DORA training: the Digital Operational Resilience Act for every employee

Opens with the question of how long people could live without payment systems, and an exercise naming the system your clients could not do without. Covers two events: the faulty security software update of 19 July 2024 that Microsoft estimated affected about 8.5 million Windows devices, and the European Central Bank's T2 system stopping for about seven hours on 27 February 2025 because of a hardware defect. Draws three lessons: ICT failure is business failure, shared providers are a weak point, and resilience means withstanding and recovering. Explains DORA's aim and that it has applied since 17 January 2025. Introduces LMN Payments, a Dublin payment institution with providers in Manila, Mumbai and Frankfurt, then the ten modules and final exam. It ends with a recap and three practice questions.

What you will be able to do

• Explain why ICT failures quickly become failures of financial services
• Describe what DORA aims to achieve and since when it applies
• Describe how the course and final exam work

Why it matters

Seeing how one provider's update stopped services worldwide shows why your firm's resilience depends on everyone.

Practice: Practice: Why DORA · 3 questions

Starts with a new IT manager at a Paris insurer who plans to wait for a French law to put DORA into effect, as NIS2 works through national laws. Explains why there is nothing to wait for: DORA is a regulation, applying directly in every Member State since 17 January 2025. Covers the twenty types of financial entity it covers, the narrow exceptions, and how it reaches critical ICT providers through oversight. Explains proportionality, the technical standards that complete it, including the templates for the register of information, and why for financial entities DORA applies instead of NIS2's equivalent rules on ICT risk, incidents and testing. Applies this to LMN Payments, supervised by the Central Bank of Ireland. It ends with a recap and three practice questions.

What you will be able to do

• Explain why DORA applies directly without national law
• Identify the financial entities in scope and how proportionality works
• Explain how DORA relates to NIS2 for financial entities

Why it matters

Knowing DORA already applies, and how much applies to you, stops your firm waiting for rules that are already in force.

Practice: Practice: A regulation for the financial sector · 3 questions

Opens in LMN Payments' boardroom, where a director asks why the board must approve the digital operational resilience strategy if ICT risk is the chief technology officer's job. Covers Article 5: internal governance and control, with the management body bearing ultimate responsibility for ICT risk, approving, overseeing and funding it and keeping its own knowledge up to date. Explains the sound, documented ICT risk management framework under Article 6, independent control and internal audit in the three lines of defence, formal follow-up so critical audit findings are fixed on time, and a resilience strategy with the firm's own tolerances. Covers reviewing the framework at least once a year and after major incidents, and giving honest information for reviews. It ends with a recap and three practice questions.

What you will be able to do

• Explain why the management body bears ultimate responsibility for ICT risk
• Describe the parts of an ICT risk management framework
• Explain how the framework is reviewed and improved

Why it matters

Understanding the board's role helps you give the information it needs to oversee ICT risk properly.

Practice: Practice: ICT risk management: the framework and board · 3 questions

Starts on a Friday night at LMN Payments when a developer at the partner in Mumbai puts an untested fix into the live checkout service, and card payments fail for forty minutes across Europe. Covers identifying and classifying functions and assets, including those on remote sites, mapping the critical ones, their links and providers, and keeping risks assessed. Explains protection: a security policy, limited access, strong sign-in, controlled changes with an emergency path, timely patches and changes made by providers. Covers detection: layered mechanisms with clear alert thresholds, alerts reaching the right people within minutes, and regular testing. Shows LMN finding three more changes made outside the process in one month. It ends with a recap and three practice questions.

What you will be able to do

• Identify and map critical ICT assets and their links
• Apply change control, including an emergency path for urgent fixes
• Describe detection mechanisms with clear alert thresholds

Why it matters

Following the change process even when a fix is urgent stops your own team causing the outage.

Practice: Practice: Protection, prevention and detection · 3 questions

Opens on a Monday at LMN Payments when the cloud region running its payment platform fails, nobody knows who decides on switching to the Frankfurt backup site, the Manila desk is flooded and a sales manager posts that everything is fine. Covers continuity plans based on an impact analysis, tested at least yearly, with a crisis function that decides, set against a Madrid bank testing only around a meeting table. Explains backup policy, restoring on physically and logically separated systems, checking data after recovery, and learning from major incidents. Covers training every employee, speaking with one voice to clients and the public, staying off social media, and following the recovery checklist to the end. It ends with a recap and three practice questions.

What you will be able to do

• Describe the parts of a tested business continuity plan
• Explain backup and restoration rules under DORA
• Follow crisis communication rules during an incident

Why it matters

Deciding who decides before a crisis means recovery starts at once and the firm speaks with one voice.

