PROFESSIONAL PROGRAMME

DORA Training for ICT, Risk & Compliance Teams

Operational training for teams that implement ICT risk controls, coordinate incident reporting, test recovery and evidence third-party oversight.

Digital Operational Resilience Act, Articles 6–15, 17–30 and 13(6)

BlueTeam Academy

8 modules · 16 assessment questionsApproximately 2.5 hoursNamed certificate of completion

After this course, learners will…

What learners can do

Map important services to assets, dependencies, controls and accountable owners.
Coordinate incident records, reporting decisions, resilience testing and recovery evidence.
Evaluate provider risks and turn control gaps into prioritised improvements with verifiable closure.

Benefits for your company

ICT, risk and compliance teams can work from a shared record of dependencies, findings and decisions.
Management receives traceable evidence of control performance and unresolved limitations.

INSIDE THE COURSE

8 modules. Decisions you can practise.

8 lessons0.6 hExercises take additional time.

Each module includes a practical role-specific scenario, a decision check and a written reflection. Complete the modules before taking the final scenario assessment.

Explore the outline. Open a section to see the lessons and topics inside.

Scope, governance and the control framework

6 slides

Translate applicable requirements into owned controls, evidence and escalation routes.

Link to this lesson

Service mapping and ICT risk assessment

6 slides

Map services to assets and dependencies and evaluate residual ICT risk.

Link to this lesson

Protection, access and controlled change

6 slides

Evaluate access, vulnerability and change controls against operational evidence.

Link to this lesson

Detection, classification and incident reporting

6 slides

Coordinate incident facts, classification and reporting against the applicable rules.

Link to this lesson

Continuity, backup and recovery assurance

6 slides

Validate recovery capability at the business-service level and track unresolved limitations.

Link to this lesson

Resilience testing and remediation

6 slides

Design risk-based tests and close findings with evidence of effective remediation.

Link to this lesson

ICT providers, registers and exit readiness

6 slides

Connect provider inventories, contracts, concentration risk and practical exit arrangements.

Link to this lesson

Evidence, reporting and continuous improvement

6 slides

Produce traceable management evidence and turn incidents and findings into owned improvements.

Link to this lesson

✓

16 scenario questions · 80% pass mark

Allow approximately 30 minutes for the final assessment and review.

WHO THIS IS FOR

Practical decisions in your regulatory context.

ICT, security, risk, compliance, continuity and supplier-management practitioners at in-scope financial entities.

Digital Operational Resilience Act, Articles 6–15, 17–30 and 13(6)

This programme develops operational judgement under DORA’s general framework and flags the separate Article 16 simplified framework. It connects role-specific learning under Article 13(6) with implementation and evidence. Apply the regulatory technical and implementing standards, current reporting templates and supervisory instructions relevant to your entity; this course is not a substitute for that implementation work.

LEARNING THAT LEAVES A RECORD

Practise, assess and document completion.

Apply the decisions

Work through role-relevant situations, explain your reasoning and connect the learning to your company’s procedures. Progress is saved as you complete each module.

Keep named evidence

After the module checks, written exercises and a passing assessment, receive a named certificate showing the course version and result. Administrators can export company completion reports and individual certificates.

Course text and assessment follow your selected language. Written responses are retained, not independently graded. Duration and the pass mark are Academy choices, not statutory thresholds. Completion is not accreditation or proof of organisational regulatory compliance.

Primary sources

Programme version: dora-ict-risk-compliance-v1 · Content reviewed 14 October 2026

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.