The Digital Operational Resilience Act (DORA) sets requirements for digital operational resilience in the EU financial sector. Complete a task checklist for your area to identify internal responsibilities, a supplier’s contribution and contacts for unresolved questions.
In the case, a role chart assigns overall risk management for a financial entity to its ICT supplier, although the contract describes only the supplier's contribution to reporting and recovery. Correct the chart and formulate questions about internal decisions and handovers. When another subcontractor joins, add the dependency and information routes.
This introductory course provides orientation for the EU financial sector. Suppliers must separately assess their own regulatory position; applicability to your organisation also requires a separate legal assessment.
What you will work on
Map DORA topic areas to your organisational context
Distinguish the financial entity's responsibilities from supplier contributions
Assign an outstanding responsibility in the case
Who it is for
Managers in financial entities
Control and compliance professionals
Managers at ICT suppliers serving financial entities
Topics
Scope and actors in the EU financial sector
ICT risk management and management accountability
Reporting of ICT-related incidents
Digital operational resilience testing
ICT third-party risk and supplier contributions
Responsibilities, evidence and outstanding tasks
Your result
Your DORA task checklist records internal tasks, supplier contributions, contacts and follow-up questions. Use it for future initiatives in your area.
Prerequisites
Knowledge of your function and basic ICT dependencies. For your own overview, you need access to approved information about your area and its ICT dependencies; otherwise you work with a financial-sector case study. No previous DORA knowledge is required.
Format and approach
Planned: 4–5 hours of self-study as an introductory course, with mapping tasks and self-checks with explanations.
A report claims that 100 per cent of recovery tests succeeded. On closer inspection, only a low-criticality system was tested. Assess what the evidence supports and plan how to test the critical service and address a finding.
A contract permits exit from an ICT service within three months. Data export takes four months and a replacement provider needs five. Plan how the minimum service can be maintained during the transition.