What does DORA require for ICT security awareness and training?

DORA requires compulsory ICT security awareness and digital operational resilience training for every employee and for senior management, plus regular specific training for members of the management body. As at September 2026 these obligations have applied for more than 18 months, since Article 64 of Regulation (EU) 2022/2554 set January 17, 2025 as the application date.

Article 13(6) is the core staff obligation: "Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions."

The phrase "compulsory modules" means DORA training is mandatory training inside the entity's existing training scheme, not an optional awareness campaign. The phrase "commensurate to the remit of their functions" means one generic course for everyone is unlikely to be enough: a developer, a payments operator, and a board member face different ICT risks.

The management body bears ultimate responsibility for managing the entity's ICT risk (Article 5(2)(a)), so DORA requires its members to keep their own knowledge current. Article 5(4) states that members "shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed."

Article 5(2)(g) adds a resourcing duty: the management body must allocate and periodically review the budget for digital operational resilience, including relevant ICT security awareness programs, digital operational resilience training, and ICT skills for all staff. Article 13(5) requires senior ICT staff to report at least yearly to the management body on lessons from testing and incidents, which gives directors a regular input for their own learning.

Where appropriate, yes. Article 13(6) says financial entities shall also include ICT third-party service providers in their relevant training schemes, and Article 30(2)(i) requires contracts for ICT services to set out the conditions for providers' participation in the entity's awareness programs and resilience training.

The regulatory technical standards in Commission Delegated Regulation (EU) 2024/1774 reinforce this. Article 19 requires the human resources policy to require staff of the financial entity, and of ICT third-party service providers using or accessing its ICT assets, to be informed about and adhere to the entity's ICT security policies, procedures, and protocols, and to be aware of reporting channels for anomalous behavior, including channels established under the EU Whistleblower Directive where applicable.

DORA is an EU regulation, which Article 64 describes as "binding in its entirety and directly applicable in all Member States." A directive, such as NIS2, sets goals that each Member State must write into national law (transposition), so the detail can differ between countries. A regulation needs no transposition, which is why a bank in Lisbon and one in Frankfurt face the same Article 13(6) text.

National rules still matter for supervision and penalties, which are set and enforced by national competent authorities. In Portugal, Article 15 of the cybersecurity regime approved by Decree-Law 125/2025 designates the Banco de Portugal, the Comissão do Mercado de Valores Mobiliários (CMVM), and the Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) as the special national cybersecurity authorities for digital operational resilience in the financial sector. NIS2 recital 28 treats DORA as the sector specific act for financial entities, so DORA's training rules take precedence over the equivalent NIS2 provisions; see NIS2 management body training.

Entities under the simplified ICT risk management framework in Article 16, such as small and non-interconnected investment firms and certain exempted payment institutions, are not subject to Articles 5 to 15, but they still must develop ICT security awareness programs and resilience training according to their needs and ICT risk profile (Article 16(1)(h)).

Article 28(2)(e) of Delegated Regulation (EU) 2024/1774 adds that the management body of these entities allocates and reviews, at least once a year, the budget for resources including awareness programs, resilience training, and ICT skills for all staff.

A supervisor will look for a documented link between each DORA obligation, the population it covers, the training delivered, and evidence that people can apply it. The table below is an illustrative mapping, not a regulatory template.

Completion data alone rarely shows that training is commensurate to function, which is the distinction explained in completion tracking vs competency verification. Refresh timing can follow the approach in setting mandatory training refresh cycles, triggered also by post incident reviews under Article 13.

Knowledge Foundry represents DORA provisions, ICT roles, and the competencies each role needs as linked objects with assessment points, so each module traces to Article 5, 13, or 16 and to the population it covers. When the entity's ICT policies or the regulatory technical standards change, the affected modules and learners can be identified from those links.