DORA Training for Board Members and Executives

FINANCIAL SECTOR LEADERSHIP · DORA

Understand the risk. Make the decision.

DORA board training should build the knowledge and judgement needed to oversee financial services through disruption. Our eight-module programme connects board accountability to the decisions you face: approving resources, challenging recovery estimates, overseeing suppliers and responding when important services fail.

Work through original financial-service scenarios, complete a written decision exercise and a decision check in every module, then take a 16-question scenario assessment. Apply your company’s service and risk context to the exercises. Your written reasoning is retained for review by you and authorised company administrators; its professional quality is not automatically graded.

What your leadership team will learn

• Distinguish board accountability from tasks delegated to security, IT and risk teams.
• Evaluate how attacks, outages, data corruption and failed changes affect financial services.
• Challenge risk reports, recognise weak assurance and evaluate an investment decision.
• Question service priorities, recovery assumptions, backup readiness and test evidence.
• Practise service suspension, escalation, communication and reporting oversight decisions.
• Assess concentration, subcontracting, contractual safeguards and exit feasibility.
• Interpret findings, challenge overdue remediation and distinguish testing obligations.
• Make and explain decisions through a realistic financial-service disruption.

DORA training for directors and management-body members

Designed for the relevant directors and governing-body members of financial entities within DORA’s scope, including in-scope banks, insurers, payment institutions and investment firms. Senior executives with ICT-risk responsibilities can use the programme alongside role-specific learning. Technical experience is not required.

The learning objective is leadership oversight and judgement. Staff awareness and detailed ICT, risk and compliance training are separate programme tracks. This product distinction is not a legal requirement to purchase multiple courses.

INSIDE THE COURSE

Eight modules. Decisions you can explain.

Plan approximately three hours for the core programme: reading, guided exercises, written decisions and the final assessment. This is a study estimate, not three hours of video or a statutory minimum. Work at your own pace. Current lessons, assessment and certificates are in English; public pages and the dashboard support English and Bulgarian.

1. 01
   Lesson

   DORA responsibilities for boards and executives

   Distinguish board accountability from tasks delegated to security, IT and risk teams.

2. 02
   Lesson

   Understanding ICT risk

   Evaluate how attacks, outages, data corruption and failed changes affect financial services.

3. 03
   Lesson

   Risk appetite, reporting and investment

   Challenge risk reports, recognise weak assurance and evaluate an investment decision.

4. 04
   Lesson

   Business continuity and recovery

   Question service priorities, recovery assumptions, backup readiness and test evidence.

5. 05
   Lesson

   Incident escalation and executive decisions

   Practise service suspension, escalation, communication and reporting oversight decisions.

6. 06
   Lesson

   Third-party and cloud dependencies

   Assess concentration, subcontracting, contractual safeguards and exit feasibility.

7. 07
   Lesson

   Testing, audit and remediation

   Interpret findings, challenge overdue remediation and distinguish testing obligations.

8. 08
   Lesson

   Executive scenario and assessment

   Make and explain decisions through a realistic financial-service disruption.

9. ✓
   Knowledge check

   16 questions · 80% pass mark

Completion evidence your organisation can export

Complete every module decision check and written exercise, then pass the scenario assessment with at least 80%. The server records the course version, module dates, objectives and assessment result. Your certificate of completion has a unique identifier and preserves your identity, organisation and professional role at issue. Company reports show assignments, module gaps, results, certificate identifiers, refresher history and workshop records.

A certificate of completion records the Academy’s programme criteria. It does not represent an EU-approved qualification, accreditation or a determination that your organisation complies with DORA.

Keep knowledge current and relevant

The available board refresher takes approximately 45 minutes, with three applied reviews and an eight-question assessment. Use an annual refresher as a planning baseline, then adjust to your responsibilities and risk profile. Material service changes, supplier changes, incidents or audit findings may require earlier targeted learning. Administrators can choose a review interval, assign the refresher and export its history.

An optional company-specific workshop can apply the scenarios to your own services, dependencies and recovery assumptions. The dashboard includes a suggested 60-minute agenda and lets administrators record the facilitator, participants, objectives, decisions and follow-up. Workshop attendance is recorded separately from assessed course completion.

Enrol your leadership team

Start with a 30-day company demo using your domain and work email. It includes the setup account and one student, with no payment required. Explore the programme, assessment and evidence before arranging wider company access.