DORA (Digital Operational Resilience Act – EU)

Covers DORA’s requirements for ICT governance, roles and responsibilities, risk management framework, and integration of ICT risk into overall operational risk management.

• Governance, Roles, and Responsibilities

  Explains what DORA expects from the management body, risk and IT functions, and how accountability for digital operational resilience is structured.

  Includes Lab
  Key Objectives:

  • Describe management body responsibilities under DORA
  • Define how ICT risk governance should be organized within a financial entity
  • Identify documentation and decision‑making evidence expected by supervisors

• ICT Risk Management Framework

  Describes the components of a DORA‑compliant ICT risk management framework and their integration into enterprise risk management.

  Includes Lab
  Key Objectives:

  • List the mandatory elements of an ICT risk management framework under DORA
  • Explain how to integrate ICT risk management with existing operational risk frameworks
  • Outline steps to perform ICT risk identification and assessment

• Documentation, Reporting, and Evidence for Supervisors

  Focuses on what documentation and evidence is needed to demonstrate a sound ICT risk management framework to regulators and auditors.

  Key Objectives:

  • Identify the key documents required to evidence DORA compliance
  • Explain how to structure ICT risk registers and reporting dashboards
  • Describe how to prepare for supervisory reviews and audits

Details DORA’s requirements for detecting, managing, and reporting ICT-related incidents, including classification, communication, and regulatory notifications.

• Incident Management Lifecycle Under DORA

  Introduces the end-to-end lifecycle for ICT incidents, from detection through to lessons learned and improvements, aligned with DORA expectations.

  Includes Lab
  Key Objectives:

  • Describe the stages of ICT incident management required by DORA
  • Differentiate between events, incidents, and major incidents
  • Explain the importance of post-incident reviews and learning

• Incident Classification and Regulatory Reporting

  Explains DORA’s framework for classifying incidents, identifying major incidents, and reporting them to competent authorities within specified timelines.

  Includes Lab
  Key Objectives:

  • Apply DORA’s criteria for classifying ICT incidents and identifying major incidents
  • Outline the information required in incident notifications to authorities
  • Coordinate internal and external communication around significant incidents

• Interaction With Other Regulatory Reporting Regimes

  Explores overlaps between DORA incident reporting and other reporting requirements (e.g., GDPR, NIS2) and how to coordinate them.

  Key Objectives:

  • Identify when multiple regulations may trigger parallel incident reporting obligations
  • Plan a harmonized reporting workflow to reduce duplication and errors
  • Clarify roles and responsibilities for multi-regime incident reporting

Covers DORA’s requirements for testing digital operational resilience, from basic testing to advanced threat‑led penetration testing (TLPT).

• Testing Strategy and Coverage

  Explains how to design a testing strategy that meets DORA requirements and aligns with existing testing and assurance programs.

  Includes Lab
  Key Objectives:

  • Describe the types of tests required under DORA
  • Plan a risk-based testing strategy focused on critical functions
  • Integrate DORA testing with existing security and continuity testing

• Advanced Threat-Led Penetration Testing (TLPT)

  Provides an overview of DORA’s advanced testing requirements, including threat‑led penetration testing and involvement of authorities.

  Key Objectives:

  • Explain the purpose and scope of TLPT under DORA
  • Identify when entities are expected to conduct TLPT
  • Describe the high-level process of planning and executing TLPT

• Scenario Testing, BCM, and DR Under DORA

  Focuses on scenario-based testing, business continuity management (BCM), and disaster recovery (DR) exercises in line with DORA.

  Includes Lab
  Key Objectives:

  • Design realistic resilience scenarios aligned with DORA expectations
  • Integrate ICT continuity and recovery testing with business processes
  • Evaluate test outcomes and refine continuity strategies

Addresses DORA’s stringent requirements for managing risks from ICT third‑party service providers, including contracts, oversight, and exit strategies.

• Outsourcing and ICT Third-Party Risk Framework

  Explains how to set up a robust framework for identifying, assessing, and managing ICT third‑party risks in line with DORA.

  Includes Lab
  Key Objectives:

  • Define ICT outsourcing, third‑party, and sub‑outsourcing in the DORA context
  • Design a lifecycle approach to ICT third‑party risk management
  • Align third‑party risk processes with procurement and vendor management

• Contractual Requirements and Key Clauses

  Details the specific contractual elements and clauses DORA expects for ICT service arrangements to ensure operational resilience and oversight.

  Includes Lab
  Key Objectives:

  • Identify mandatory contractual clauses for ICT third‑party contracts under DORA
  • Explain the importance of access, audit, and information rights
  • Plan exit and transition clauses to ensure resilience

• Oversight of Critical ICT Third-Party Providers

  Explores the specific oversight framework for critical ICT third‑party service providers and its implications for financial entities.

  Key Objectives:

  • Summarize how DORA introduces oversight for critical ICT providers
  • Explain how financial entities interact with designated critical providers and their lead overseers
  • Adjust internal oversight practices in light of external oversight mechanisms

Covers DORA’s provisions on information sharing, building a resilience culture, and designing a practical implementation roadmap and operating model.

• Threat Intelligence and Information Sharing

  Explains how DORA encourages information sharing on cyber threats and best practices, and how to participate in trusted communities.

  Includes Lab
  Key Objectives:

  • Describe the benefits and risks of cyber threat information sharing
  • Explain DORA’s provisions for information sharing arrangements
  • Plan participation in information sharing communities while maintaining confidentiality

• Building a Digital Operational Resilience Culture

  Focuses on the human and organizational factors necessary for effective DORA implementation: awareness, training, and cross‑functional collaboration.

  Key Objectives:

  • Identify key stakeholders and their roles in fostering resilience culture
  • Design awareness and training programs aligned with DORA
  • Promote collaboration between IT, security, risk, compliance, and business units

• DORA Implementation Roadmap and Operating Model

  Provides practical guidance on planning and executing a DORA implementation program and establishing a steady‑state operating model.

  Includes Lab
  Key Objectives:

  • Conduct a high-level DORA gap assessment and prioritize actions
  • Design an implementation roadmap with phases, owners, and milestones
  • Define a target operating model for ongoing DORA compliance and resilience