Practice: Practice: Response, recovery, learning, communication · 3 questions

Starts with a Tuesday at LMN Payments when a database upgrade makes about 15% of card payments fail for three hours across Ireland, Spain, Germany and Italy, and the team calls it a glitch. Covers the incident management process Article 17 asks for: recording every ICT-related incident and significant cyber threat, however small, and reviewing the log for repeats, set against a Paris insurer logging only complaints. Explains the six classification criteria, each with thresholds set in a delegated regulation, and the test for a major incident: critical services affected, plus malicious access with data at risk or two other thresholds met. Covers who classifies, and flagging waves of similar complaints as a sign of reputational impact. It ends with a recap and three practice questions.

What you will be able to do

• Record every ICT-related incident through a defined process
• Apply the six classification criteria and their thresholds
• Decide whether an incident is major under DORA

Why it matters

Classifying by the criteria, not by feeling, means major incidents reach the supervisor instead of being fixed quietly.

Practice: Practice: Classifying ICT-related incidents · 3 questions

Returns to Tuesday at LMN Payments, this time done right: failures begin at ten past two and the incident is classified as major by half past three. Covers Article 19: three reports to the competent authority, here the Central Bank of Ireland, using standard templates. Explains the time limits: the initial notification within four hours of classification and at most 24 hours from awareness, the intermediate report in 72 hours, and the final report within a month, and what to do if the template cannot be used. Covers telling affected clients without undue delay, voluntary notification of significant cyber threats such as a fake login page, sharing threat information, and how a provider's quick call protects its client's clock. It ends with a recap and three practice questions.

What you will be able to do

• List the three DORA incident reports and their time limits
• Prepare an initial notification with what is known
• Explain when clients must be told and threats may be notified

Why it matters

Having a template, an approver and the clock in mind means a major incident is reported on time.

Practice: Practice: Reporting major incidents · 3 questions

Opens with a review at LMN Payments where last year's penetration test of the merchant portal found twelve issues and five are still open a year later. Covers the risk-based testing programme that firms other than microenterprises run, with independent testers and critical systems tested at least yearly, shown as LMN's simple table of systems, tests, owners and dates. Explains threat-led penetration testing for firms selected by their authority, at least every three years on live systems, and the rules for testers, who are certified or follow formal codes of conduct and carry professional indemnity insurance. Ends with every finding prioritised, remedied and validated, and providers cooperating in their clients' tests. It ends with a recap and three practice questions.

What you will be able to do

• Plan a risk-based resilience testing programme
• Explain who must run threat-led penetration tests and how often
• Track test findings until they are remedied and validated

Why it matters

A test adds resilience only when its findings are fixed, so tracking them is as important as running it.

Practice: Practice: Digital operational resilience testing · 3 questions

Starts with LMN Payments' fraud team signing up to a cloud scoring tool with a company card and connecting it to live payment data, with no checks, although fraud monitoring is a critical function. Covers the firm staying fully responsible, checking risks, including concentration risk, and the provider before signing. Explains the set terms contracts must contain, more for critical functions, and exit strategies that are planned and tested, with a transition period and data in a usable format. Covers the register of information that records every ICT arrangement and supports reporting to the authority. Shows how the tool was paused, assessed, contracted, registered and given an exit plan before going live two weeks later. It ends with a recap and three practice questions.

What you will be able to do

• Check a provider and concentration risk before signing
• Identify the terms a DORA-compliant ICT contract must contain
• Record ICT arrangements in the register of information

Why it matters

Bringing every ICT provider through checks and the register keeps your firm in control of services it relies on.

Practice: Practice: ICT third-party risk and the register · 3 questions

Opens with a new joiner at LMN Payments asking who checks on a cloud provider that serves hundreds of financial firms. Covers the oversight framework: nineteen critical ICT third-party providers designated by the European Supervisory Authorities on 18 November 2025, each overseen by a Lead Overseer with real powers. Explains supervision of financial entities by competent authorities and penalties set by national law, which can reach managers too, and what may change. Sets out each role in a table, from staff and team managers to board members and staff of ICT providers, with a Mumbai IT services firm sharing one login to a Milan bank's systems. Ends with six everyday habits, a recap and the final exam.

What you will be able to do

• Explain how critical ICT providers are overseen at EU level
• Describe supervision and penalties under DORA
• Apply six everyday habits that support digital resilience in your role

Why it matters

Knowing your own row in the table shows what DORA expects of you every working day.

Practice: Practice: Oversight, penalties and your role · 3 questions