A tailored course, built for your situation
Mastering DORA; A Step-by-Step Guide to Operational Resilience for Financial Services Leaders
A complete implementation roadmap for embedding DORA compliance into core risk and technology delivery workflows.
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
Senior compliance, risk, and technology leaders in EU financial institutions preparing for DORA Article 9 assessments and annual resilience testing cycles.
Who this is not for
Individuals outside financial services or practitioners focused solely on non-regulatory IT operations without compliance ownership.
What you walk away with
- Define escalation thresholds for technology incidents without requiring senior review
- Approve recovery time objectives for critical functions independently
- Own the design of internal resilience testing schedules without external validation
- Sign off on third-party dependency mappings for outsourced cloud services
- Finalise annual audit evidence packs for EBA submission with no revisions
The 12 modules (with all 144 chapters)
Module 1. DORA's Scope in Practice
Clarify which systems, services, and vendor relationships fall under Article 4 classification. Focus on real examples from tier-1 banks’ internal mapping exercises.
12 chapters in this module
- Identifying critical business services per EBA guidelines
- Mapping dependencies across cloud infrastructure providers
- Classifying internal applications using impact tiers
- Documenting cross-border data flows for reporting
- Using heat matrices to prioritise resilience testing
- Validating scope with legal and compliance counterparts
- Avoiding over-inclusion in initial submissions
- Updating scope after M&A or divestiture events
- Aligning with internal risk taxonomy classifications
- Logging scope decisions for audit trail completeness
- Integrating service classification into onboarding flows
- Reviewing scope annually with CRO office input
Module 2. Incident Classification Framework
Build a consistent taxonomy for identifying, logging, and categorising operational incidents that meet DORA thresholds.
12 chapters in this module
- Defining criteria for a tier-1 operational incident
- Setting duration thresholds for service disruption
- Classifying incidents by customer impact severity
- Differentiating DORA-reportable events from internal logs
- Using timestamps to validate outage duration
- Creating standard fields for incident registration
- Validating incident classification with legal team
- Integrating classification rules into monitoring tools
- Training first responders on escalation triggers
- Auditing classification accuracy post-event
- Adjusting thresholds based on historical patterns
- Documenting exceptions for regulator queries
Module 3. Escalation Tree Design
Design clear, role-based escalation paths that ensure timely executive awareness without overburdening leadership.
12 chapters in this module
- Identifying decision owners for each incident tier
- Defining time-bound handoffs across geographies
- Specifying communication channels for escalation
- Setting automatic escalation triggers based on duration
- Including backup roles for primary contacts
- Mapping escalation paths to duty-of-care policies
- Integrating with war room activation protocols
- Documenting escalation decisions in audit logs
- Testing escalation paths during tabletop exercises
- Updating trees after organisational changes
- Aligning with crisis management communication plans
- Validating escalation compliance during internal audits
Module 4. Recovery Time Objectives
Establish realistic, evidence-backed RTOs for critical functions and secure internal sign-off.
12 chapters in this module
- Assessing historical recovery performance for baseline
- Setting RTOs based on business impact analysis
- Documenting assumptions behind each RTO
- Validating RTO feasibility with technical teams
- Including human recovery time in calculations
- Adjusting RTOs per service criticality tier
- Publishing RTOs in resilience documentation
- Reviewing RTOs after infrastructure changes
- Benchmarking against peer institution data
- Handling regulator questions on ambitious RTOs
- Updating RTOs after testing outcomes
- Linking RTOs to SLA commitments with clients
Module 5. Resilience Testing Planning
Develop an annual testing schedule that meets DORA requirements while minimising operational disruption.
12 chapters in this module
- Scheduling tests around peak business cycles
- Identifying minimum viable test scope per function
- Involving third parties in joint testing scenarios
- Designing test objectives for maximum insight
- Using red team simulations to stress test plans
- Documenting test results for regulator submission
- Assigning accountability for test execution
- Integrating findings into control improvement plans
- Avoiding conflicts with other audit cycles
- Securing leadership approval for test scope
- Tracking completion across global units
- Publishing test outcomes to risk committees
Module 6. Third-Party Oversight
Implement structured oversight of ICT third-party providers impacting operational resilience.
12 chapters in this module
- Identifying material vendors under Article 8
- Mapping contract clauses to DORA requirements
- Requiring vendors to report incidents per agreement
- Validating vendor resilience testing participation
- Tracking subcontractor management practices
- Conducting due diligence on cloud service tiers
- Setting minimum security standards for onboarding
- Auditing vendor compliance evidence packs
- Managing exit strategies for critical providers
- Integrating vendor risk into internal reporting
- Enforcing right-to-audit clauses
- Maintaining up-to-date vendor inventories
Module 7. Internal Reporting Requirements
Structure regular internal reports that inform decision-making and demonstrate oversight.
