6 November 2026 • Cyber security
In brief: The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied to banks, insurers, investment firms, payment institutions, pension funds and other financial entities in the EU since 17 January 2025. Article 13(6) makes ICT security awareness programmes and digital operational resilience training compulsory modules in staff training, for all employees and for senior management, at a depth that fits each role. Article 5 puts the final responsibility for ICT risk on the management body, which must budget for that training and keep its own knowledge up to date through regular, specific training. In the Netherlands, DNB and the AFM supervise compliance and can impose fines. What they want to see is evidence: who was trained, on what, how often, and whether it changed behaviour.
DORA training requirements at a glance
DORA has no separate chapter on training. The obligations are spread over several articles and one technical standard. This is what they mean, and what to put on the table when the supervisor asks.
| DORA requirement | What it means for training | Evidence for the supervisor |
|---|---|---|
| Art. 13(6): awareness programmes and resilience training as compulsory modules for all employees | Everyone takes part, including new starters and temporary staff, not only IT | Training plan, enrolment and completion per employee, onboarding records |
| Art. 13(6): complexity commensurate to the remit of each function | Role-based tracks: payments, customer service, developers, ICT staff and management do not get the same content | Mapping of roles to curricula, with the rationale |
| Art. 13(6) and Art. 30(2)(i): ICT third-party service providers in training where appropriate | Contracts state how suppliers take part in your awareness programme | Contract clauses, participation records of supplier staff |
| Art. 5(2)(g): management body allocates and reviews the budget for awareness and training | Training is a board decision, not a line item hidden in IT | Board minutes approving and reviewing the budget |
| Art. 5(4): board members keep their ICT risk knowledge up to date, including by specific training on a regular basis | Separate, recurring sessions for directors and supervisory board members | Attendance, programme content, dates per board member |
| Art. 13(3) and 13(5): lessons from tests and incidents feed back into the framework, reported to the board at least yearly | Training content changes after incidents and test results | Change log of the programme, yearly report to the management body |
| Delegated Regulation (EU) 2024/1774, Art. 19: staff know the ICT security policies and the reporting channels | Employees know how and where to report a suspicious email or behaviour | Policy acknowledgements, reporting figures |
Who falls under DORA
Article 2(1) lists twenty types of financial entity. Among them: credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, fund managers, insurers, insurance intermediaries, pension institutions, credit rating agencies and crowdfunding platforms.
There are exceptions. Insurance intermediaries that are micro, small or medium-sized enterprises fall outside the scope, as do pension institutions with no more than 15 members in total. Small and non-interconnected investment firms, exempted payment and e-money institutions and small pension institutions work under a simplified ICT risk framework in Article 16. Even that lighter regime still requires them to develop awareness programmes and resilience training for staff and management, “according to needs and ICT risk profile”.
ICT third-party service providers are the last item on the list. Most feel DORA through their customers’ contracts. The largest ones are supervised directly: on 18 November 2025 the European Supervisory Authorities published the first list of critical ICT third-party providers, 19 companies ranging from hyperscale cloud to financial software.
The five pillars in brief
Article 1 sets out what DORA regulates, usually grouped into five pillars:
- ICT risk management. A documented framework, governance and controls (Articles 5 to 16). Training sits here.
- Incident reporting. Classifying major ICT-related incidents and reporting them to the supervisor.
- Digital operational resilience testing. A risk-based testing programme, and for designated entities threat-led penetration testing at least every three years (Article 26).
- ICT third-party risk. Contract requirements, an annual register of information and oversight of critical providers.
- Information sharing. Voluntary exchange of threat intelligence between financial entities.
What Article 13(6) says about training
The core sentence is short. “Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions.”
Three words carry the weight. Compulsory means an optional e-learning on the intranet does not qualify. All means the receptionist and the CFO, not a selection of high-risk roles. Commensurate means one generic module for everyone is not enough either: a developer with production access needs more depth than a colleague in facilities. The same paragraph adds that, where appropriate, ICT third-party service providers should be included in the training, and Article 30(2)(i) requires contracts to set out the conditions for that.
Article 13 is titled “Learning and evolving”: incidents and test results must flow back into the framework. A programme that never changes after a real phishing incident does not fit that logic.
