A tailored course, built for your situation
Sources and specific examples on hand when peers push back on DORA
Build unshakeable reasoning for DORA implementation choices backed by precedent and framework logic
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Having to defend DORA decisions without concrete backing undermines influence and slows adoption
The situation this course is for
Teams stall when practitioners can’t articulate the why behind DORA control mappings or timeline choices. Peers push back. Revisions multiply. Momentum fades.
Who this is for
Mid-level compliance or risk practitioner in financial services, accountable for DORA implementation, regularly challenged by peers on control design or timeline assumptions
Who this is not for
Executives seeking board-level summaries, vendors selling DORA tools, or those not involved in implementation details
What you walk away with
- Cite EBA guidance cold when questioned on incident reporting thresholds
- Map specific DORA articles to internal control patterns with worked examples
- Respond to peer challenges with regulator-endorsed interpretations
- Reference real firm-level adaptations from across the EEA
- Defend timeline assumptions using precedent from audit findings
The 12 modules (with all 144 chapters)
Module 1. Foundations of DORA’s legal structure
Break down DORA’s binding articles, EU regulation hierarchy, and direct applicability across member states. Understand which provisions are principle-based vs prescriptive.
12 chapters in this module
- What makes DORA directly applicable
- Hierarchy of EU regulation levels
- Binding vs recommended articles
- Scope of 'financial entity' definition
- Third-country application logic
- Key definitions: ICT risk, incident, dependency
- EBA’s role in interpretation
- Timeline for full compliance phases
- Overlap with MiFID II reporting
- How NIS2 aligns with DORA scope
- Carve-outs for small asset managers
- Sources for national deviations
Module 2. EBA guidelines and their implementation weight
Examine how EBA’s draft guidelines shape supervisory expectations, even before finalisation. Learn where regulators expect adherence versus flexibility.
12 chapters in this module
- Status of draft vs final guidelines
- EBA’s consultation process
- Precedent from public feedback
- Regulator expectations on testing
- Incident classification thresholds
- ICT third-party due diligence depth
- Internal audit frequency norms
- Use of external experts
- Documentation standards for reviewers
- How ESAs coordinate on DORA
- National regulator variation patterns
- Sources for ongoing updates
Module 3. Control mapping from DORA to internal frameworks
Map specific DORA requirements to existing internal policies, control libraries, and audit templates. Avoid generic mappings that collapse under scrutiny.
12 chapters in this module
- Article 7 to internal incident policy
- Article 9 and access control standards
- ICT risk assessment cadence alignment
- Mapping testing obligations
- Third-party oversight integration
- Internal audit plan updates
- Documentation retention rules
- How to map cascade obligations
- Evidence required for attestations
- Linking to change management logs
- Audit trail depth expectations
- Cross-referencing with MiFID II
Module 4. Responding to peer challenges on scope
Equip yourself with responses when colleagues question whether a vendor or system falls under DORA’s purview.
12 chapters in this module
- Threshold for critical ICT dependency
- Service provider classification
- In-scope technologies by function
- Hosting vs managed services split
- Open source software considerations
- Cloud provider responsibility matrix
- Thresholds for incident reporting
- When API dependencies count
- Legacy systems and exemptions
- Interconnection with payment systems
- Data location vs control location
- How regulators define materiality
Module 5. Defending timeline assumptions
Use enforcement patterns and audit findings to justify your organisation’s timeline for DORA readiness.
12 chapters in this module
- Typical regulator tolerance window
- Phased implementation acceptance
- Evidence from supervisory colleges
- Benchmarking peer firm progress
- How delays were treated in practice
- Documentation to justify delay
- Regulator communication norms
- Escalation paths for extensions
- Impact of M&A on timelines
- Reporting obligations during transition
- Interim controls for gaps
- Mapping to annual audit plans
Module 6. ICT risk assessment with DORA-specific drivers
Design risk assessments that explicitly address DORA’s unique requirements, not just generic cyber risk.