12 chapters in this module
- Defining key metrics for resilience dashboards
- Setting frequency for management reporting
- Including incident trend analysis in summaries
- Highlighting testing gaps and remediation plans
- Documenting decisions based on report insights
- Aligning report content with CRO expectations
- Automating data pulls from monitoring systems
- Ensuring report confidentiality and access control
- Reviewing report effectiveness annually
- Linking reports to capital allocation decisions
- Summarising findings for board-level briefings
- Archiving reports for audit readiness
Module 8. Incident Response Playbooks
Develop standardised response procedures that ensure consistency during disruptions.
12 chapters in this module
- Creating step-by-step actions for common scenarios
- Assigning roles within incident response teams
- Including communication templates for stakeholders
- Integrating with existing ITIL incident workflows
- Defining decision points for playbook branching
- Storing playbooks in accessible knowledge bases
- Training teams on playbook usage
- Updating playbooks after real incidents
- Validating playbook steps during drills
- Linking playbooks to monitoring alert rules
- Ensuring multilingual access for global teams
- Securing approval for playbook changes
Module 9. Regulatory Evidence Packaging
Assemble complete, regulator-ready submissions for DORA Article 9 assessments.
12 chapters in this module
- Compiling incident registers for review period
- Gathering testing results from all business lines
- Including third-party compliance attestations
- Validating data completeness before submission
- Formatting evidence per EBA expectations
- Redacting sensitive customer information
- Obtaining legal sign-off on final package
- Tracking submission timelines across jurisdictions
- Preparing for follow-up regulator questions
- Using checklist to verify all requirements
- Archiving copy for internal audit
- Learning from prior-year feedback loops
Module 10. Change Control Integration
Embed DORA requirements into existing change management processes.
12 chapters in this module
- Flagging high-risk changes for resilience review
- Requiring resilience checklists for major rollouts
- Integrating with CAB approval workflows
- Assessing impact on critical functions
- Requiring rollback plans for high-severity changes
- Logging changes in central incident repository
- Notifying resilience leads of planned outages
- Suspending changes during active incidents
- Reviewing change success rates quarterly
- Updating controls based on change failures
- Training change managers on DORA triggers
- Auditing compliance with change policies
Module 11. Cross-Functional Coordination
Align resilience practices across compliance, technology, risk, and operations teams.
12 chapters in this module
- Establishing joint working groups for resilience
- Defining shared ownership of key deliverables
- Synchronising reporting cycles across functions
- Creating shared definitions for core terms
- Resolving conflicts in escalation paths
- Integrating input from legal and data protection
- Conducting joint tabletop exercises
- Standardising documentation formats
- Sharing lessons from incident reviews
- Building trust through transparency
- Managing competing priorities during crises
- Maintaining alignment after organisational changes
Module 12. Continuous Improvement
Implement feedback loops that strengthen resilience over time.
12 chapters in this module
- Conducting post-mortems after all major incidents
- Tracking action items to resolution
- Updating playbooks with new insights
- Benchmarking performance against peers
- Identifying investment needs from gaps
- Reporting improvement progress to leadership
- Adjusting testing frequency based on risk
- Incorporating regulator feedback into plans
- Measuring staff preparedness over time
- Revising RTOs and RPOs annually
- Celebrating wins to reinforce culture
- Planning long-term resilience roadmap
How this maps to your situation
- Operational incident handling
- Resilience testing execution
- Third-party risk oversight
- Regulatory evidence submission
Before vs. after
Before
Reliant on cross-team consensus for declaring incidents or adjusting recovery timelines.
After
Empowered to finalise escalation thresholds and recovery windows independently, backed by regulator-aligned frameworks.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 90 minutes of focused reading and reflection, designed for completion over a weekend.
If nothing changes
Continued reliance on group decisions may delay incident response and expose the organisation to scrutiny during EBA assessments.
How this compares to the alternatives
Unlike generic compliance courses, this program focuses exclusively on DORA’s operational resilience requirements with real templates from recent Article 9 submissions and decision frameworks used by senior practitioners in global banks.
Frequently asked
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Is DORA experience required?
No. The course is designed for practitioners new to DORA and those refining existing frameworks.
Are the templates regulator-approved?
Templates are based on actual evidence packs reviewed in recent EBA assessments, anonymised and generalised for broad application.
$199 one-time. Approximately 90 minutes of focused reading and reflection, designed for completion over a weekend..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours