DORA Board Training Requirements: A Practical Guide

Start with the entity and the people, not the course catalogue

DORA has applied since 17 January 2025. Its financial-sector scope is defined by entity categories and exclusions; it is not a general training law for every European company. Use your licence, legal entity and relevant supervisory rules to establish the starting point. EIOPA’s DORA overview explains the sector context; Article 2 is the scope provision.

Create a one-page scope record before assigning learning. List the regulated entity, the framework it follows, its governing bodies, the people holding those positions, and the person who validated that mapping. A group-level programme can supply common content, but a subsidiary board still needs to understand its own services, dependencies and decisions. An overseas parent’s completion report does not tell you whether local directors understand the local recovery arrangements.

Use actual governance responsibilities when defining the audience. “Management body” is a legal term, mapped through Article 3(30), and is not simply a synonym for everyone with “manager” in their job title. Ask your governance or legal team to confirm the mapping for your structure. Include newly appointed members in the training register immediately; do not leave them waiting for the next group campaign.

Keep one important exception visible: entities within Article 16’s simplified framework do not apply Articles 5–15 directly. Their training and governance requirements follow that framework and its technical standards. Simplified does not mean training-free.

Separate the requirement from the training format

Article 5(4) links regular, specific learning to the ability to understand and assess ICT risk and its business impact. Article 13(6) separately addresses staff and senior-management awareness and resilience training. Neither provision gives a universal number of annual course hours.

That distinction matters when procuring a programme. A provider can supply a coherent syllabus, a learning record and an assessment. Your company must still decide whether the content addresses the responsibilities and risk exposure of its participants. A certificate cannot validate a recovery plan the learner has never seen, or a supplier dependency that the course does not know exists.

Set observable outcomes before choosing the format. After learning, a director should be able to explain which service would be most damaging to lose, identify where management’s evidence is weak, and describe the decisions that remain with the board during a disruption. An executive should be able to apply their own escalation arrangements without searching through unfamiliar policy documents.

A practical programme therefore has three layers: a shared conceptual foundation, a briefing about the organisation itself, and a decision exercise. Online study suits the first layer; a service owner and risk lead can provide the second; a facilitated discussion tests the third. The combination is a suggested design, not a mandated delivery method.

Build a training matrix around decisions people make

The following matrix is a starting template. Replace the examples with your company’s real responsibilities and keep sensitive operational details within your controlled learning environment. Give every row an owner who can confirm whether the promised learning outcome was achieved.

A useful matrix has more than a list of modules. Add the required language, accessibility needs, next review date, material version, assessor and remedial action. Someone may understand the basic vocabulary yet need help interpreting a business-impact analysis. Another person may have deep technical expertise but little familiarity with financial-sector governance.

Do not assign everyone the same remedial programme because one person struggled. Record the gap precisely: “Could not identify who authorises emergency customer communication” produces a useful action; “Needs more cyber awareness” does not. Ask the participant to revisit the relevant internal procedure and then explain the decision in their own words.

Choose a defensible cadence and explicit refresh triggers

EIOPA’s final Q&A DORA 250-3380 connects training frequency to roles and proportionality, and points to lessons from incidents and relevant threat intelligence when updating programmes. A calendar alone is therefore an incomplete design. Document both your normal cycle and the events that can bring learning forward.

For a board starting from a weak baseline, a reasonable internal proposal is induction on appointment, a planned annual foundation review, focused briefings before material decisions, and an exercise when the business or threat picture warrants it. These are suggested scheduling choices. The annual foundation review is not a fixed statutory training frequency, and a high-change or high-risk business may need substantially more.

• A new operating model, acquisition or critical service introduces unfamiliar dependencies.
• A material incident exposes confusion about escalation, customer impact or recovery authority.
• A test shows that an assumed workaround cannot operate at the required scale.
• A provider change alters concentration, access to data or exit feasibility.
• A director changes committee role or assumes a new responsibility.
• A material legal or supervisory development changes the decisions the board must understand.

Give someone responsibility for reviewing those triggers. A training register that only sends expiry reminders will miss the most useful moments to learn. Add a short “training impact” field to significant change proposals and post-incident actions so the programme can respond to events.

Reserve time for discussion. A five-minute briefing that results in a clear, recorded decision may be more useful than another hour of passive slides. That does not make five minutes sufficient for the overall programme; it shows why relevance and understanding should be measured alongside duration.

Retain evidence of learning and what changed afterwards

Build an evidence chain that a colleague can follow without interviewing the programme administrator. The chain should run from an identified learning need, through relevant content and participation, to an assessment and any resulting action. This is our suggested record structure; it is not a claim that DORA prescribes this exact set of fields.

