in a mainframe security audit include:

  • RACF, ACF2, and Top Secret configuration reviews
  • SMF log integrity and access controls
  • Dataset and USS access restrictions
  • Privileged user activity monitoring
  • Encryption and cryptographic key management
  • Compliance with CIS, STIG, and ISO 27001 standards

Unlike standard IT environments, mainframes demand auditors with deep technical expertise in z/OS internals and security subsystems. This complexity often results in audits being infrequent, labor-intensive, and based on partial data samples.

Why is it important for DORA and NIS2 compliance?

DORA focuses on the financial sector, demanding continuous, evidence-based ICT risk management, operational resilience, and audit traceability. NIS2, meanwhile, broadens cybersecurity obligations across sectors considered critical to European society, such as energy, healthcare, transport, government, and digital infrastructure.

For mainframe environments, compliance with both DORA and NIS2 requires:

  • Regular, evidence-based security assessments
  • Traceable controls for privileged users and critical systems
  • Rapid detection, categorization, and reporting of incidents (within 24 hours)
  • Oversight of third-party providers and supply chain security
  • Disaster recovery and operational resilience aligned with legal obligations

Effective mainframe security audits reduce the risk of insider threats, poorly governed access, delayed incident response, and reputational or legal damage. They also ensure organizations meet the continuous compliance expectations of regulators and internal stakeholders.

How DataPASS automates security audits

Traditional mainframe audits are costly, manual, and performed infrequently, which limits their effectiveness. DataPASS transforms this process into a continuous, automated security audit, providing organizations with real-time compliance insights.

DataPASS offers:

  • Weekly analysis of 100% of cataloged mainframe security data
  • Application of hundreds of internationally recognized compliance and risk controls
  • Dashboards visualizing compliance trends over time
  • Audit-ready evidence generation for DORA, NIS2, ISO 27001, and GDPR

Benefits of using DataPASS include:

  • Reduced manual audit effort and costs
  • Continuous monitoring of privileged users and critical systems
  • Traceable and actionable reporting for management and regulators
  • Unified framework covering multiple regulatory requirements simultaneously

By automating audits, DataPASS ensures that organizations can maintain full compliance, demonstrate accountability, and respond to risks in real time.

Weekly Audits vs. Traditional Models

Regular security assessments are no longer optional. By shifting from annual, manual audits to weekly automated audits, organizations gain actionable insights, reduce compliance gaps, and significantly improve their overall mainframe security posture.

Aspect Traditional Audit Weekly Automated Audit (DataPASS)
Frequency Annual or sporadic Weekly
Coverage Sample-based 100% of cataloged security data
Effort Manual, high Minimal, automated
Compliance Evidence Partial, point-in-time Continuous, audit-ready dashboards
Risk Detection Delayed Immediate detection of vulnerabilities
Cost High due to manual work Lower thanks to automation

Weekly audits reduce regulatory risk, uncover hidden vulnerabilities, and support continuous improvement initiatives required by DORA and NIS2.

Ensuring Mainframe Compliance under DORA & NIS2

The era of manual, point-in-time mainframe audits is over. Compliance with DORA and NIS2 demands continuous, traceable, and automated auditing practices. Traditional methods are too slow, incomplete, and costly.

Bsecure’s DataPASS enables organizations to:

  • Demonstrate compliance with DORA’s financial-sector mandates
  • Meet NIS2 governance and resilience requirements across critical infrastructures
  • Reduce audit fatigue by consolidating evidence into a single framework
  • Provide actionable insights for management and regulators

With weekly automated security audits, organizations can maintain resilience, manage risks proactively, and ensure full regulatory compliance. The question is no longer whether you can afford to audit your z/OS systems—but whether you can afford not to.