How to organize training and awareness according to DORA

The DORA regulation is very specific when it comes to training and awareness requirements — and this is not only for financial organizations, but also for the IT companies that supply their services to financial entities.

This article specifies what those DORA requirements are, and suggests how to organize effective training and awareness according to this EU regulation.

Comprehensive Guide to the DORA Regulation

Free white paper that explains the basics of the European Union’s Digital Operational Resilience Act

DOWNLOAD NOW

Training and awareness requirements for financial organizations

To start, what exactly does DORA require? There are several articles in DORA that prescribe training and awareness for financial organizations:

• Article 5(2) g) requires organization-wide training and awareness: management bodies of financial entities must “allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff.”
• Article 5(4) requires training and awareness for senior management: “members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.”
• Article 13(6) requires training and awareness for both senior management, and all the employees — financial entities must “develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions.”
• Article 16(1) point (h) requires training and awareness as a consequence of testing and incidents: “implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT security awareness programmes and digital operational resilience training for staff and management.”
• Article 19 (b) in “CDR 2024-1774 Technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework” requires the whole staff of financial organizations to be informed about security documentation, reporting channels for anomalous behavior, and returning all the assets upon termination of employment.
• Article 28 in “CDR 2024-1774 Technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework” requires the organization, as part of simplified ICT risk management, to allocate and review “at least once a year the budget necessary to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training and ICT skills for all staff.”

Training and awareness requirements for IT suppliers

As mentioned earlier, DORA specifies that ICT suppliers of financial organizations also need to go for training and awareness — basically, this training needs to be arranged by the financial organization:

• Article 13(6) says that “where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).”
• Article 30(2) point (i) goes a step further and says that “the contractual arrangements on the use of ICT services shall include at least the following elements: … the conditions for the participation of ICT third-party service providers in the financial entities’ ICT security awareness programmes and digital operational resilience training in accordance with Article 13(6).”
• Article 19 (b), in “CDR 2024-1774 Technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework” similarly to the requirement listed for financial organizations, requires the whole staff of ICT third-party service providers to be informed about security documentation, reporting channels for anomalous behavior, and returning all the assets upon termination of employment.

Which topics should be covered in DORA training & awareness?

When defining topics for training and awareness, the best approach is to go through each DORA article and determine which of them need to be covered with training or awareness.

However, since different DORA requirements are relevant to different employees, the best approach is to group employees and define which articles, i.e., topics, are the best suited for them.

In general, you could go with the following groups:

• Topics for senior management
• Topics for security managers
• Topics for mid-level management
• Topics for IT employees
• Topics for all other employees
• Topics for IT service providers

In the table below, you can see how to map DORA requirements (and requirements of some Commission Delegated Regulations) to particular target groups.