Description

A focused course, tailored for you

ICT Resilience Governance for Insurance Entity CIOs

Build the DORA-compliant ICT risk framework your management body signs and your supervisor does not contest.

The DORA management body presentation draft is open. The register section looks clean. The concentration risk narrative section is blank. Three critical functions depend on the same cloud infrastructure provider through separate contract lines, and no-one has written the analysis that explains why that arrangement is managed rather than a supervisory finding waiting to happen.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Insurance entity CIOs operating within banking groups run two ICT risk governance layers simultaneously. DORA mandates that the management body formally owns and approves the ICT risk management framework, which the CIO drafts and maintains. The complication unique to insurance subsidiaries of banking groups is that ICT arrangements frequently cross legal entity lines: shared platforms, group IT services, central data pipelines. DORA does not exempt these intragroup arrangements from register and resilience requirements. They must be documented to Article 30 minimum contractual standards and must appear in the concentration risk analysis the same way third-party vendor contracts do. These questions have no ready-made template: which intragroup arrangements fall in scope, how to document gaps in SLAs never written to DORA standards, how to negotiate TLPT scope with the parent bank's security function, how to classify incidents against the Article 18 severity thresholds. They require entity-specific analysis built from the ICT risk management framework outward.

What you walk away with

Produce the DORA ICT risk management framework document the management body approves at the annual review, with each section mapped to its regulatory article reference.
Complete the ICT third-party register including intragroup arrangements documented to Article 30 minimum contractual clause standard.
Write the concentration risk narrative for providers supporting multiple critical functions, including the management and mitigation statement your supervisor reads without sending it back.
Define the TLPT scope boundary between your entity and the parent bank's testing obligation, and produce the coordination agreement both supervisors accept.
Classify ICT incidents to DORA Article 18 severity thresholds and produce the incident notification template your team uses in the first 24 hours.

The 12 modules

Module 1. DORA's Mandate on the Management Body

DORA Article 5 places ICT risk governance accountability on the management body, not on the CIO alone. This module maps what the management body must formally approve versus what it can delegate, how the quarterly ICT risk review differs from the annual framework sign-off, and how to structure the board-level ICT risk exposure presentation so it produces governance decisions rather than clarification questions. You build the governance calendar and the approval workflow.

Module 2. ICT Risk Management Framework Structure

The ICT risk management framework is the central document DORA examiners review first. This module covers the mandatory components under Articles 6 through 9: the risk tolerance statement, the ICT asset and function inventory, the classification methodology for critical and important functions, and the annual review trigger conditions. You produce the framework outline document with each section cross-referenced to its DORA article and ready for management body approval.

Module 3. Classifying Critical and Important Functions

Which functions are critical or important determines the scope of your register, your TLPT mandate, and your incident reporting thresholds. This module covers the classification criteria under DORA Article 3, the methodology for an insurance entity whose critical functions include policy issuance, claims processing, actuarial calculation, and reinsurance cession management. You produce the classification register with documented rationale that withstands supervisory challenge.

Module 4. Third-Party Register: Scope and Required Fields

DORA Article 28 requires a complete register of all ICT third-party service providers supporting critical or important functions. For insurance entities within banking groups, scoping the register correctly is the hard problem. This module covers the mandatory register fields, how to handle providers serving multiple group entities under a single master agreement, and how to structure the register to support both the annual reporting obligation and the internal risk review cycle.

Module 5. Intragroup ICT Arrangements Under DORA

DORA does not exempt intragroup ICT arrangements from register and resilience requirements. Shared core systems from the parent bank, group data platforms, and central IT shared services must all be documented to Article 30 minimum contractual clause standard. This module covers how to identify which intragroup arrangements fall in scope, how to request contractual documentation from the parent's group treasury or legal function, and how to document gaps without triggering a group-level remediation escalation.

Module 6. Concentration Risk Analysis and Narrative

Supervisors use the register to identify ICT concentration risk: critical functions over-dependent on a small number of providers. For insurance entities with intragroup arrangements, concentration is frequently structural and cannot be eliminated quickly. This module covers the EIOPA guidance on concentration risk for insurers, how to calculate provider-level concentration across your critical function set, and how to write the management and mitigation narrative for the management body report when concentration exists and is actively managed.

Module 7. Contractual Gap Analysis Under Article 30

Existing ICT contracts frequently predate DORA and lack the twelve minimum clauses required under Article 30. This module covers each minimum contractual element, a field-by-field gap analysis methodology, and how to sequence remediation across a register of 40 to 100 contracts when not all can be renegotiated in the same cycle. You produce a gap analysis template and a remediation priority matrix ranked by function criticality and contract renewal date.

Module 8. Incident Classification and Regulatory Notification

DORA Articles 17 through 19 require classification of ICT incidents against defined severity thresholds and regulatory notification for major incidents within 24 hours. This module covers the classification criteria, how to build the internal severity matrix that maps operational symptoms specific to an insurance entity (claims system outage, policy issuance failure, actuarial engine unavailability) to the regulatory reporting obligation. You produce the incident classification runbook and the initial notification template.

