DORA Training
DORA training builds the digital-operational-resilience awareness the regulation requires across staff and, critically, the management body, which under Articles 5–6 must maintain sufficient knowledge to understand and oversee ICT risk.
Who needs training
DORA expects ICT security-awareness training for all staff and tailored resilience training proportionate to role. The management body carries an explicit, non-delegable duty to keep its ICT knowledge current, since it bears ultimate accountability for the framework.
What good training covers
Effective programmes cover the five pillars, incident-reporting duties, third-party-risk obligations, and the entity's own policies, refreshed as the regulation and its technical standards evolve.
What supervisors say boards still get wrong
DORA's Article 5–6 duty is not satisfied by a single annual presentation to the board. The EBA's 23 February 2026 follow-up peer review of how competent authorities assess ICT risk under the Supervisory Review and Evaluation Process found that, more than a year into DORA's application, supervisors are now testing whether a management body can demonstrably understand and challenge the ICT risks it is presented with, not just receive a briefing. The review also found convergence still uneven across the EU: how rigorously a home authority probes board-level ICT competence varies by jurisdiction, so an entity should not assume the bar is the same everywhere. A training programme that produces a paper trail of sessions delivered is no longer enough on its own; it needs to show the management body actually applied that knowledge, for example in how it questioned a risk appetite proposal or an incident post-mortem.
Frequently asked questions
Does DORA require board-level training?
DORA requires management-body members to possess and keep up to date sufficient knowledge and skills to understand and assess ICT risk and its impact.
Is staff security-awareness training mandatory?
DORA requires ICT security-awareness programmes and digital-resilience training as part of the ICT risk-management framework.
How often should DORA training be refreshed?
Regularly, and whenever the regulation, technical standards, or the entity's risk profile change materially.
Is delivering training enough to satisfy DORA's board-knowledge requirement?
Not on its own. A February 2026 EBA follow-up peer review found supervisors increasingly testing whether a management body can demonstrably understand and challenge ICT risk, not just confirm training sessions took place, though the depth of scrutiny still varies by competent authority.