PROFESSIONAL PROGRAMME
DORA: Digital Operational Resilience — Comprehensive Programme
Implement digital operational resilience through service mapping, risk decisions, incident reporting, recovery, testing and ICT supplier oversight. Fourteen practical modules lead to an integrated financial-sector crisis simulation.
Regulation (EU) 2022/2554 and applicable delegated and implementing acts.
BlueTeam Academy
WHO THIS IS FOR
Practical decisions in your regulatory context.
ICT risk, compliance, security, operations and supplier-management teams, and accountable managers at in-scope financial entities.
Regulation (EU) 2022/2554 and applicable delegated and implementing acts.
For teams at in-scope financial entities. Confirm the applicable framework, exemptions and supervisory instructions for your entity. This independent Academy programme is not a PECB qualification or a determination of regulatory compliance.
INSIDE THE COURSE
14 modules. Decisions you can practise.
Each module includes a practical role-specific scenario, a decision check and a written reflection. Complete the modules before taking the final scenario assessment.
- 0125–30 min
Scope, proportionality and the regulatory map
Decide which legal entity and framework a control programme must cover.
- 0225–30 min
Governance, accountability and training
Turn management-body responsibility into decisions, challenge and evidence.
- 0325–30 min
Services, assets and dependency mapping
Trace an important financial service through its operational dependencies.
- 0425–30 min
Risk assessment and control design
Assess a failure scenario and justify a treatment with evidence.
- 0525–30 min
Detection, incident classification and evidence
Keep an incident record that supports classification and response.
- 0625–30 min
Major incident reporting and communications
Coordinate the reporting clocks and submit defensible updates.
- 0725–30 min
Continuity, recovery and transaction integrity
Demonstrate safe service recovery under realistic constraints.
- 0825–30 min
Resilience testing and threat-led testing
Choose a test that answers a material risk question.
- 0925–30 min
ICT third-party lifecycle and information register
Connect supplier decisions and register data to supported functions.
- 1025–30 min
Contracts, subcontracting and oversight
Identify contractual gaps and know when specialist review is needed.
- 1125–30 min
Exit, substitution and concentration
Test whether a provider exit is operationally credible.
- 1225–30 min
Threat information sharing and safe AI assistance
Use shared intelligence and AI without surrendering judgement or sensitive data.
- 1325–30 min
Assurance, metrics and continuous improvement
Produce a report that shows results and decisions rather than activity counts.
- 1425–30 min
Integrated simulation and implementation handover
Coordinate a realistic crisis and defend a prioritised improvement plan.
- ✓
42 scenario questions · 80% pass mark
Allow approximately 30 minutes for the final assessment and review.
LEARNING THAT LEAVES A RECORD
Practise, assess and document completion.
Apply the decisions
Work through role-relevant situations, explain your reasoning and connect the learning to your company’s procedures. Progress is saved as you complete each module.
Keep named evidence
After the module checks, written exercises and a passing assessment, receive a named certificate showing the course version and result. Administrators can export company completion reports and individual certificates.
Course text and assessment follow your selected language. Written responses are retained, not independently graded. Duration and the pass mark are Academy choices, not statutory thresholds. Completion is not accreditation or proof of organisational regulatory compliance.
Primary sources
- DORA — Regulation (EU) 2022/2554
- Incident classification — Delegated Regulation (EU) 2024/1772
- Incident reporting deadlines — Delegated Regulation (EU) 2025/301
- Incident reporting forms — Implementing Regulation (EU) 2025/302
- Register of information — Implementing Regulation (EU) 2024/2956
- European Commission — DORA implementing and delegated acts
Programme version: dora-comprehensive-v1 · Content reviewed 14 October 2026
AI
Practical AI use, with human judgement.
This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.
AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.