1. Record the audience, role and reason the learning was assigned.
2. Keep the syllabus, material version, delivery date and source-review date.
3. Record attendance or completion in a way that identifies the actual participant.
4. Retain assessment results and a concise account of the questions used.
5. Record gaps, the person responsible for resolving them and a completion date.
6. Link substantive discussion to the relevant board decision or action log.

Assess judgement as well as recall. “Which article covers governance?” checks memory. “The provider reports recovery, but transaction reconciliation is incomplete: what evidence do you request before resuming normal service?” tests a useful executive distinction. Participants need not select identical operational choices, but they should recognise uncertainty and explain their rationale.

A completion rate should always have a denominator and a date. “Eight of ten in-scope members completed the current foundation; two newly appointed members have scheduled induction” is more informative than “80% compliant.” Training status and regulatory compliance are different things.

Set retention and access rules with the people responsible for privacy, records and governance. Keep individual assessment detail restricted to those who need it; a board pack may only need the aggregate position and unresolved gaps. Preserve the historical course version so a later reviewer can see what was actually taught.

Worked example: use one disruption to reveal the real learning needs

Consider this fictional exercise. A financial company’s customer transaction portal is unavailable at 09:15. Its supplier says that infrastructure is healthy but cannot yet confirm the consistency of queued transactions. Customer support is receiving duplicate-payment complaints. The next executive update is due in twenty minutes.

First decision: define the problem in business terms

Ask participants to describe the affected service, the customers exposed and the consequence of waiting. A strong answer distinguishes a service being reachable from transactions being reliable. It also names what is unknown. If the discussion immediately becomes a debate about the supplier’s technical terminology, the programme needs more work on translating technical facts into business consequences.

Second decision: identify authority and escalation

Ask who can restrict transaction processing, who coordinates the incident, who applies the reporting procedure, and when the board receives an update. Participants should use their own approved roles and procedures. Do not invent a reporting deadline for the exercise or wait for a full board meeting before an authorised team can follow an existing incident-reporting obligation.

Third decision: agree the evidence for recovery

The supplier announces that the platform is available again. A director should ask what reconciliations, business checks and customer protections support resumption. The exercise should allow management to explain different options and their consequences, including controlled partial service. “The dashboard is green” is an observation, not a complete recovery argument.

End with a short debrief. Perhaps the board understood escalation but could not distinguish the recovery target from the latest demonstrated result. Assign a focused learning action, ask the service owner to improve the report, and revisit the decision at a later meeting. This creates a direct link between learning, evidence and better oversight without pretending that a tabletop proves the technical recovery capability.

Evaluate a DORA course against your board’s needs

Use a procurement brief that asks what participants will be able to do afterwards. Request a syllabus, an example executive scenario, the legal sources and their review date, the assessment approach, and the information available in completion records. Ask how the provider corrects material when the legal or supervisory position changes.

Look for clear boundaries. A foundation course should say which issues require an organisation-specific discussion. If a supplier claims that completing a single module makes your company DORA-compliant, ask how it has assessed your operating model, controls, contracts and evidence. The claim cannot be substantiated merely by delivering training.

Prefer plain explanations of availability, data integrity, service dependencies, recovery and risk ownership over a large glossary. A board does not need to configure a firewall to challenge an unsupported recovery assumption. It does need the confidence to ask what management has tested and what remains uncertain.

BlueTeam Academy’s Cybersecurity Training for Executives & Boards provides an introductory starting point: approximately 25 minutes across six lessons. Use it to establish common language, then add your internal service briefing, role-specific discussion and ongoing learning plan. Completion is a learning record, not accreditation or a conclusion that your organisation complies with DORA.

A practical 90-day plan for an existing board

This is an implementation sequence for improving a programme, not a regulatory grace period. Prioritise urgent knowledge gaps immediately where they affect decisions already being made.

Appoint one programme coordinator, while keeping subject ownership with the appropriate functions. The coordinator can chase completion and preserve records; the risk lead validates relevance, service owners explain the operating reality, and the chair protects time for meaningful discussion. Document how absences, new appointments and unresolved assessment gaps are handled.

At the final review, sample one participant’s complete learning record and one action arising from the exercise. Can you show both that the person learned something relevant and that the organisation acted on the resulting issue? If either link is missing, improve that link before adding more content.

Bring these questions to the next board meeting

• Have we identified every person whose role requires this learning?
• Can each member explain our most consequential ICT dependency?
• Does our programme include our own service and recovery evidence?
• Which recent incident, test or change should alter the training plan?
• What unresolved learning gaps could affect a decision this quarter?
• Can we trace a learning activity to better challenge or a completed action?

Use the answers to set a focused agenda. A board with strong foundation knowledge may need a detailed discussion about one supplier. A newly appointed board may need the basics before it can interpret the risk dashboard. Both should be able to explain why their programme fits their responsibilities.

Continue with our guide to DORA board responsibilities and the practical DORA board reporting dashboard. Together, they connect what directors learn to the decisions they make and the information they ask to receive.