DORA security awareness training
DORA Article 13(6) makes ICT security awareness and digital operational resilience training compulsory for every employee of an EU financial entity, and Article 5(4) adds regular training for the management body.
Five-to-ten-minute 3D exercises mapped to each DORA duty, with completion evidence your auditor can export.
At a glance
- Regulation
- (EU) 2022/2554, applies from 17 January 2025
- Staff duty
- Article 13(6): ICT security awareness and resilience training for all staff
- Board duty
- Article 5(4): specific training on a regular basis
- Penalties
- Set nationally; critical ICT providers up to 1% of average daily worldwide turnover
Five articles that put people into ICT risk
DORA is mostly about systems and contracts. These are the places where it names staff and leaders directly.
- Art. 5(4) Board knowledge Management body members keep their ICT risk knowledge current, including through regular, specific training.
- Art. 13(6) Compulsory training Awareness programmes and resilience training for all employees and senior management, scaled to role.
- Art. 17 Incident process A defined way to detect, log and escalate ICT-related incidents, which starts with someone noticing.
- Art. 19 Major incident reports Initial notification, intermediate reports and a final report to the competent authority.
- Art. 28 Third-party risk ICT providers are managed as part of your own risk, and Article 13(6) lets you bring them into training.
Article 50(5) lets Member States apply remedial measures to management body members personally.
One path for Article 13(6), renewed every year
The DORA path covers the everyday ICT habits of a financial firm and ends with how to report an incident.
- Ten core courses
- From security policies to incident reporting, with AI basics as an optional extra.
- 12-month cycle
- The path is reassigned each year, so training stays regular without manual chasing.
- Proof per person
- PDF certificates, a tenant CSV and the compliance report page, or sync to Vanta and Drata.
DORA articles, mapped to exercises
Where each exercise supports a specific DORA duty, from the board seat to the branch counter.
Art. 13.6 ICT Security Awareness Art. 17 ICT Incident Reporting Art. 28 Third-Party ICT Risk Art. 25 ICT Testing Requirements Art. 11 Communication & Resilience Art. 16 ICT Risk Management (AI & Agentic Systems) Art. 9 ICT Protection & Prevention How DORA reaches your people
What the regulation asks of staff, leaders and incident handlers, article by article.
01 Check whether you are a financial entity under Article 2
Start with Article 2(1). If your firm holds an EU licence as a bank, payment institution, investment firm, insurer, crypto-asset service provider or one of the other listed entity types, DORA applies.
Smaller firms are not exempt, but Article 4 lets them apply the rules in proportion to their size and risk profile. Training still has to happen. It can be simpler.
02 Train the management body under Article 5(4)
Article 5 makes the management body responsible for the ICT risk management framework. Article 5(4) then asks each member to keep up to date through regular, specific training.
A supervisor can ask who sits on the board, what training each person took and when. Keep those records apart from the staff list.
03 Run compulsory staff training under Article 13(6)
Every employee is in scope, from the service desk to senior management. The content should fit the role: a payments operator needs more on fraud than a facilities coordinator.
The article does not fix a frequency. Running the programme every 12 months and recording completions is a common way to show it is ongoing.
04 Make incident escalation a habit before Articles 17 to 19 apply
Article 17 requires a process to detect, manage and notify ICT-related incidents. Article 19 requires major incidents to be reported to the competent authority.
The technical standard in Delegated Regulation (EU) 2025/301 sets the clock:
- initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it
- intermediate report within 72 hours of the initial notification
- final report within one month of the latest intermediate report
That clock only works if staff report odd emails, calls and system behaviour quickly.
05 Bring ICT providers into the picture under Article 28
Article 28 treats ICT third-party risk as part of your own ICT risk. Staff who onboard vendors, approve integrations or change payment details are where that risk often lands.
Article 13(6) also allows relevant ICT third-party providers to take part in your training programmes where appropriate.
06 Training that shows up in an inspection
DORA does not prescribe a curriculum. It asks for training that fits the role and the ICT risk. Interactive exercises let a payments clerk practise a fake invoice and a board member practise a cloned voice, instead of watching the same video.
Recurring assignment keeps the programme regular. The DORA path is reassigned every 12 months, and each completion is saved with a date.
When a supervisor asks, you can hand over per-user PDF certificates, a tenant-wide CSV, or the compliance report page. Firms that already use Vanta or Drata can sync completion there.
What enforcement looks like so far
Supervision is new, so public cases are scarce. Here is what is on the record so far.
Few published sanctions yet
DORA has applied since January 2025, and we have not found published fines against a financial entity for a training failure.
That does not mean nothing is checked. National competent authorities have powers under Article 50 to inspect, demand documents and order remedial measures. Training records are an easy thing for them to request.
Critical ICT providers designated in November 2025
On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA and ESMA) announced the first designations of critical ICT third-party providers. The designation used data from the registers of ICT contracts that financial entities submitted.
