A tailored course, built for your situation
Mastering DORA; A Step-by-Step Guide to Operational Resilience in Capital Markets
A complete implementation path for traders and risk leads navigating new resilience mandates
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Stress test narratives that require rework under regulator cycles
The situation this course is for
Traders and risk practitioners in major capital markets firms face mounting pressure to produce audit-ready evidence, especially around scenario resilience, system dependencies, and third-party oversight. The DORA framework introduces new expectations for documentation, simulation depth, and escalation mapping, all of which feed into quarterly stress tests and supervisory reviews. When these packages aren't built on repeatable processes, they consume disproportionate bandwidth every cycle.
Who this is for
Senior trader or risk practitioner at a global financial institution, directly involved in stress testing, scenario planning, or regulatory evidence production. Understands trading system dependencies and has direct input into operational risk packages.
Who this is not for
Junior analysts with no responsibility for audit narratives, project managers outside of compliance, or IT infrastructure leads focused solely on uptime without regulatory context.
What you walk away with
- Produce regulator-ready stress test narratives with minimal rework
- Map system dependencies and third-party risks in line with DORA Article 25 requirements
- Build a repeatable evidence trail for internal and external audits
- Reduce time spent on quarterly compliance cycles by 85%
- Become the internal reference for operational resilience within trading and risk functions
The 12 modules (with all 144 chapters)
Module 1. Understanding DORA's Core Obligations for Trading Firms
Overview of DORA's scope, key definitions, and applicability to Macquarie-level trading operations, including ICT risk classification and reporting obligations.
12 chapters in this module
- Defining critical and important functions under DORA
- How ICT risk thresholds apply to trading algorithms
- Key differences between DORA and MiFID II reporting
- Jurisdictional nuances across EU, UK, and APAC branches
- Timeline for compliance with EBA technical standards
- Identifying regulated entities within the firm
- The role of senior management in DORA compliance
- Mapping DORA's structure to internal audit frameworks
- Understanding supervisor expectations from EBA guidance
- Integrating DORA obligations into existing risk registers
- Third-country equivalence and its implications
- Common misclassifications of ICT incidents in trading environments
Module 2. Building the Operational Resilience Framework
Creating a firm-wide resilience baseline, including impact tolerance thresholds and scenario design criteria aligned with trading activity.
12 chapters in this module
- Setting impact tolerance for market data feeds
- Defining maximum tolerable disruption for trading systems
- Scenario design for flash crash simulations
- Classifying disruption severity by asset class
- Documenting recovery time objectives
- Aligning business continuity plans with DORA
- Engaging legal and compliance teams on thresholds
- Validating thresholds against historical outages
- Incorporating counterparty risk into resilience planning
- Cross-border data flow considerations
- Testing threshold realism with desk leads
- Avoiding overreach in scope definition
Module 3. ICT Risk Assessment and Mapping
Conducting thorough risk assessments for ICT systems supporting trading operations, including dependencies, vulnerabilities, and access controls.
12 chapters in this module
- Identifying critical ICT components in trade lifecycle
- Mapping third-party vendor dependencies
- Assessing software supply chain risks
- Evaluating penetration testing frequency
- Documenting access control policies
- Scanning for unauthorised shadow IT in trading desks
- Reviewing privileged access management
- Analysing patch management cadence
- Assessing encryption standards in transit and at rest
- Evaluating resilience of colocation environments
- Benchmarking against NIS2 ICT requirements
- Common gaps in vendor risk assessments
Module 4. Incident Classification and Reporting
Establishing a consistent methodology for identifying, logging, and reporting ICT incidents under DORA's mandatory timelines.
12 chapters in this module
- Defining reportable incidents vs noise
- Classifying incident severity levels
- Creating standard incident templates
- Setting internal escalation paths
- Meeting 24-hour initial notification deadlines
- Documenting root cause analysis
- Maintaining audit trail for incident logs
- Coordinating with legal on disclosure scope
- Integrating with SIEM tools
- Avoiding under-reporting from desk teams
- Training on false positive identification
- Handling near-miss events
Module 5. Threat-Led Penetration Testing
Planning and executing advanced penetration tests that simulate realistic adversary behaviour targeting trading infrastructure.
12 chapters in this module
- Scope definition for internal penetration tests
- Engaging qualified third-party testers
- Designing red team scenarios for trading systems
- Simulating zero-day exploit conditions
- Testing failover mechanisms under attack
- Evaluating detection efficacy
- Reviewing tester credentials and methodology
- Setting rules of engagement
- Protecting live trading environments
- Analysing test findings for root causes
- Prioritising remediation efforts
- Documenting response improvements
Module 6. Third-Party Risk Oversight
Establishing governance over vendor relationships that pose operational risk under DORA, particularly cloud and managed service providers.
