Module 1 – Introduction to DORA

• Overview of the Digital Operational Resilience Act (DORA):
  Understand the origins, objectives, and importance of the DORA regulation within the European Union’s financial ecosystem. Explore its role in ensuring that financial institutions can withstand, respond to, and recover from ICT-related disruptions.
• Objectives, Scope, and Key Definitions:
  Examine DORA’s scope, including entities covered (banks, insurers, investment firms, ICT providers), and learn key regulatory definitions such as “digital resilience,” “ICT risk,” and “critical third-party providers.”
• The Role of a Lead Manager under DORA:
  Define the strategic and operational responsibilities of a DORA Lead Manager in guiding compliance, managing cross-functional teams, and aligning digital resilience objectives with business goals.

Module 2 – Governance & Oversight

• Senior Management Responsibilities:
  Learn how DORA assigns ultimate accountability for digital operational resilience to the board and senior management. Understand their role in setting policies, risk appetite, and resilience objectives.
• Accountability and Decision-Making Processes:
  Explore governance frameworks that promote clear accountability, transparent decision-making, and effective escalation paths for ICT-related incidents.
• Integration of Resilience into Corporate Governance:
  Discover how to embed resilience principles into corporate strategies, enterprise risk management, and overall governance structures to support regulatory expectations.

Module 3 – ICT Risk Management Framework

• Risk Identification and Classification:
  Develop the ability to identify and categorize ICT risks, assess their potential impact, and map them across business functions and critical assets.
• Risk Mitigation Strategies and Controls:
  Learn to design and implement risk control measures, preventive strategies, and contingency plans aligned with DORA requirements and best practices.
• Continuous Monitoring and Review:
  Understand how to establish ongoing monitoring systems, metrics, and review cycles to ensure that the ICT risk management framework remains effective and up to date.

Module 4 – Incident Management & Reporting

• Major Incident Classification Criteria:
  Gain clarity on what constitutes a “major incident” under DORA, and how to apply objective criteria for classification and prioritization.
• Internal Escalation Processes:
  Learn to establish structured escalation pathways for timely internal communication and decision-making during ICT incidents.
• Reporting Obligations to Competent Authorities:
  Understand the regulatory reporting timelines, content, and format required for notifying national and EU authorities about major ICT incidents.

Module 5 – Digital Operational Resilience Testing

• Threat-Led Penetration Testing (TLPT):
  Examine the requirements for TLPT exercises, including scope, methodology, red team operations, and assessment of critical functions.
• Testing Methodologies and Frequency:
  Learn different testing types (scenario-based, vulnerability assessments, continuity tests) and how to define an appropriate testing schedule.
• Reporting and Remediation Plans:
  Develop capabilities in documenting test results, identifying weaknesses, and implementing remediation plans to strengthen ICT resilience.

Module 6 – Third-Party Risk Management

• Outsourcing Register and Contractual Requirements:
  Explore how to maintain a comprehensive outsourcing register and ensure contracts with ICT third-party providers meet DORA’s legal and operational requirements.
• Managing ICT Third-Party Providers:
  Learn methods for assessing provider risks, conducting due diligence, and setting performance and security benchmarks.
• Oversight of Critical Service Providers:
  Understand supervisory expectations regarding the monitoring of critical ICT providers and how to maintain business continuity in case of provider failure.

Module 7 – Information Sharing & Cooperation

• Collaboration Between Financial Entities:
  Learn how institutions can strengthen resilience through structured collaboration, sharing best practices, and coordinated incident response.
• Sectoral Threat Intelligence Sharing:
  Discover mechanisms for sharing cyber threat intelligence across the financial sector, and how this contributes to collective resilience.
• Ensuring Confidentiality and Security in Shared Data:
  Examine protocols for protecting sensitive data during information exchanges and maintaining compliance with data protection laws.

Module 8 – Achieving & Maintaining Compliance

• Compliance Monitoring Tools and KPIs:
  Learn how to track ongoing compliance through measurable performance indicators and automated monitoring tools.
• Gap Analysis and Remediation Strategies:
  Develop the ability to identify gaps in existing frameworks, prioritize actions, and implement effective remediation plans.
• Preparing for Audits and Regulatory Reviews:
  Understand how to document compliance efforts, prepare for supervisory reviews, and demonstrate a culture of continuous improvement in digital operational resilience.