12 chapters in this module
- Inclusion of third-party concentration risk
- ICT incident probability calibration
- Dependency mapping depth
- Resilience testing scope
- Supplier exit risk scoring
- Geographic concentration risks
- Technology debt exposure
- Single point of failure identification
- Redundancy thresholds
- Cross-border data flow risks
- Service level agreement alignment
- Audit evidence for risk register
Module 7. Incident classification and reporting thresholds
Apply regulator-endorsed examples to classify incidents accurately and avoid under- or over-reporting.
12 chapters in this module
- Materiality thresholds by asset size
- Downtime vs data integrity impact
- Incident escalation trees
- Cross-border reporting obligation
- 24-hour notice content
- Follow-up report deadlines
- Regulator communication channels
- Internal logging standards
- Evidence package structure
- Exemptions for resolved incidents
- Third-party incident attribution
- Aggregate incident counting
Module 8. Third-party due diligence under DORA
Apply supervisory expectations to vendor assessments, especially for cloud and managed service providers.
12 chapters in this module
- Criticality scoring for vendors
- Minimum due diligence steps
- Onsite audit rights negotiation
- Exit strategy documentation
- Subcontractor oversight
- Geographic risk of provider
- Penetration testing access
- Regulatory inspection readiness
- Contractual terms to include
- Key person dependency risk
- Financial stability checks
- Incident response coordination
Module 9. Testing critical functions under DORA
Design tests that meet DORA’s expectations for scope, frequency, and documentation.
12 chapters in this module
- Definition of critical function
- Annual vs triennial test cycle
- Scenario design principles
- Red team vs third-party assessor
- Evidence retention standards
- Findings follow-up process
- Escalation to senior management
- Integration with business continuity
- Cyber resilience test overlap
- Third-party test inclusion
- Regulator access to results
- Lessons from EBA stress tests
Module 10. Audit and oversight evidence packages
Assemble documentation that withstands internal and external scrutiny, aligned with DORA’s evidentiary expectations.
12 chapters in this module
- Control mapping to evidence
- Audit trail requirements
- Internal review sign-off
- External auditor coordination
- Version control for policies
- Timeline of implementation
- Gap remediation logs
- Training completion records
- Meeting minutes with decisions
- Action item trackers
- Regulator inquiry responses
- Lessons from audit findings
Module 11. Cross-border coordination under DORA
Navigate the complexities of multi-jurisdictional ICT risk and incident reporting.
12 chapters in this module
- Lead regulator determination
- Supervisory college coordination
- Cross-border incident reporting
- Data transfer compliance
- Local vs group-level controls
- Incident localization logic
- Time zone impact on reporting
- Language requirements
- Regulator information sharing
- Translation of evidence
- Crisis response roles
- Regulator access rights
Module 12. Sustaining DORA compliance over time
Build processes that maintain compliance without recurring heavy lifts, using adaptive control libraries and change triggers.
12 chapters in this module
- Change detection triggers
- Annual review cycle design
- Control library versioning
- Employee onboarding training
- Regulator update tracking
- Benchmarking against peers
- Internal challenge function
- Lessons from enforcement actions
- Adaptive policy templates
- Automated evidence collection
- Succession planning for roles
- Hand-built playbook integration
How this maps to your situation
- When a peer questions whether a vendor is in scope
- Before submitting an incident report
- During internal audit preparation
- When designing resilience testing
Before vs. after
Before
Responding to challenges on DORA implementation with general reasoning or internal precedent
After
Walking through regulator-endorsed examples and specific article interpretations with confidence
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3-4 hours per module, with optional deep dives into templates and examples
If nothing changes
Continuing to rely on abstract justifications risks delays, rework, and diminished influence when peers question DORA decisions
How this compares to the alternatives
Most DORA training offers high-level summaries. This course delivers line-by-line interpretations and real-world precedent, not just overviews.
Frequently asked
How is this different from general compliance training?
It focuses exclusively on DORA’s implementation logic, with specific article interpretations and regulator-endorsed examples.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Are templates specific to financial services?
Yes, all templates reflect asset management and wealth management firm contexts, including custody and reporting structures.
$199 one-time. Approximately 3-4 hours per module, with optional deep dives into templates and examples.
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours