GRC-01
Cyber Governance for Executives (DORA)
day(s)
Remote Session
Paris
Decision-makers
On request
PRESENTATION & TARGET AUDIENCE
Understand your role. Limit your exposure.
A board of directors or executive committee arbitrates budgets, sets priorities, and makes decisions under pressure in a crisis. If its members lack a basic understanding of cyber risk, the organization’s compliance and its ability to respond to an incident remain fragile, regardless of the resources invested further down the hierarchy. This training is therefore not a box-ticking exercise, it directly determines the strength of the organization’s line of defense.
This training is designed for executives, Executive Committee (ExCom) and Board members, and directors of financial entities subject to DORA. It enables participants to identify the main objectives of the regulation and understand its consequences for executive liability.
PREREQUISITES
No technical or theoretical prerequisites are needed to attend this training.
LEARNING OBJECTIVES
The overall pedagogical objective of this training is to enable executives to identify the main objectives of the DORA regulation and understand its consequences for their liability as directors.
By the end of this training, participants will be able to:
- Identify the scope of application of DORA and distinguish the type of financial entity concerned and the competent authority their organization falls under, in order to map the risk typologies to which it is genuinely exposed.
- Explain the compliance requirements placed on the management body, and match each family of requirements to the technological and organizational levers available to address it.
- Link the criticality of service providers and the business impact of potential incidents to the priorities of an effective cybersecurity policy.
TRAINING METHODS
This training alternates interactive presentations and practical workshops. The introductory module draws on key figures and recent cases to anchor the stakes before addressing the regulations. The following modules are based on hands-on exercises and a contrasting case study leading to a group discussion facilitated by the trainer.
ASSESSMENT METHOD
The effective mastery of all the learning objectives will be assessed through a quiz (summative assessment).
PROGRAMME
Sequence 1: What DORA concretely means for your organization
- Explain the criteria used to qualify the type of financial entity concerned, and identify the competent authority it falls under.
- Describe the most common risk typologies in the financial sector (ICT-related incidents, failure of a critical service provider, cyberattacks), and map the organization’s exposure to each of these risks.
Sequence 2: Legal obligations and risks for executives
- Explain the obligations Article 5 of the regulation places on the management body (approval, review and oversight of the risk management framework, ongoing training for executives).
- Distinguish sanctions targeting the entity itself from the specific regime applicable to critical third-party ICT providers.
- Describe the risk management requirements forming the core of the regulation (documented framework, incident classification and notification, digital operational resilience testing, third-party risk management).
- Explain the principle of European harmonization through common technical standards, and distinguish the competent authority and sanction calibration specific to each sector (ACPR or AMF depending on the case).
- Identify the resulting notification obligations (deadlines to be met), and define the organization required to meet and sustain them over time.
- Match each family of requirements to its concrete levers: methodological (EBIOS RM), normative (ISO 27001), technological (detection and response, strong authentication, encryption, isolated backups, penetration testing) and organizational (staff training, access governance, contractual clauses for providers, tested continuity plans).
Sequence 3: Concrete examples and ROI of an effective cybersecurity policy
- Outline the method for mapping and scoring provider criticality, and describe its role as the starting point of a prioritized compliance plan.
- Distinguish the business impact of an unmanaged incident (business interruption, loss of contracts, reputational damage, risk to regulatory authorization) from the cost of a structured approach.
- Explain, using a reading grid, how the risk-reduction impact of a security measure helps determine investment priorities.
Updated on 3 July 2026
Training Center
PARIS
121 rue d'Aguesseau (centre d'affaires Emergence)
92 100 Boulogne Billancourt
Registered under number: 11922630392.
Meets DORA requirements
Article 5 of DORA requires executives to be trained on ICT risk. This training meets that obligation directly, combining exposure to the regulatory framework with hands-on workshops. It produces a training certificate and quiz results, usable as evidence during an audit or regulatory review.
A key component of a comprehensive solution :
- Full DORA training programme : from executive training to organisation-wide staff awareness, including IT teams and phishing simulation campaigns.
- Cyber crisis exercise : joint simulation with management and IT teams, to rehearse coordination under pressure.
- Third-party risk management : mapping your suppliers and providers, scoring their criticality, and securing your supply chain contractually.
- CISO as a Service: ongoing strategic security guidance, without an in-house recruitment.