Those providers now sit under direct EU oversight. Under Article 35, a Lead Overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover, for up to six months, if a provider does not comply.
National penalties and personal measures
For financial entities, Article 50 leaves administrative penalties to each Member State, requiring them to be effective, proportionate and dissuasive.
Article 50(5) adds that where national law allows, measures can also be applied to members of the management body and other responsible individuals. That is a reason to keep the board’s Article 5(4) training records clean.
The DORA duties that depend on people
Other DORA duties that depend on how people behave.
Article 13(6): awareness for every employee
The core of the learning path. Policies, phishing, passwords, devices, sensitive data, communication, remote work and public spaces cover the daily ICT habits of a financial firm.
Completion is recorded per person, so you can show coverage across the whole workforce.
Article 5(4): the management body
Board members face the attacks aimed at them: impersonated executives, urgent payment requests, deepfake calls.
Assign the same path, or a dedicated one, to the management body and export their records separately.
Articles 17 and 19: incident reporting
The incident reporting course teaches staff what to report, how and how fast.
The real-world incidents course shows why a slow report costs time the firm needs for its own notification deadlines.
Article 28: third-party ICT risk
OAuth consent, vendor verification and changed bank details are where third-party risk meets daily work.
The related exercises let procurement, finance and IT practise those decisions.
Recommended exercises
Payment fraud, impersonated executives and incident escalation in a financial setting.
- Phishing The baseline Article 13(6) scenario for every employee. Try the exercise
- Business Email Compromise Fake payment instructions, the fraud that lands hardest in finance teams. Try the exercise
- Whaling With A Deepfake For the management body under Article 5(4): a cloned executive asking for an urgent transfer. Try the exercise
- General Incident Reporting Fast escalation feeds the Article 17 process and the Article 19 reporting clock. Try the exercise
- Reporting Culture Staff who report without fear give the incident team the time DORA deadlines need. Try the exercise
- Third-Party App OAuth Risks Article 28 third-party risk in a form employees meet every week. Try the exercise
- Verification Procedures Call-backs and code words for service desk and payment staff facing impersonation. Try the exercise
Further reading
Related glossary terms
References
- Regulation (EU) 2022/2554 (DORA) EUR-Lex
- DORA Article 5: Governance and organisation digital-operational-resilience-act.com (regulation text)
- DORA Article 13: Learning and evolving digital-operational-resilience-act.com (regulation text)
- DORA Article 19: Reporting of major ICT-related incidents digital-operational-resilience-act.com (regulation text)
- DORA Article 35: Powers of the Lead Overseer digital-operational-resilience-act.com (regulation text)
- DORA Article 50: Administrative penalties and remedial measures digital-operational-resilience-act.com (regulation text)
- DORA Article 64: Entry into force and application digital-operational-resilience-act.com (regulation text)
- Delegated Regulation (EU) 2025/301, Article 5: time limits for incident reports Advisera (regulation text)
- European Supervisory Authorities designate critical ICT third-party providers ESMA
Give your supervisor a training record that holds up
Every employee, every board member, renewed on a 12-month cycle.
Frequently asked questions
What is DORA security awareness training?
The Digital Operational Resilience Act has applied to EU banks, insurers, investment firms, payment institutions and other financial entities since 17 January 2025. Article 13(6) requires ICT security awareness and resilience training for all staff, and Article 5(4) requires the board to keep its own knowledge current.
Does DORA require security awareness training?
Yes. Article 13(6) requires financial entities to develop ICT security awareness programmes and digital operational resilience training as compulsory modules in staff training.
It applies to all employees and to senior management, with complexity matched to each person’s role.
Does the board need separate DORA training?
Article 5(4) asks members of the management body to keep enough knowledge and skills to understand and assess ICT risk, including by following specific training on a regular basis.
In practice, keep a distinct record for the board so you can answer that question on its own.
How often does DORA training have to happen?
The regulation does not set a fixed interval. Article 5(4) says "on a regular basis" for the board.
An annual cycle is a common, defensible choice. The RansomLeak DORA path recurs every 12 months.
When did DORA start to apply?
17 January 2025. As an EU regulation it applies directly, with no national transposition step.
What are the incident reporting deadlines?
Delegated Regulation (EU) 2025/301 sets them for major ICT-related incidents:
- initial notification within 4 hours of classification as major, and within 24 hours of becoming aware
- intermediate report within 72 hours of the initial notification
- final report within one month of the latest intermediate report
What are the penalties under DORA?
For financial entities, Member States set administrative penalties under Article 50, and authorities can order remedial measures and publish notices.
Critical ICT third-party providers face periodic penalty payments under Article 35 of up to 1% of average daily worldwide turnover, for up to six months.
Should our ICT providers take the training?
Article 13(6) says financial entities may include relevant ICT third-party service providers in their training schemes where appropriate. It is an option, not a blanket duty.