A tailored course, built for your situation
Mastering DORA for Financial Services Compliance Practitioners
A structured path to owning operational resilience decisions in regulated financial environments
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
Compliance and risk practitioners in regulated financial institutions leading DORA implementation without formal authority escalation paths
Who this is not for
Vendors selling DORA tooling, consultants without hands-on control mapping experience, or practitioners outside financial services
What you walk away with
- Identify and claim ownership of 9 specific decision points under DORA Article 25 without requiring senior review
- Structure internal incident reports that trigger automatic acceptance by oversight functions
- Map cross-functional control responsibilities to prevent ownership gaps during audits
- Build a living playbook that survives team turnover and leadership shifts
- Demonstrate compliance depth during regulator walkthroughs with framework-backed evidence flows
The 12 modules (with all 144 chapters)
Module 1. Understanding the EBA’s Operational Resilience Mandate
Establish foundational knowledge of DORA’s scope, objectives, and regulatory expectations for financial institutions. Explore how designated essential functions are identified and mapped across systems and third parties.
12 chapters in this module
- Defining operational resilience in the context of financial services
- Overview of the Digital Operational Resilience Act (DORA)
- Role of the European Banking Authority in enforcement
- Key obligations for financial entities under DORA Article 3
- Identifying critical and important functions per EBA guidelines
- Mapping dependencies across internal and external service providers
- Timeline for compliance across reporting cycles
- How national regulators are interpreting DORA requirements
- Common misconceptions about scope and applicability
- Case study: First-tier implementation at a global investment bank
- Integration points with existing risk frameworks
- Building stakeholder alignment on initial scoping
Module 2. Incident Classification and Reporting Thresholds
Define clear criteria for categorizing ICT incidents and determine reporting obligations based on impact and duration. Learn how to document events so they meet EBA standards without over-escalation.
12 chapters in this module
- Defining materiality for ICT incidents under DORA Article 4
- Three-tier classification: minor, major, critical
- Time-based thresholds for escalation and notification
- Decision rights for initial classification by frontline teams
- Documenting incident details to support regulatory review
- When to involve external experts or legal counsel
- Internal logging standards that pass audit scrutiny
- Avoiding over-reporting while maintaining compliance
- Cross-border notification requirements
- How peer firms are handling initial reporting loads
- Template creation for standardized incident records
- Audit trail requirements for classification decisions
Module 3. Vendor Risk and Third-Party ICT Provider Oversight
Gain full command over vendor selection, monitoring, and incident response coordination. Understand how to enforce DORA requirements within contractual frameworks and SLAs.
12 chapters in this module
- Scope of third-party ICT providers under DORA Article 6
- Vendor classification: in-scope vs out-of-scope services
- Due diligence expectations for cloud infrastructure providers
- Contractual clauses required for compliance verification
- Right-to-audit provisions and enforcement mechanisms
- Oversight frameworks for subcontracting chains
- Incident reporting responsibilities by vendor tier
- Establishing joint testing protocols with key suppliers
- Managing vendor-owned control evidence collection
- Benchmarking vendor performance against EBA baselines
- Termination triggers based on recurrent control failures
- Integrating vendor oversight into regular risk reporting
Module 4. ICT Risk Assessment Framework Design
Build a repeatable, defensible process for identifying, measuring, and treating ICT risks across the organization. Ensure assessments align with business impact priorities.
12 chapters in this module
- Defining the ICT risk universe for financial institutions
- Aligning risk taxonomy with EBA reference models
- Conducting business impact analyses for critical functions
- Risk scoring methodologies incorporating likelihood and impact
- Documentation standards for risk treatment decisions
- Integration with existing ERM processes
- Role clarity between risk owners and control implementers
- Frequency requirements for risk reassessment
- Incorporating threat intelligence into risk scenarios
- Scenario testing for extreme but plausible events
- Reporting risk profiles to senior management
- Common gaps found during supervisory reviews
Module 5. Operational Resilience Testing Programs
Design and lead testing programs that validate incident response capabilities and resilience plans. Learn what evidence regulators expect to see from test outcomes.
12 chapters in this module
- Types of resilience testing under DORA Article 20
- Requirements for frequency and scope per entity size
- Designing realistic cyber attack simulations
- Involving executive leadership in tabletop exercises
- Third-party testing coordination and oversight
- Documenting test results for supervisory submission
- Remediation tracking for identified weaknesses
- Integrating test findings into control improvements
- Benchmarking test maturity against industry peers
- Resource planning for annual testing cycles
- Common deficiencies in initial test reports
- Building organizational muscle memory through repetition
Module 6. Information and Intelligence Sharing Mechanisms
Implement secure, compliant channels for sharing threat data across entities and with regulators. Understand when and how to participate in industry forums.
12 chapters in this module
- Purpose of financial sector information sharing under DORA
- Approved entities for intelligence exchange
- Anonymization standards for shared incident data
- Internal approval processes for disclosure
- Technical platforms used for secure transmission
- Timing requirements for aggregated reporting
- Liability protections for good-faith sharing
- Participation in FS-ISAC and other networks
- Evaluating value from shared intelligence feeds
- Internal distribution of relevant threat updates
- Maintaining audit readiness for sharing logs
- Balancing transparency with confidentiality obligations
Module 7. Building the Resilience Control Framework
Develop a comprehensive set of controls that satisfy DORA requirements and integrate with existing governance structures. Map ownership clearly to prevent gaps.
