Cyber training: a DORA-compliant programme for your entire organisation
DORA requires all financial entities to train their management bodies, IT teams and staff in digital operational resilience. Stroople delivers a complete, Qualiopi-certified programme that covers your entire organisation through a single coordinated programme. Every module directly addresses the requirements of the regulation.
What does DORA require in terms of training?
The DORA regulation (EU 2022/2554), in application since 17 January 2025, requires financial entities to build ICT risk awareness and training into their resilience framework. Article 5(4) requires members of the management body to maintain sufficient knowledge and skills to understand and assess ICT risk and its impact on operations. Article 13(6) makes ICT security awareness programmes and digital operational resilience training compulsory components of staff training schemes, for all employees and for senior management.
In practice, three obligations apply simultaneously: equipping the management body to govern ICT risk, raising staff awareness of everyday threats, and preparing IT leadership to run incident response and reporting within DORA deadlines. A DORA training programme that covers only one of these levels does not fully satisfy the regulatory requirement.
What DORA says: Article 5(4) requires management body members to actively maintain sufficient knowledge and skills to understand and assess ICT risk. Article 13(6) requires ICT security awareness programmes and digital operational resilience training for all staff, including senior management. The management body bears final responsibility for ICT risk management.
An DORA training programme
structured across three levels.
The Stroople programme covers the three profiles DORA targets. Each track is an annual programme blending in-person and remote delivery, designed to consolidate lasting reflexes without pulling teams away for full days at a time.
Before any training begins, Stroople conducts a maturity assessment and adapts content to your entity type, your technology environment and your specific risk exposure, whether you are a bank, an insurer, an asset manager, a payment institution or a critical ICT provider.
This training is designed for executives, Executive Committee (ExCom) and Board members, and directors of financial entities subject to DORA. It enables participants to identify the main objectives of the regulation, understand its consequences for executive liability, and match each family of requirements to the technological and organizational levers available to address it. No prior technical expertise is required.
Discover the full program →This training is designed for CIOs and CISOs of financial entities subject to DORA. It gives IT teams the reference points and methods needed to translate DORA into concrete day-to-day actions: RACI grid across the compliance framework, risk analysis methodology (EBIOS RM, ISO 27005), incident classification and notification within DORA deadlines, ICT provider register and proportionate sizing of technical measures.
Discover the full program →This training is designed for Executive Committee (COMEX) members and members of the IT Department (CIO office). It enables strategic decision-makers and operational leaders to share a common culture of cyber crisis management and to clarify each person’s role in a crisis situation, including regulatory notification within DORA deadlines. No prior technical expertise is required, as the training is designed for executives and managers.
Discover the full program →Executive track
Designed for board members and C-suite executives, this track builds the ICT risk governance posture that DORA requires under Article 5(4). Beyond regulatory knowledge, participants train to lead under pressure: the crisis exercise places the full leadership team in a live ICT incident scenario, from initial detection through to the decision chain and regulatory notification within the 4-hour initial deadline.
IT leadership track
Designed for CIOs, IT managers and security officers, this track covers DORA from an operational standpoint: ICT risk management framework, incident classification and reporting, digital operational resilience testing and third-party risk, including the register of information. The crisis exercise is run jointly with the executive track, ensuring both teams rehearse the same scenario and speak the same language when it matters.
Employees track
An annual programme for all employees, with no technical prerequisite. Four phishing simulation campaigns run throughout the year, with immediate remediation for every clicker and dedicated virtual classroom sessions for repeat clickers. Themed e-learning capsules extend awareness across a broad range of everyday threats, from payment fraud to social engineering.
Cybersecurity training in practice: the detail of your programme
Each organisation’s level of cyber maturity varies. Before we roll out our training modules, we carry out a quick audit to assess your entity type, your technological environment and your level of exposure, so that we can tailor a programme to suit your specific needs.
Phishing simulations: customisable campaigns, measurable results
Phishing simulation campaigns are fully customisable: scenarios, sender identity, pretext and difficulty level are adapted to your sector and your target population. Each campaign is more demanding than the last, progressing from generic mass phishing to targeted spear phishing and executive-level whaling. A detailed report is delivered after each campaign, covering click and reporting rates by department, high-risk profiles and remediation actions triggered.
Phishing simulation campaigns — ACME Bank
1,187 employees · Full year 2024 · 4 campaigns · Increasing difficulty
Avg. click rate
18%
↓ −14 pts vs C1
Reporting rate
39%
↑ +29 pts vs C1
Serial clickers
67
Virtual classrooms triggered
Remediation
94%
219 total clickers
Trend — click rate vs reporting rate
Click rate by department — C4 (whaling)
C1 — Feb. 2024
Mass phishing
Generic security alert email
C2 — May 2024
Targeted mass
Fake Office 365 security alert
C3 — Sep. 2024
Spear phishing
Personalised email — internal HR
C4 — Nov. 2024
Whaling
Executive targeting — urgent transfer request from CEO
* The C4 click rate remains close to C3 despite overall progress: whaling scenarios are the hardest to detect. The relevant benchmark is performance at equal difficulty level, not the raw trend. · Data shown is fictional and produced for illustrative purposes only.
A curated e-learning offer, configured for your organisation
The e-learning offer is configured by Stroople ahead of the programme, based on your regulatory obligations and risk profile. Each module is available in multiple languages, designed to be completed in under to twenty minutes and validated by a scored assessment at an 80% pass threshold. Content is updated as the threat landscape evolves.
E-learning offer — ACME Bank
Staff track · DORA Art. 13(6) · 2025 annual cycle
Assigned to staff track
Identifying a malicious email
Phishing and ransomware awareness
Phishing awareness
AI and phishing: new threats
Spear phishing
QR code phishing
SMS phishing
Payment fraud and fake transfer orders
Regulatory modules — also assigned
DORA regulation overview
GDPR in everyday practice
Understanding GDPR compliance
Content is managed by Stroople and customised to your sector and regulatory obligations. Completion rates reflect ACME Bank staff track progress as of Dec. 2025. Data shown is fictional and produced for illustrative purposes only.
Continuous tracking and audit-ready reporting
Completion and assessment data are tracked continuously across all three groups. The reporting covers individual scores, time spent, risk level and phishing click rate per learner, and serves directly as the documentary evidence expected during a NIS2 compliance audit.
Training follow-up — ACME Bank
1,187 learners · DORA staff track · Dec. 2025
Overall completion
78%
926 of 1,187 learners
Avg. score
7.2/10
Pass threshold: 6.0
Avg. time
47 min
Per active learner
High-risk learners
58
Score below 6.0 or 0% progress
Progress by formation
Most active learners
C. Lefebvre
M. Garnier
T. Rousseau
S. Vasseur
A. Perrin
J. Delcourt
Completion by group
Group 1 — Staff
Group 2 — Management
Group 3 — IT leadership
Completion rates reflect ACME Bank staff track progress as of Dec. 2025. Data shown is fictional and produced for illustrative purposes only.
How is the programme deployed?
Deployment follows four steps, with minimal coordination burden on your teams. First, Stroople conducts the maturity assessment and programme scoping – typically one to two weeks. Next, scheduling is coordinated with your calendar and team availability. In-person sessions can be held on-site or at our training facilities; remote modules are accessible via any browser with no installation required.
Throughout the programme, each module generates formal evaluation outputs: entry-level skills assessments, e-learning QCM results at an 80% pass threshold, and phishing simulation reports. These documents are directly usable as audit evidence for NIS2 compliance. A closing report is delivered at the end of each annual cycle.
Your organisation falls within the DORA scope. Ready to structure your training programme?
Rethinking Cyber Training: One Size Fits None
Most cybersecurity training programs follow the same logic: roll out identical e-learning modules to all employees, once a year, and tick the box. This approach has one virtue: it is simple to deploy and cost-effective. It has one major flaw: it does not work. Not because the tools are poor. Because the starting question is wrong.