The short answer
DORA Article 5(4) requires management-body members to keep their ICT-risk knowledge and skills current through specific training on a regular basis, proportionate to the risk being managed. It does not set one universal annual interval. Choose a documented learning cycle, consider applicable supervisory expectations and respond to material changes before the next routine refresher.
1. What the training provisions actually require
DORA has applied since 17 January 2025. Begin with the financial entity’s scope and applicable framework. Under the general framework, Article 5(4) concerns the management body’s ability to understand and assess ICT risk and its impact on operations. The purpose is current knowledge and informed judgement, rather than completing the same slide deck every twelve months. The words used in the provision do not specify a universal calendar interval.
Article 13(6) addresses compulsory ICT-security awareness and digital operational resilience training for employees and senior management. Its complexity must fit the remit of their functions, with relevant ICT providers included where appropriate. Eligible entities using Article 16’s simplified framework have different provisions, including needs-based staff and management training in Article 16(1)(h). Do not treat the board provision as the applicable legal basis for every learner or entity.
These distinctions matter when creating a learning calendar. A director, incident coordinator and customer-service colleague may all need learning after the same outage, but they need different decisions and levels of detail. A shared briefing may support several needs; separate commercial purchases are not mandated by that fact. Read the board training requirements guide before turning a legal obligation into a procurement specification.
2. An annual refresher is a programme choice
An annual refresher can provide a predictable baseline for planning, induction follow-up and budget. It can also create a useful point at which the board reviews its learning priorities. However, describing that baseline as the only interval allowed by DORA confuses a provider’s product design with the regulation’s wording. Explain the choice, its rationale and the events that can bring learning forward.
Other supervisory expectations may inform the decision. For example, the ECB’s published good-practice expectations on bank boards’ ICT and security expertise discuss annual training. That is relevant context for affected banks, not a basis for claiming the same rule applies identically to every financial entity. The compliance team should identify applicable supervisory material and national requirements alongside the DORA framework.
At BlueTeam Academy, the annual refresher is a planning recommendation. Administrators can set a different review interval based on the company’s roles and risk profile. That setting schedules an internal review expectation; it does not establish that a given period satisfies every obligation. A board should be able to explain why its selected cycle makes sense, which information it considered and who will revisit the decision if exposure changes. A calendar without that reasoning is a weak substitute for a learning plan.
3. Define events that trigger earlier learning
A regular programme should have a route for changes that arrive between planned sessions. Examples include launching an important service, changing a cloud or identity dependency, acquiring another business, a material incident, a recurring audit finding or a director taking a new role. The question is whether the event changes the knowledge or decisions expected from the people concerned. Not every technical change needs a board course, but significant changes need a reasoned assessment.
Consider a payments entity that moves its recovery environment to the same cloud platform as its primary service. The board completed a continuity module two months earlier. Waiting ten more months to discuss the new concentration may leave directors relying on a recovery assumption that no longer holds. A targeted briefing and decision exercise can address that gap without repeating the entire programme.
Create a simple trigger record: the change, affected service, roles concerned, learning need, proposed activity, owner and completion evidence. Connect it to the normal risk or change-governance process so that it is not dependent on somebody remembering the training calendar. After an incident, use the lessons about decisions and escalation as well as the technical cause. A new procedure matters only if the people expected to use it understand what they must do differently.
4. Plan around roles and financial services
A useful plan starts with the people and services for which the entity is responsible. Identify management-body members and their oversight duties. Map senior-management responsibilities and the operational roles that need specific awareness or resilience skills. Then connect those responsibilities to services, important data, ICT dependencies and foreseeable disruption. This produces a more defensible plan than assigning identical content to every account in the directory.
For the board, the output may be the ability to challenge risk appetite, investment, recovery evidence and material supplier exposure. For an incident coordinator, it may be reliable classification, escalation and coordination through the entity’s approved procedures. For a colleague handling customer instructions, it may be recognising and reporting a suspected integrity problem promptly. These outcomes are related, but a test about password hygiene alone does not demonstrate board-level judgement about recovery or resources.
Use proportionate depth. A leader responsible for a service with complex shared dependencies may need more detailed scenario work than an introductory overview provides. Document where the common core ends and an entity-specific briefing or workshop begins. If the legal framework has not yet been confirmed, record that as an unresolved action with an owner. Do not make the learning system’s default setting appear to be a legal determination of scope.
5. A practical cycle from induction to refresh
One workable design starts with induction, followed by a common leadership core, a discussion of the entity’s actual services and a scheduled review of changes. The common core provides vocabulary and decision methods. The company discussion tests whether those methods apply to the real recovery design, supplier chain and governance arrangements. The recurring review then asks what has changed and which earlier assumptions need new evidence.