Module 9. TLPT Scope, Coordination, and Supervisory Submission

Threat-led penetration testing applies to insurance entities above DORA's size thresholds and covers ICT systems supporting critical functions. For CIOs at insurance subsidiaries of banking groups, the scope boundary question is significant: does the parent bank's TLPT obligation cover shared platforms? This module covers how to define your entity's TLPT scope, how to negotiate the coordination agreement with the parent bank's security function, and what the supervisory submission package must contain.

Module 10. Exit Strategy and Provider Substitutability

DORA requires documented exit strategies for critical ICT third-party arrangements, including intragroup ones. Exit strategy documentation is frequently absent or present only as a theoretical statement. This module covers what a viable exit strategy must contain for an insurance entity: migration path, data portability plan, transition service agreement terms, and continuity coverage during transition. You produce the exit strategy template and the substitutability assessment for providers with no near-term alternative.

Module 11. The Management Body ICT Risk Report

The quarterly management body ICT risk report is where DORA's governance mandate becomes a visible deliverable. This module covers what the report must contain under Article 5, how to structure the concentration risk section when multiple providers are in the red zone, how to frame residual risk the management body must formally accept, and how to handle the annual framework review approval cycle. You build the report template and the board discussion guide for each major risk section.

Module 12. Supervisory Examination Readiness

DORA supervisory examinations for insurance entities are coordinated by national supervisors under EIOPA oversight. This module covers which documents supervisors examine first, how to structure the evidence pack for the ICT risk management framework review, the most common findings from early examinations across the insurance sector, and how to conduct a self-assessment of your entity's posture before the examination cycle begins. You produce an examination readiness checklist mapped to the DORA article structure.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

The management body keeps returning the ICT risk framework draft for more detail. Module 2 builds the framework document structure with each section mapped to its article reference so the approval cycle completes.

The DORA register is complete for external vendors but the intragroup arrangements section is blank or underdocumented. Module 5 covers exactly how to scope and document those arrangements to the Article 30 standard.

The concentration risk section of the quarterly presentation is unfinished because no narrative methodology exists. Module 6 provides the calculation approach and the written narrative framework the management body report requires.

TLPT is scheduled and the scope boundary with the parent bank is unresolved. Module 9 covers the coordination agreement structure and the supervisory submission package.

What you get with this course

12 written modules covering the full DORA ICT risk governance lifecycle for insurance entities within banking groups
Downloadable ICT risk management framework outline document with article cross-references
ICT third-party register template with all DORA Article 28 mandatory fields
Contractual gap analysis template and remediation priority matrix for Article 30 compliance
Incident classification runbook with severity thresholds mapped to insurance entity operational symptoms
TLPT scope definition worksheet and parent entity coordination agreement template
Management body ICT risk report template with quarterly and annual review sections
Supervisory examination readiness checklist mapped to the DORA article structure
Hand-built implementation playbook tailored to your entity's ICT risk governance profile, delivered alongside course access

What you will have in hand by Day 1, Week 1, Month 1

Course access is provisioned within 24 hours of purchase

The hand-built implementation playbook, tailored to your entity's ICT risk governance profile, is delivered alongside course access

Before and after

Before

The DORA register is partially complete, the concentration risk narrative is undrafted, intragroup arrangements are underdocumented, and the management body keeps returning the ICT risk framework for revision.

After

The ICT risk management framework is approved at the annual review, the register covers both third-party and intragroup arrangements to Article 30 standard, the concentration risk narrative is written and defensible, and the management body report runs on a predictable quarterly cycle.

What happens if you do not address this

Supervisors examining insurance entities under DORA focus on the ICT risk management framework and the third-party register as primary evidence of governance maturity. Incomplete intragroup documentation and undrafted concentration risk narratives are among the most common early findings. A supervisory finding on framework completeness creates remediation obligations that consume more CIO time than the original build would have.

Who it is for

CIO or equivalent ICT risk governance lead at an insurance entity that operates within a banking group or financial holding company. Owns the DORA register, the management body ICT risk report, the TLPT calendar, and the incident classification and reporting process. Manages ICT arrangements that include both external vendors and intragroup services from the parent entity or sibling subsidiaries.

Who this is NOT for. CIOs at standalone insurance companies without intragroup ICT complexity. Technology project managers without regulatory reporting accountability. IT directors whose DORA compliance workstream is fully delegated to a consulting firm with no internal ownership.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Each module is designed to be completed in 30 to 45 minutes, making the full course completable in three to four focused working sessions. The templates and playbook are ready to use immediately after each module.

Why $199 is the right number

A consulting firm engagement covering the DORA ICT risk framework for an insurance entity typically runs to a multi-week project with significant coordination overhead. This course delivers the same analytical framework, the same register and reporting templates, and a hand-built implementation playbook for a fraction of that cost and timeline, with no external consultant requiring access to your internal systems or provider contracts.

FAQ

Does this course cover insurance entities specifically, or is it a generic DORA overview?

Every module is built around the insurance entity context: critical functions specific to insurance operations, EIOPA concentration risk guidance for insurers, how DORA interacts with Solvency II ICT governance requirements, and the intragroup arrangement complexity that arises when an insurance entity operates within a banking group.

What does the implementation playbook contain?

The implementation playbook is built specifically for your entity after purchase. It covers your priority gaps based on the profile you provide, the sequencing of your register completion and contractual gap remediation, and the management body approval timeline for your framework review cycle.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.