GRC-03
DORA Principles and Obligations for IT Teams
day(s)
Remote Session
Paris
Decision-makers
On request
PRESENTATION & TARGET AUDIENCE
An IT team translates regulatory requirements into concrete measures, selects tools, prioritizes remediation, and manages the relationship with service providers. Without a precise understanding of the DORA framework and the internal division of roles, compliance ends up relying on individual interpretation and blind spots, particularly in organizations where no dedicated CISO position exists.
This training is designed for CIOs and CISOs of financial entities subject to DORA. It aims to give IT teams the reference points and methods needed to translate DORA into concrete day-to-day actions.
PREREQUISITES
No technical or theoretical prerequisites are needed to attend this training.
LEARNING OBJECTIVES
The overall pedagogical objective of this training is to explain the DORA regulatory framework to IT teams and enable them to apply the methods and tools needed to translate it into concrete day-to-day actions.
By the end of this training, participants will be able to:
- Explain the DORA regulatory framework and describe what it concretely changes for an IT team’s daily work.
- Distinguish their own role from that of their counterparts within the compliance framework, including in the absence of a dedicated CISO, and apply a RACI grid to the main DORA obligations.
- Apply a recognized risk analysis method (ISO 27005, EBIOS RM), linked to DORA’s documentary requirements, to a typical critical system.
- Classify an incident according to defined criteria, and apply the notification procedure within the required deadlines.
- Build and maintain an ICT service provider register, and assess their level of criticality.
- Assess and calibrate security measures according to the size and criticality of the organization, based on the principle of proportionality.
TRAINING METHODS
This training alternates interactive presentations and practical workshops. The introductory module draws on key figures and recent cases to anchor the stakes before addressing the regulations. The following modules are based on hands-on exercises and a contrasting case study leading to a group discussion facilitated by the trainer.
ASSESSMENT METHOD
The effective mastery of all the learning objectives will be assessed through a quiz (summative assessment).
PROGRAMME
Sequence 1: Introduction to DORA
- Explain the regulatory context and scope of application of DORA, and distinguish its relationship with other cyber regulations (notably NIS2).
- Describe the main pillars of the regulation (ICT risk management, incidents, resilience testing, third parties, information sharing).
- Explain the concrete changes for an IT team (new documentary obligations, new deadlines, new points of contact).
Sequence 2: Who owns what, positioning yourself within the chain of responsibility
- Distinguish the division of roles between management, the security function (CISO, or CIO/IT manager in its absence), legal, business units and external providers.
- Apply a RACI grid to the main DORA obligations to clarify who decides, who executes, and who validates.
Sequence 3: Risk management framework
- Explain the key principles of risk analysis (ISO 27005, EBIOS RM).
- Link a risk analysis method to the documentary requirements expected under DORA.
- Apply the method to map the risks of a typical critical system (hands-on exercise).
Sequence 4: Incident notification in practice
- Differentiate the criteria used to classify an incident as major.
- Identify the deadlines to be met (4h, 72h, 1 month) and each party’s role in the notification chain.
- Apply the classification and notification procedure to a simulated case (workshop).
Sequence 5: Securing ICT third parties
- Build and maintain an up-to-date register of ICT service providers.
- Apply a scoring method to assess provider criticality.
- Identify the contractual clauses to include and the subcontracting chain management requirements.
Sequence 6: Sizing technical measures, the principle of proportionality
- Position the principle of proportionality within DORA.
- Apply a sizing grid for measures according to the organization’s size and criticality.
- Translate a technical measure into a risk/cost argument, and justify an investment request presentable to the executive committee.
- Distinguish a disproportionate over-investment from a minimal setup that is insufficient given the risk profile.
Updated on 3 July 2026
Training Center
PARIS
121 rue d'Aguesseau (centre d'affaires Emergence)
92 100 Boulogne Billancourt
Registered under number: 11922630392.
Meets DORA requirements
Article 13.6 of DORA requires staff training to be proportionate to each employee’s function, with a level of complexity commensurate to their responsibilities. For IT and security teams, that means operational skills mapped directly to compliance duties, not generic awareness content. This training delivers exactly that: risk analysis methodology, incident classification, vendor oversight and technical sizing, producing a certificate and quiz results usable as evidence during an audit.
A key component of a comprehensive solution :
- Full DORA training programme : from executive training to organisation-wide staff awareness, including IT teams and phishing simulation campaigns.
- Third-party risk management : mapping your suppliers and providers, scoring their criticality, and securing your supply chain contractually.
- CISO as a Service: ongoing strategic security guidance, without an in-house recruitment.