As an example, a newly appointed director could complete a board programme, attend a service briefing and record the questions they want management to answer. The board secretary or learning owner could check progress against the agreed dates. At the next planned review, the director could examine changes in responsibilities and unresolved risk issues, then take a refresher or targeted exercise. The exact timing should follow the entity’s needs and applicable expectations, rather than this illustrative sequence being treated as a mandatory timetable.
Keep activities connected. A workshop that identifies an untested recovery dependency should produce an action and a future evidence request. The next refresher should revisit whether that action changed the service capability. This turns learning into an ongoing oversight process. It also helps a corporate buyer judge a course by the decisions it supports, not only the number of videos, the length of a certificate or a provider’s use of the word compliance.
6. Record learning and the gaps that remain
For each learner, retain the identity, organisation, professional role, assigned modules, course version and completion dates. Record assessment results and the identifier of any certificate of completion. Keep refresher history and company workshop records distinguishable from the core course. A changed course title should not silently overwrite the meaning of an earlier completion record.
The corporate report should show gaps as well as successes: people who have not started, unfinished modules, failed or outstanding assessments, overdue assignments and follow-up activities. A completion percentage can conceal the fact that the directors responsible for a critical service have not completed the relevant learning. Use the report to decide who needs support or a different activity; avoid treating it as a regulatory compliance score.
Evidence has limits. Time spent on a page is not proof of understanding. A selected-response assessment samples particular decisions; it does not establish competence across every live incident. Written reasoning and facilitated discussion can reveal assumptions, but the record should say whether those responses were actually reviewed. If a company administrator records workshop attendance, label it as an administrator attestation. See our guide to DORA training certificates for a practical boundary between completion evidence and unsupported certification claims.
7. Example: a board responds to a changed cloud dependency
A fictional insurer plans a routine leadership refresher in November. In March, a provider change makes two customer-facing services dependent on the same identity platform. In April, a recovery exercise restores data successfully but does not test loss of that platform. The training owner identifies that directors may interpret the two service contracts as evidence of independent recovery. The learning gap is a mistaken assumption about common dependencies.
The entity arranges a short service briefing and a board exercise before approving the renewal decision. Participants map the shared dependency, challenge the recovery estimate and identify the evidence they need. The record captures the date, roles, scenario, decisions and unresolved actions. The technical team owns a representative recovery test; the business owner owns the residual-risk decision. Learning does not replace either responsibility.
In November, the refresher revisits the result of that test and the board’s earlier questions. If the exposure remains unresolved, the report says so. Completing the refresher does not convert a failed control into a successful one. This example demonstrates why a regular calendar and event-driven learning belong together: the calendar creates continuity, while the change trigger keeps knowledge relevant to decisions that cannot wait.
8. Put the plan into the company workspace
Use DORA Board & Executive Training as the common leadership programme, then add your company context. The Academy’s core programme has eight modules with written decision exercises and a scenario assessment. Approximately three hours is a guided-study estimate, including the exercises; it is not a legal minimum or a guarantee of sufficiency for every role.
The separate board refresher supports a review of changed responsibilities, recovery assumptions and supplier or audit lessons. Administrators can assign it to the relevant people and track its completion separately from the original programme. Company workshop records can identify the facilitator, participants, objectives and decisions after a session has taken place. Keep unresolved operational actions in your normal governance process as well as recording the learning they generated.
Before adopting the plan, have the responsible learning, risk and compliance owners agree its scope. Decide who maintains the calendar, who receives overdue reports, what triggers a targeted update and how the next review will evaluate whether understanding improved. That ownership is more valuable than simply choosing a recurring date.
Questions leaders ask
Does regular mean once every year?
The DORA training provisions do not define one universal annual interval. An annual refresher is a useful programme design choice for many organisations, and applicable supervisory expectations may add relevant context. Document the basis for your schedule, consider the people’s roles and ICT risk, and define how material changes trigger earlier learning. Do not describe a provider’s standard renewal date as the regulation’s explicit wording.
Must the whole course be repeated after every change?
No universal rule in these provisions requires repeating an identical course after every change. Assess whether the change affects knowledge, skills or decisions for the role. A targeted briefing, scenario exercise or updated module may address the gap more directly. Preserve the earlier course record and record the new activity separately, including its purpose and any follow-up.
Does a completed refresher prove that the company complies with DORA?
No. It is evidence of a learning activity and, where assessed, of the recorded assessment result. Organisational compliance involves the applicable governance, controls and wider obligations. A defensible learning record identifies what was taught and assessed, which version was used and what remains unresolved. It should support informed oversight rather than be promoted as a substitute for it.
Sources and further reading
Primary legislation and supervisory material. Practical examples and templates in this guide are suggestions, not prescribed regulatory forms.
- DORA: Articles 5, 13 and 16
- EIOPA Q&A 250–3380: training and proportionality
- ECB: bank board ICT and security expertise expectations
This guide is educational. Confirm your entity’s scope, applicable framework and supervisory requirements with your legal and compliance team.
