PROFESSIONAL PROGRAMME

DORA: Digital Operational Resilience — Comprehensive Programme

Implement digital operational resilience through service mapping, risk decisions, incident reporting, recovery, testing and ICT supplier oversight. Fourteen practical modules lead to an integrated financial-sector crisis simulation.

Regulation (EU) 2022/2554 and applicable delegated and implementing acts.

BlueTeam Academy

14 modules · 42 assessment questionsApproximately 7 hoursNamed certificate of completion

After this course, learners will…

What learners can do

Connect governance, ICT risk, incident handling, resilience testing and third-party oversight into one working programme.
Test recovery and provider-exit assumptions against the services and dependencies the organisation actually uses.
Coordinate a crisis exercise and defend a prioritised improvement plan using evidence and clear ownership.

Benefits for your company

Teams can connect separate resilience activities and identify gaps between policy, contracts and operational capability.
Leaders gain a clearer basis for allocating resources and tracking improvements across business and technical teams.

INSIDE THE COURSE

14 modules. Decisions you can practise.

14 lessons1.8 hExercises take additional time.

Each module includes a practical role-specific scenario, a decision check and a written reflection. Complete the modules before taking the final scenario assessment.

Explore the outline. Open a section to see the lessons and topics inside.

Scope, proportionality and the regulatory map

6 slides

Decide which legal entity and framework a control programme must cover.

Topics you will explore

Start with the legal entity, not the group
Use proportionality and Article 16 carefully
Map the sources and assign internal ownership

Link to this lesson

Governance, accountability and training

6 slides

Turn management-body responsibility into decisions, challenge and evidence.

Topics you will explore

Management body responsibility and delegated delivery
How to respond when reporting conflicts with evidence
Training, knowledge updates and evidence

Link to this lesson

Services, assets and dependency mapping

6 slides

Trace an important financial service through its operational dependencies.

Topics you will explore

Set the service boundary and criticality
Capture evidence, owners and dataflows
Verify updates and use the map

Link to this lesson

Risk assessment and control design

6 slides

Assess a failure scenario and justify a treatment with evidence.

Topics you will explore

Frame the scenario before choosing controls
Separate control design from control performance
Record residual risk and approvals clearly

Link to this lesson

Detection, incident classification and evidence

6 slides

Keep an incident record that supports classification and response.

Topics you will explore

Build an incident record that can be checked
Apply the actual classification rules
Preserve useful evidence safely

Link to this lesson

Major incident reporting and communications

6 slides

Coordinate the reporting clocks and submit defensible updates.

Topics you will explore

Anchor the reporting clock to awareness, classification and submission
Plan the sequence after the initial submission
Communicate defensibly when facts are still moving

Link to this lesson

Continuity, recovery and transaction integrity

6 slides

Demonstrate safe service recovery under realistic constraints.

Topics you will explore

Separate recovery targets from evidence
Reconcile records before considering payment replay
Test the constrained service

Link to this lesson

Resilience testing and threat-led testing

6 slides

Choose a test that answers a material risk question.

Topics you will explore

Select a test for a risk question
Keep TLPT distinct
Close findings through validation

Link to this lesson

ICT third-party lifecycle and information register

6 slides

Connect supplier decisions and register data to supported functions.

Topics you will explore

Connect contracts, services and business functions
Distinguish function criticality from provider designation
Link reliable records and due diligence

Link to this lesson

Contracts, subcontracting and oversight

6 slides

Identify contractual gaps and know when specialist review is needed.

Topics you will explore

Start with the applicable contract layer
Check changes and subcontracting
Understand oversight and AI data use

Link to this lesson

Exit, substitution and concentration

6 slides

Test whether a provider exit is operationally credible.

Topics you will explore

Define an exit decision and its constraints
Test information and transition assumptions
Measure concentration and replacement limits

Link to this lesson

Threat information sharing and safe AI assistance

6 slides

Use shared intelligence and AI without surrendering judgement or sensitive data.

Topics you will explore

Share intelligence within the applicable conditions
Use AI with permitted information
Keep the consequential decision with people

Link to this lesson

Assurance, metrics and continuous improvement

6 slides

Produce a report that shows results and decisions rather than activity counts.

Topics you will explore

Governance and Review of ICT Controls
Metrics for Service Impact, Recovery, and Supplier Dependencies
Evidence Quality, Continuous Improvement, and the Academy Practice Plan

Link to this lesson

Integrated simulation and implementation handover

6 slides

Coordinate a realistic crisis and defend a prioritised improvement plan.

Topics you will explore

Inject one — establish facts and authority
Inject two — challenge recovery claims
Inject three — hand over decisions and improvement

Link to this lesson

✓

42 scenario questions · 80% pass mark

Allow approximately 30 minutes for the final assessment and review.

WHO THIS IS FOR

Practical decisions in your regulatory context.

ICT risk, compliance, security, operations and supplier-management teams, and accountable managers at in-scope financial entities.

Regulation (EU) 2022/2554 and applicable delegated and implementing acts.

For teams at in-scope financial entities. Confirm the applicable framework, exemptions and supervisory instructions for your entity. This independent Academy programme is not a PECB qualification or a determination of regulatory compliance.

LEARNING THAT LEAVES A RECORD

Practise, assess and document completion.

Apply the decisions

Work through role-relevant situations, explain your reasoning and connect the learning to your company’s procedures. Progress is saved as you complete each module.

Keep named evidence

After the module checks, written exercises and a passing assessment, receive a named certificate showing the course version and result. Administrators can export company completion reports and individual certificates.

Course text and assessment follow your selected language. Written responses are retained, not independently graded. Duration and the pass mark are Academy choices, not statutory thresholds. Completion is not accreditation or proof of organisational regulatory compliance.

Primary sources

Programme version: dora-comprehensive-v1 · Content reviewed 14 October 2026

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.