Skip to main content
DORA

DORA Lead Manager

Become a certified DORA Lead Manager. Implement digital operational resilience for financial institutions. PECB-accredited course with exam included.

PECBManager5 daysLiveSelf-pacedIn-house
  • Practitioner-led, taught by a working CISO
Christophe Mazzola

Taught by

Christophe Mazzola

Practicing CISO · Founder of Cyber Academy

See full profile →

For

Right fit if you are.

  • ✓Executives and decision-makers at financial institutions who are accountable for digital resilience strategy
  • ✓Compliance officers and risk managers responsible for meeting regulatory obligations
  • ✓IT professionals supporting ICT governance, risk, and resilience programmes
  • ✓Legal and regulatory affairs personnel who interpret and apply financial regulation
  • ✓Consultants and advisors specialising in financial regulation and cybersecurity
  • ✓Third-party ICT service providers seeking to understand their obligations under DORA

Honest call

NOT for. When to skip it.

We'd rather you keep your money than buy the wrong path.

  • ✗Individuals with no background in information security or ICT risk who may struggle to follow the technical and regulatory content without additional preparation
  • ✗Professionals looking for a purely technical hands-on cybersecurity course, as this programme focuses on governance, compliance, and management rather than technical implementation
  • ✗Those seeking an introductory overview course, since the Lead Manager level targets practitioners ready to plan and lead DORA implementation projects
  • ✗Organisations outside the financial sector whose regulatory environment does not include DORA obligations may find limited direct applicability

Outcomes

What you'll be able to do

  • 1Interpret the purpose and regulatory requirements of the Digital Operational Resilience Act (DORA)
  • 2Explain the fundamentals of ICT risk management, incident management, and digital operational resilience
  • 3Plan and prepare a structured implementation project for DORA compliance
  • 4Apply DORA's five main pillars to strengthen an organisation's digital operational resilience
  • 5Manage ICT-related risks and incidents in line with DORA obligations
  • 6Oversee ICT third-party risk and coordinate information-sharing arrangements
  • 7Conduct reviews of digital operational resilience programmes and identify improvement opportunities
  • 8Support continual improvement cycles to maintain ongoing DORA conformance

Programme

Day by day

Day 1Introduction to DORA Concepts and Requirements

  • Regulatory Context and Scope of DORA

    This module situates DORA within the broader EU financial regulatory landscape and clarifies which entities and ICT services fall within its scope.

  • Core Requirements and Obligations

    Participants examine the key obligations DORA places on financial entities, including governance responsibilities and the five main pillars of digital operational resilience.

  • Fundamentals of Digital Operational Resilience

    This module introduces the foundational concepts of digital operational resilience and explains how they translate into practical organisational measures.

By end of day

  • • Articulate DORA's scope and identify which organisational functions it directly affects
  • • Describe the five resilience pillars and their governance implications
  • • Distinguish DORA obligations from related financial and cybersecurity regulations
Day 2ICT-Related Risk and Incident Management

  • ICT Risk Management Framework

    This module covers the components of a DORA-compliant ICT risk management framework, including risk identification, assessment, and treatment processes.

  • ICT-Related Incident Classification and Reporting

    Participants learn how DORA defines major ICT-related incidents, the criteria used to classify them, and the mandatory reporting timelines to competent authorities.

  • Incident Response and Recovery Planning

    This module addresses the design of response and recovery procedures that satisfy DORA's requirements for business continuity and service restoration.

By end of day

  • • Build an ICT risk management process aligned with DORA's requirements
  • • Classify incidents correctly and map reporting obligations to the appropriate timelines
  • • Design response plans that address both regulatory and operational recovery needs
Day 3ICT Third-Party Risk Management and Information Sharing

  • Third-Party ICT Provider Oversight

    This module explains DORA's requirements for managing concentration risk and maintaining oversight of critical ICT third-party service providers.

  • Contractual and Due-Diligence Requirements

    Participants review the contractual provisions and pre-engagement due-diligence steps that DORA mandates when engaging ICT service providers.

  • Cyber Threat Information Sharing

    This module explores the voluntary and structured information-sharing arrangements DORA encourages among financial entities to strengthen sector-wide resilience.

By end of day

  • • Develop a third-party risk management programme that meets DORA's oversight requirements
  • • Identify and address mandatory contractual clauses for ICT provider agreements
  • • Establish or participate in information-sharing arrangements appropriate to the organisation's risk profile
Day 4Review and Continual Improvement

  • Digital Operational Resilience Testing

    This module covers DORA's requirements for resilience testing, including threat-led penetration testing and basic testing programmes for in-scope entities.

  • Performance Monitoring and Audit

    Participants explore metrics, key performance indicators, and internal audit approaches used to assess the effectiveness of a DORA compliance programme.

  • Continual Improvement Processes

    This module explains how to embed lessons learned from incidents, audits, and tests into a structured improvement cycle that sustains long-term compliance.

By end of day

  • • Design a resilience testing programme proportionate to the entity's size and risk profile
  • • Select indicators that provide meaningful insight into the maturity of the digital resilience programme
  • • Operate a continual improvement loop that incorporates findings from multiple assurance sources
Day 5Consolidation and Exam Preparation

  • Competency Domain Review

    This session revisits the five exam competency domains, reinforcing understanding of ICT risk management, incident management, third-party risk, resilience testing, and continual improvement.

  • Case Study and Practical Application

    Participants work through applied scenarios that mirror the kind of analysis and decision-making assessed across the PECB Certified DORA Lead Manager exam domains.

  • Exam Briefing and Logistics Guidance

    This module clarifies the structure, format, and rules of the PECB examination so that participants understand what to expect during the assessment.

By end of day

  • • Consolidate knowledge across all five DORA Lead Manager competency domains
  • • Apply regulatory and management concepts to realistic organisational scenarios
  • • Approach the PECB examination with a clear understanding of its structure and expectations

Public sessions

Upcoming public sessions

Open-enrolment cohorts. Pick a date and book your seat. Want a private cohort for your team instead? Request an in-house quote.

No confirmed live cohort right now. You can still:

Buy the self-paced licenceRequest an in-house quote

Deep dive

Everything inside this certification

The detail behind the headline. Read at your own pace. Each section answers a buyer question we get on discovery calls.

  • Domain 1: Fundamental concepts of ICT risk management and digital operational resilience
  • Domain 2: Preparing and planning for DORA project implementation
  • Domain 3: ICT risk and ICT-related incident management
  • Domain 4: Digital operational resilience testing and ICT third-party risk management
  • Domain 5: Review and continual improvement

The requirements for certifications are as follows:

  • Drafting a DORA implementation business case
  • Managing a DORA implementation project
  • Implementing an ICT risk management framework
  • Managing documented information
  • Implementing corrective actions
  • Monitoring and improving the performance of the ICT risk management framework
  • Certification and examination fees are included in the price of the training course
  • Participants will receive the training course material containing over 450 pages of explanatory information, examples, best practices, exercises, and quizzes.
  • An attestation of course completion worth 31 CPD (Continuing Professional Development) credits will be issued to the participants who have attended the training course.
  • In case you fail the exam, you are eligible to retake the exam within a 12-month period from the date the coupon code is received.

Educational approach

  • The training course incorporates interactive elements, such as essay-type exercises and multiple-choice quizzes, some of which are scenario-based.
  • Participants are strongly encouraged to communicate and engage in discussions.
  • The quizzes are designed in a manner that closely resembles the format of the certification exam.

FAQ

Buyers always ask

What is the difference between completing this training course and obtaining a PECB Certified DORA Lead Manager credential?+

Completing the five-day training course means you have attended all sessions and received a certificate of course completion from Cyber Academy. This does not by itself award a professional certification.

To obtain a PECB Certified DORA Lead Manager credential, you must separately pass the PECB examination and satisfy PECB's own certification requirements, which include specific professional experience criteria. The exam and certification process are administered directly by PECB, not by Cyber Academy.

What does the PECB DORA Lead Manager exam assess?+

The exam evaluates competency across five domains: fundamental concepts of ICT risk management and digital operational resilience; preparing and planning a DORA implementation project; ICT risk and ICT-related incident management; digital operational resilience testing and ICT third-party risk management; and review and continual improvement.

For details on exam format, available languages, duration, and passing criteria, candidates should consult the PECB List of Exams and the Examination Rules and Policies published on the PECB website.

Is the certification exam included with this course?+

Exam inclusion depends on the delivery format and commercial option selected. Check the booking summary or ask Cyber Academy for written confirmation before registering.

Completing the training, passing the applicable exam, and meeting the PECB credential requirements are separate steps.

Who benefits most from this course, and are there formal entry requirements?+

The course is designed for professionals who need to plan, lead, or advise on DORA compliance programmes, including executives, compliance and risk managers, IT professionals, legal staff, and consultants working in or with the financial sector.

There are no formal prerequisite qualifications. PECB recommends that participants have a foundational understanding of information security and ICT risk management concepts before attending so they can follow the technical and regulatory content effectively.

How does DORA relate to other frameworks such as ISO 27001 or NIS2?+

DORA is an EU regulation that imposes legally binding requirements specifically on financial entities and their critical ICT third-party providers, focusing on digital operational resilience. While frameworks such as ISO 27001 address information security management more broadly, and NIS2 covers network and information system security across multiple sectors, DORA introduces financial-sector-specific obligations including mandatory ICT incident reporting, resilience testing requirements, and direct oversight of critical third-party providers.

This course focuses exclusively on DORA's requirements and does not provide certification preparation for ISO 27001, NIS2, or other frameworks, although familiarity with those frameworks may help participants contextualise DORA's approach.

Next step

Where this leads

Pillar guide

Read the full DORA guide

Digital Operational Resilience Act for financial entities and their critical ICT providers.

Ready to get certified?

Taught by a practicing CISO. Prices and exam terms shown up front.

Buy a live seatBuy self-paced licenceRequest a quote