DORA compliance training 

Operational resilience

• Without any legal requirements: how does company-wide security work today? How can an organization become “digitally resilient”?
• A triad of information security management, business continuity management and third-party risk management.
• Not just for cyber risks, but for all risks that can disrupt the organization's operations.
   

Key messages:

1. Security and digital resilience are not an “IT thing”, but run through all areas of the business.
2. Risk management is the be-all and end-all, not only in your own organization, but also along the value chain.
3. Despite comprehensive measures, disruptions can always occur, and you have to be prepared for that too. 

A glimpse into our e-learning:

The DORA Regulation

• What Does DORA Require from Affected Companies?
  
  Operational Resilience and Risk Management. Risks in Information and Communication Technology (ICT) must be identified and managed as effectively as possible.
• Classification and Reporting of ICT Incidents. Affected companies must be able to systematically detect, report, and manage incidents related to ICT.
• Testing Digital Operational Resilience. DORA mandates regular assessments and, if necessary, adjustments to protective measures.
• Third-Party Risk Management. Many ICT services are provided by external vendors. Therefore, it is crucial to consider associated risks within a Third-Party Risk Management (TPRM) framework.
• Information Sharing. DORA actively promotes voluntary information exchange between affected companies and supervisory authorities.

Key Message:

DORA strengthens the resilience of the financial industry and its ICT service providers against cyber threats in a sustainable and long-term manner. Attacks are detected earlier, incidents are handled more quickly and effectively, and potential damage is minimized.

A glimpse into our e-learning:

My Responsibilities

The training differentiates between executives and employees, as they have distinct roles in implementing DORA.

• Executives are responsible for their business units, act as information owners, and serve as role models for their teams.
• Security teams can support implementation, but identifying risks in business processes (e.g., BIA, RIA) can only be successful with the involvement of the business units.
• Responsibility for implementation does not lie with Security or IT but with senior management—and consequently with every executive.

Key Messages (for Executives):  

1. It’s about your information and your responsibility. And it’s about protecting the company from existential threats.
2. Ensure that security measures are implemented in your area. Actively support implementation with resources and expertise.
3. Make sure that ICT services are only used after a prior risk analysis and due diligence within the Third-Party Risk Management framework.
4. Ensure that employees regularly participate in relevant training, education, and awareness programs.