12 chapters in this module
- Core components of a DORA-compliant control framework
- Control types: preventive, detective, corrective
- Mapping controls to specific DORA articles
- Assigning control ownership by function and level
- Documentation depth expected by regulators
- Control testing frequency and evidence standards
- Version control and change management for framework updates
- Integration with ISO 27001 and other standards
- Automating control monitoring where possible
- Reporting control status to oversight bodies
- Handling control exceptions and compensating measures
- Continuous improvement based on test and audit outcomes
Module 8. Internal Governance and Oversight Structures
Establish effective committees and reporting lines that ensure accountability and decision quality. Align control ownership with organizational hierarchy.
12 chapters in this module
- Roles and responsibilities under DORA Article 23
- Establishing resilience oversight committees
- Frequency and agenda requirements for governance meetings
- Escalation paths for unresolved control gaps
- Reporting templates for executive update cycles
- Integrating DORA metrics into performance dashboards
- Training requirements for governance participants
- Documenting deliberations and decisions
- Succession planning for key control roles
- External validation of governance effectiveness
- Benchmarking governance maturity models
- Avoiding siloed decision-making across functions
Module 9. Evidence Collection and Audit Readiness
Produce clean, complete documentation packages that stand up to internal and regulator review. Eliminate delays caused by missing or weak evidence.
12 chapters in this module
- Types of evidence required per DORA article
- Retention periods and storage requirements
- Standardizing evidence formats across teams
- Sampling approaches used by auditors
- Preparing for on-site supervisory assessments
- Common deficiencies cited in audit findings
- Evidence validation checklists for each control
- Cross-referencing evidence to risk assessments
- Using automation tools for evidence aggregation
- Version control for updated policies and procedures
- Handling document requests under tight timelines
- Post-audit action tracking and closure
Module 10. Cross-Functional Control Ownership Models
Clarify decision rights and responsibilities across technology, risk, legal, and operations. Prevent duplication and gaps in control implementation.
12 chapters in this module
- Challenges of decentralized control ownership
- Three models: centralized, federated, distributed
- Role of the central compliance function under DORA
- Defining RACI for key control activities
- Conflict resolution mechanisms for ownership disputes
- Onboarding new teams into control frameworks
- Maintaining consistency across geographies
- Communication strategies for control changes
- Training and certification requirements
- Performance incentives tied to control quality
- Audit readiness across multiple stakeholders
- Documenting handoffs and transitions
Module 11. Sustaining Resilience Through Leadership Change
Ensure continuity of compliance posture despite personnel shifts. Build institutional knowledge that transcends individual contributors.
12 chapters in this module
- Knowledge capture techniques for tacit expertise
- Documenting decision rationales and precedents
- Succession planning for critical control roles
- Onboarding checklists for incoming practitioners
- Standardizing operating procedures across tenures
- Central repositories for key artifacts and decisions
- Mentorship models for emerging leaders
- Lessons learned from leadership transitions
- External validation as continuity evidence
- Building organizational memory systems
- Versioned control playbooks with change logs
- Automated alerts for upcoming review cycles
Module 12. Future-Proofing the Resilience Posture
Anticipate upcoming revisions and supervisory expectations. Position your practice ahead of the next audit cycle.
12 chapters in this module
- Tracking regulatory developments post-DORA
- Engagement opportunities with standard-setting bodies
- Incorporating emerging threats into planning
- Adopting new technologies responsibly
- Benchmarking against forward-leaning peers
- Investing in automation and AI tools
- Workforce planning for future skill needs
- Expanding influence across business lines
- Communicating resilience value to executives
- Preparing for international expansion implications
- Building external recognition through thought leadership
- Continuous learning pathways for practitioners
How this maps to your situation
- Initial DORA scoping and classification decisions
- Vendor oversight and third-party control enforcement
- Internal governance and cross-functional alignment
- Audit preparation and long-term sustainability
Before vs. after
Before
Uncertain which resilience decisions you can own independently
After
Confident sign-off authority on incident classification, vendor escalations, and reporting rhythms
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 90 minutes per week over eight weeks, self-paced with downloadable resources for offline review.
If nothing changes
Continuing without clear command of decision rights may result in duplicated reviews, delayed responses, and missed opportunities to lead in your function.
How this compares to the alternatives
Unlike generic compliance courses, this program focuses exclusively on DORA’s decision rights and evidence standards, with templates tailored to financial services practitioners who need to act without waiting for approval.
Frequently asked
Who is this course designed for?
Compliance and risk practitioners in financial institutions implementing DORA, particularly those expected to make independent judgments on incident and control matters.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Does this cover MiFID II or other regulations?
The focus is DORA, though concepts apply broadly to financial services compliance. Other frameworks are covered only as they intersect with DORA requirements.
$199 one-time. Approximately 90 minutes per week over eight weeks, self-paced with downloadable resources for offline review..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours