DORA: training requirements in the financial sector

The Digital Operational Resilience Act aims to ensure that financial entities can withstand, respond to and recover from disruptions and attacks on their information and communication technology (ICT). Its scope is broad: credit institutions, payment and e-money institutions, investment firms, insurers and reinsurers, fund managers, crypto-asset service providers and others listed in Article 2. As a regulation, DORA applies directly; it has been applicable since 17 January 2025 (Article 64).

DORA rests on five pillars: ICT risk management (Chapter II), handling and reporting of ICT-related incidents (Chapter III), digital operational resilience testing (Chapter IV), management of ICT third-party risk (Chapter V) and information sharing (Chapter VI). Training is not a chapter of its own but a cross-cutting duty, anchored mainly in Articles 5 and 13.

Article 5 makes the management body responsible for ICT risk management: it defines and approves the framework, oversees its implementation and bears ultimate responsibility. To make that work, Article 5(4) requires members of the management body to actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the entity's operations — including by following specific training on a regular basis, commensurate to the ICT risk being managed.

That is more than a recommendation. Training must be specific, meaning tailored to the entity's risk profile, and it must be regular. A one-off induction on appointment does not meet the wording.

Article 13 covers learning and evolving. Under paragraph 6, financial entities develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. These apply to all employees and to senior management staff, at a level of complexity commensurate with the remit of their functions.

Where appropriate, financial entities also include ICT third-party service providers in their training schemes. Correspondingly, Article 30(2)(i) requires contracts for ICT services to oblige the provider to participate in the financial entity's ICT security awareness programmes and digital operational resilience training.

Article 13 also requires financial entities to analyse lessons from incidents and tests and feed them back into the ICT risk-management framework. For training this means content is not only revised annually but adjusted specifically after incidents. Leaving training unchanged after a successful phishing attack wastes the most important lesson.

For small and non-interconnected entities, Article 16 provides a simplified ICT risk-management framework. Training remains part of it, but scope and depth may follow the lower risk. Regulatory technical standards from the European supervisory authorities add detail and must be observed.

Supervisors check whether the ICT risk-management framework is lived. That includes evidence that members of the management body were trained specifically and regularly, that the compulsory modules exist for all employees and were completed, and that providers are bound by contract. A central register with training plan, content, participation and results makes inspections much easier.

Because DORA is the more specific law for the financial sector, NIS2 gives way to that extent. Other rules may still apply, such as supervisory requirements on governance or the GDPR for the training data itself.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.