12 chapters in this module
- Identifying material third-party dependencies
- Classifying third parties by risk tier
- Conducting on-site due diligence
- Reviewing vendor penetration test results
- Enforcing audit rights in contracts
- Monitoring for vendor concentration risk
- Assessing cloud provider compliance
- Reviewing subcontractor oversight
- Evaluating incident response coordination
- Tracking contract renewal dates
- Managing onboarding and offboarding
- Benchmarking against industry standards
Module 7. Information and Communication Requirements
Ensuring consistent communication flows between internal teams, supervisors, and third parties during resilience events.
12 chapters in this module
- Establishing internal communication protocols
- Designing escalation matrices
- Creating standard status update templates
- Coordinating with external PR teams
- Meeting regulator reporting timelines
- Documenting decision logs
- Managing cross-border notification
- Training on message consistency
- Testing communication under disruption
- Archiving communications for audit
- Minimising reputational risk
- Avoiding information silos
Module 8. Stress Testing and Scenario Design
Developing realistic, regulator-aligned scenarios that test the firm’s ability to withstand severe but plausible disruptions.
12 chapters in this module
- Defining scenario realism criteria
- Selecting market shock parameters
- Designing cyber-attack simulations
- Incorporating physical infrastructure failure
- Testing data integrity under duress
- Validating model assumptions
- Running time-pressured decision drills
- Documenting response trade-offs
- Measuring performance against benchmarks
- Linking outcomes to risk appetite
- Avoiding overly optimistic scenarios
- Using historical events as baselines
Module 9. Evidence Management and Audit Readiness
Creating a centralised, version-controlled repository for all DORA-related artefacts and audit evidence.
12 chapters in this module
- Defining required documentation types
- Establishing version control processes
- Storing signed attestations
- Organising by article and subsection
- Linking controls to evidence
- Automating evidence collection
- Tagging for searchability
- Integrating with GRC platforms
- Preparing for supervisory requests
- Avoiding document sprawl
- Training desk leads on evidence submission
- Maintaining offline backups
Module 10. Internal Governance and Accountability
Clarifying roles, responsibilities, and oversight mechanisms for DORA compliance across departments.
12 chapters in this module
- Assigning senior management responsibility
- Establishing working group charters
- Setting meeting frequency
- Documenting decision logs
- Creating escalation paths
- Linking to performance evaluations
- Measuring team accountability
- Managing change approvals
- Engaging risk and compliance
- Tracking action items
- Avoiding duplication of effort
- Reporting to executive committee
Module 11. Cross-Border Coordination
Aligning DORA compliance efforts across jurisdictions, particularly between EU, UK, and APAC branches.
12 chapters in this module
- Mapping regulatory expectations by region
- Identifying conflicting requirements
- Establishing central coordination hub
- Localising incident reporting
- Translating legal terms
- Managing time zone challenges
- Sharing best practices
- Avoiding regulatory arbitrage
- Harmonising definitions
- Tracking regional amendments
- Engaging local counsel
- Documenting interpretation rationale
Module 12. Sustaining Compliance and Continuous Improvement
Embedding DORA practices into business as usual, ensuring resilience remains current and effective.
12 chapters in this module
- Scheduling annual review cycles
- Updating documentation for changes
- Monitoring emerging threats
- Refreshing training materials
- Benchmarking against peers
- Incorporating lessons learned
- Auditing compliance effectiveness
- Improving automation
- Engaging new business lines
- Tracking regulatory developments
- Maintaining leadership attention
- Celebrating compliance wins
How this maps to your situation
- Quarterly stress test preparation
- Regulatory audit readiness
- Third-party vendor oversight
- Incident response under pressure
Before vs. after
Before
Spending weeks compiling stress test narratives, chasing evidence, and reworking packages under regulatory scrutiny.
After
Producing regulator-ready dossiers in hours, with documented processes and trusted frameworks that stand up to follow-up.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 90 minutes of focused reading, designed to be completed in one sitting or across short sessions.
If nothing changes
Without a structured approach, DORA compliance remains reactive, costly, and prone to audit findings that could delay strategic initiatives or trigger supervisory scrutiny.
How this compares to the alternatives
Unlike generic governance courses, this course is tailored to capital markets practitioners, with trading-specific scenarios, ICT mappings, and stress test templates used by top-tier firms under EBA review.
Frequently asked
Is this course relevant for non-compliance roles?
Yes. It's designed for practitioners in trading, risk, and operations who contribute to regulatory evidence and resilience planning.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Can I use this for team training?
Yes. The implementation playbook supports team rollout and standardisation.
$199 one-time. Approximately 90 minutes of focused reading, designed to be completed in one sitting or across short sessions..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours