A tailored course, built for your situation
Mastering DORA for Financial Services Compliance Leaders
Build unshakable reasoning for resilience decisions that stand up to peer review
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Peers question your control choices and you lack concrete, sourced reasoning to defend them
The situation this course is for
Even solid compliance work gets challenged when reviewers don’t see the logic behind thresholds, testing cycles, or vendor classifications. Without documented rationale tied to DORA's intent and EBA guidelines, decisions appear arbitrary, even when they’re sound.
Who this is for
Senior compliance or risk practitioner at a U.S.-based financial institution, embedded in DORA implementation or audit coordination, who must defend design choices to technical peers, internal audit, or control owners outside their function.
Who this is not for
Entry-level analysts, consultants selling generic frameworks, or anyone not actively shaping DORA evidence or control narratives for their firm.
What you walk away with
- Explain DORA control thresholds using EBA guidelines and peer-reviewed implementation examples
- Deflect peer challenges with sourced reasoning, not policy repetition
- Map incident reporting requirements to actual operations timelines
- Justify third-party risk classifications with documented precedents
- Produce audit-ready narratives that anticipate follow-up questions
The 12 modules (with all 144 chapters)
Module 1. DORA’s Strategic Intent in U.S. Financial Markets
Understand the regulatory drivers behind DORA, including EBA RTS timelines and how U.S. firms are interpreting cross-border reporting obligations. This module grounds your work in the policy context that shapes review expectations.
12 chapters in this module
- Origins of DORA within post-crisis EU financial oversight
- Key differences between DORA and existing FFIEC guidance
- How U.S. broker-dealers are classifying 'critical ICT providers'
- Mapping DORA’s incident reporting to SEC Form 8-K cycles
- EBA finalisation status and expected U.S. ripple effects
- Defining 'digital operational resilience' in practice
- Why legacy SOX controls don’t cover DORA scope
- The role of the primary regulator in escalation paths
- Timeline for first full compliance cycle reporting
- How tiered thresholds apply to third-party contracts
- Common misinterpretations in vendor classification
- Sources to cite when defending your scope decisions
Module 2. Building Defensible Control Thresholds
Move beyond copying peer thresholds. Learn how to derive and justify your own using EBA guidance, incident data, and operational capacity.
12 chapters in this module
- Why 48 hours isn't always the right incident window
- Linking incident severity to client impact metrics
- Using historical outages to justify recovery targets
- Balancing regulator expectations with technical feasibility
- Documenting rationale for internal audit review
- How to adjust thresholds by business line
- Examples of accepted deviations from EBA templates
- Peer benchmarking without copying flawed logic
- When to escalate threshold decisions upstream
- Using change advisory board data to justify timelines
- Avoiding over-engineering in non-critical systems
- Sources to cite in control design documentation
Module 3. Third-Party Risk Classification Frameworks
Classify vendors with confidence using a repeatable method rooted in DORA Article 5 and EBA Q&A.
12 chapters in this module
- Defining materiality for non-banking ICT providers
- Mapping vendor services to potential firm-wide impact
- Scoring dependencies using network topology data
- Documenting rationale for 'critical' versus 'important'
- Examples from peer institutions under audit
- How to handle multi-vendor service chains
- Using contract renewal cycles to phase controls
- Aligning with internal procurement classification
- Incorporating vendor audit rights into sourcing
- Managing shadow ICT through discovery workflows
- When self-classification isn’t enough
- Sources to defend your classification framework
Module 4. Incident Reporting Workflows and Triggers
Design reporting workflows that meet DORA timelines without over-reporting.
12 chapters in this module
- Defining 'significant ICT incident' by impact type
- Setting detection thresholds using monitoring data
- Integrating with SIEM and service desk systems
- Roles and handoffs in escalation chains
- Documenting initial versus final assessment windows
- How much detail regulators expect in initial reports
- Aligning with existing SOX and SEC disclosure cycles
- Examples of accepted reporting templates
- Avoiding false positives in automated alerts
- Using tabletop exercise outcomes to refine triggers
- When to involve legal and comms teams early
- Sources to cite in reporting policy design
Module 5. Resilience Testing and Audit Readiness
Structure resilience testing that satisfies DORA without creating unsustainable overhead.
12 chapters in this module
- Differentiating resilience testing from disaster recovery
- Frequency requirements by system criticality tier
- Using tabletop exercises to meet minimum standards
- Documenting test scope and assumptions clearly
- Integrating findings into ongoing control improvements
- How much evidence auditors expect to see
- Examples of sufficient test summary reports
- Managing internal versus external test execution
- Timing tests to avoid fiscal close conflicts
- Using past findings to justify current posture
- Aligning with ISO 22301 where applicable
- Sources to defend your testing schedule
Module 6. ICT Provider Subsidiary and Outsourcing Compliance
Ensure outsourced functions meet DORA standards even when outside direct control.
12 chapters in this module
- Defining 'subsidiary' under DORA context
- Applying controls to offshore development teams
- Monitoring compliance through contractual KPIs
- Audit rights and access requirements for vendors
- Evidence collection from third-party providers
- Handling delays in vendor response timelines
- Examples of acceptable SLAs for incident reporting
- Managing multi-tiered vendor relationships
- Using SIG questionnaires effectively
- Documenting oversight process for internal audit
- How often to review third-party attestations
- Sources to cite in oversight framework
Module 7. Internal Governance and Escalation Protocols
Establish clear ownership and escalation paths that reflect DORA’s governance expectations.
12 chapters in this module
- Defining roles: CRO versus CISO versus CTO
- Creating a DORA-specific steering committee
- Integrating with existing risk governance forums
- Setting escalation thresholds by incident type
- Documenting decision logs for audit review
- Managing dual reporting lines in hybrid structures
- Using risk appetite statements to guide choices
- Examples of effective escalation playbooks
- Timing of executive updates
- Aligning with board-level reporting cadence
- Recording rationale for deferred actions
- Sources to justify governance model
Module 8. Data Integrity and Logging Requirements
Meet DORA’s audit logging expectations without overloading existing systems.
12 chapters in this module
- Minimum logging requirements by system tier
- Retention periods for incident versus audit logs
- Securing log access against tampering
- Integrating with existing logging infrastructure
- Sampling strategies for high-volume systems
- Documenting rationale for logging scope
- Examples of sufficient log retention policies
- Handling cross-border data storage issues
- Using logs for post-incident reconstruction
- Aligning with SEC Rule 17a-4 where applicable
- Managing cost versus compliance trade-offs
- Sources to defend your logging design
Module 9. Cyber Threat Intelligence Sharing
Participate in threat sharing without exposing sensitive information.
12 chapters in this module
- Understanding DORA’s threat intel exchange mandate
- Joining qualified information sharing forums
- Classifying threat data for internal dissemination
- Protecting client data in shared reports
- Using automated feeds without overloading teams
- Examples of compliant threat sharing templates
- Integrating with FS-ISAC and other bodies
- Timing of threat notifications
- Documenting participation for auditors
- Aligning with existing CISO workflows
- Managing vendor participation in sharing
- Sources to cite in threat intel program
Module 10. Training and Awareness for DORA Roles
Ensure staff in critical roles understand their DORA responsibilities.
12 chapters in this module
- Defining 'relevant personnel' under DORA
- Frequency and content of required training
- Documenting completion for audit purposes
- Tailoring content by role and system access
- Examples of effective training modules
- Using phishing simulations to reinforce concepts
- Integrating with existing compliance training
- Managing contractors and temporary staff
- Tracking refresh cycles automatically
- Avoiding check-the-box training culture
- Measuring effectiveness beyond completion
- Sources to justify training approach
Module 11. Documentation and Audit Evidence Management
Structure evidence to pass review without last-minute scrambling.
12 chapters in this module
- List of mandatory documentation under DORA
- Organizing files for quick retrieval
- Version control for evolving policies
- Using evidence matrices effectively
- Examples of sufficient policy statements
- Documenting exceptions and compensating controls
- Maintaining evidence between audit cycles
- Integrating with GRC platforms
- Reducing duplication across frameworks
- Preparing for EBA or SEC targeted reviews
- Handling document retention schedules
- Sources to cite in audit preparation
Module 12. Continuous Improvement and Change Management
Build feedback loops that keep your DORA implementation adaptive and credible.
12 chapters in this module
- Using audit findings to prioritize updates
- Integrating lessons from incident reviews
- Updating controls after system changes
- Managing change in hybrid cloud environments
- Examples of effective post-mortem templates
- Aligning with SDLC and change advisory boards
- Documenting rationale for control changes
- Communicating updates to stakeholders
- Tracking improvement metrics over time
- Using maturity assessments constructively
- Avoiding stagnation in control design
- Sources to cite in continuous improvement
How this maps to your situation
- DORA implementation phase
- Pre-audit evidence preparation
- Cross-functional control alignment
- Peer challenge defense preparation
Before vs. after
Before
You rely on policy documents and general guidance when explaining control choices.
After
You respond to peer questions with specific, sourced examples and documented precedents that align with DORA’s intent and EBA expectations.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: 90 minutes per week over six weeks, or binge in one weekend. Total course time: approximately 18 hours.
If nothing changes
Without defensible reasoning, your control decisions may be overridden or second-guessed, jeopardizing both compliance and credibility.
How this compares to the alternatives
Generic DORA overviews give high-level summaries. This course gives you specific, defensible justifications tied to EBA guidance, peer implementations, and operational reality, so you can stand by your decisions when challenged.
Frequently asked
Will this help me if I’m not in Europe?
Yes. DORA affects all firms with EU exposure, and U.S. regulators are monitoring implementation closely. The course includes specific guidance for U.S.-based financial institutions like Schwab.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Is this relevant to SOX or FFIEC?
Yes. The course shows how DORA complements existing frameworks and where it diverges, so you can avoid redundant work and focus on what’s new.
$199 one-time. 90 minutes per week over six weeks, or binge in one weekend. Total course time: approximately 18 hours..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours