DORA is coming: What Europe's operational resilience act means for ICT training

Europe's financial regulators spent years telling firms that cybersecurity was a resilience problem, not just a compliance one. In 2023, they turned that message into law. The Digital Operational Resilience Act, or DORA, adopted in late 2022, established a comprehensive framework for how financial entities must manage information and communication technology risk. With its application date set for January 2025, 2023 and 2024 became the preparation window, and organizations that understood what DORA required early gained a head start. Here is what the regulation demands and where training fits.

What DORA is and who it covers

DORA applies across the European financial sector, covering banks, insurers, investment firms, payment providers, and a wide range of other financial entities, as well as the critical third-party technology providers that serve them. Its scope is deliberately broad, reflecting the recognition that operational resilience depends on the whole ecosystem, not just individual firms. For organizations in scope, DORA replaced a patchwork of national rules with a single, consistent framework for ICT risk.

The ICT risk management requirements

At the heart of DORA is a requirement to maintain a comprehensive ICT risk management framework. Firms must identify risks, protect against them, detect incidents, respond effectively, and recover quickly. This includes governance at the management-body level, regular risk assessments, and clear accountability. The framework is not a one-time project but an ongoing discipline, with documentation and review built in. For many firms, it represented a significant step up in the formality of their ICT risk management.

The training and awareness obligation

DORA explicitly includes training and awareness among the measures firms must implement. The regulation requires that staff and management receive appropriate training on ICT risk, security, and their responsibilities, and that this training be regular and documented. This is not a vague suggestion, it is a named obligation, and it applies from the board down. The logic is consistent with other modern regulations: technical controls matter, but they are operated by people, and those people have to understand the risks and their role in managing them.

Third-party and supply chain risk

One of DORA's most consequential provisions addresses third-party ICT risk. Firms must manage the risks posed by their technology providers, maintain registers of critical providers, and include resilience requirements in contracts. This pushed the supply chain question, long a concern in security circles, into the regulatory mainstream. It also meant that the responsibility for resilience extended beyond a firm's own walls, to the vendors and cloud providers it depends on, a theme that would echo in other regulations in the years that followed.

Incident reporting and testing

DORA imposes strict incident reporting timelines and mandates regular testing, including threat-led penetration testing for significant firms. The reporting requirements put a premium on a workforce that recognizes and reports incidents quickly, much like the SEC rules in the United States. Testing requirements, meanwhile, meant that resilience could no longer be assumed, it had to be demonstrated. Both obligations reinforced the importance of a trained, aware workforce that can act under pressure.

How to prepare

Preparation for DORA began with understanding whether an organization was in scope, directly or through its role as a critical third-party provider. From there, the priorities were: establish or strengthen the ICT risk management framework; deliver and document ICT security training for staff and management; put incident reporting procedures in place that could meet the timelines; and review third-party contracts for the required resilience provisions. The organizations that treated DORA as a program, with owners and a roadmap, were far ahead of those that waited for the application date.

The bigger picture

DORA was part of a global shift toward enforceable, governance-focused regulation of technology risk in finance. It mirrored the SEC rules in the United States and foreshadowed the broader operational resilience expectations that would spread to other sectors. The common thread was the same: resilience is built on documented processes, tested capabilities, and a workforce that understands its role. Organizations that invested in those fundamentals, including training, positioned themselves not just for DORA but for the regulatory direction of travel as a whole.