Article 5: the board carries the responsibility
Under Article 5(2) the management body defines, approves, oversees and is responsible for the whole ICT risk management framework. Point (a) gives it “the ultimate responsibility for managing the financial entity’s ICT risk”. Point (g) makes it allocate and periodically review the budget, explicitly including the awareness programmes and training of Article 13(6).
Article 5(4) then turns to the board members themselves: they “shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.” DNB put that line on its own slides for insurers in November 2024. The same logic runs through NIS2: our article on NIS2 and board liability explains how personal accountability works there, and executive training shows what a board programme can look like.
Can you show the supervisor who trained last month?
See how Guardey gives every employee a short weekly challenge and gives compliance a record of participation and progress per person.
Discover security awareness trainingWhat DNB and the AFM expect
In the Netherlands, DNB and the AFM supervise DORA. DNB announced in December 2024 that DORA replaces its Good Practice Informatiebeveiliging 2023 for entities in scope, and that it works risk-based and proportionally: questionnaires, conversations and on-site examinations, backed by tools ranging from a letter to a fine. The Dutch government confirms that both supervisors can fine a financial firm that does not comply.
Awareness is not a side issue for them. In a presentation to insurers on 12 November 2024, DNB listed the outcomes of its 2024 examinations. One of them: more attention is needed for knowledge and awareness programmes. The AFM had published a factsheet earlier that year based on a 2023 self-assessment by 212 investment firms. On the theme “awareness and training”, 37 percent did not yet meet the expected level. Those figures predate DORA, but they show where the supervisor expected work: expect the training question to come with a request for numbers.
How DORA relates to NIS2
Many financial entities are also essential or important entities under NIS2. Article 1(2) of DORA settles the overlap: for those entities DORA counts as a sector-specific Union legal act within the meaning of Article 4 of the NIS2 Directive. In practice DORA takes precedence where both cover the same ground, which is why it is often called the lex specialis. The Dutch government puts it plainly: where the rules overlap, the DORA provisions prevail for financial institutions.
In the Netherlands NIS2 is implemented in the Cyberbeveiligingswet, in force since 15 August 2026. For a bank or insurer that means DORA is the main frame for ICT risk and training, while NIS2 still matters for group entities and suppliers outside the financial scope. Our NIS2 guide for 2026 covers who falls under it, and the difference between NIS1 and NIS2 explains how the scope grew.
A practical roll-out plan
- Map roles to risk. List functions with payment authority, production access, customer data or supplier contact. They get extra depth; everyone gets the baseline.
- Get the board decision on paper. Budget, scope and the board’s own training programme approved in the minutes, as Article 5(2)(g) and 5(4) require.
- Make the baseline compulsory and continuous. A short, recurring rhythm through the year works better than one annual module and gives you data every month.
- Add phishing simulations and a reporting channel. Measure who clicks and who reports, and make sure everyone knows where to report.
- Bring in suppliers. Add the training clause of Article 30(2)(i) to new and renewed ICT contracts.
- Close the loop. After every major incident or test, adjust the content, log the change and include it in the yearly report to the management body.
How phishing simulations and continuous training produce the evidence
DORA does not mention phishing simulations by name. Article 25 lists the tests a resilience testing programme can include, from vulnerability scans to scenario-based tests, and leaves the choice to the entity. Simulations are still the most direct way to show that training changes behaviour, and they fit Article 13(4), which requires entities to monitor how effective their resilience strategy is. A completion certificate shows someone sat through a module. A falling click rate and a rising report rate show it worked.
That is also where continuous training pays off. With Guardey, every employee plays a gamified challenge of about three minutes each week, teams compete on a leaderboard, and phishing simulations are included. The result is a record per person, per week, which you can hand to the auditor in reports that are accepted for NIS2, ISO 27001 and more than 40 other frameworks. Already working with ISO 27001? Our guide to ISO 27001 security awareness training maps neatly onto DORA.
Frequently asked questions
Is security awareness training mandatory under DORA?
Yes. Article 13(6) requires ICT security awareness programmes and digital operational resilience training as compulsory modules in staff training, for all employees and senior management. Entities under the simplified regime of Article 16 must also provide them, according to their needs and risk profile.
Does the board have to be trained under DORA?
Yes. Article 5(4) requires members of the management body to keep their knowledge and skills up to date, including by following specific training on a regular basis, in proportion to the ICT risk being managed.
Since when does DORA apply?
Since 17 January 2025. DORA is a regulation, so it applies directly in every member state without national transposition.
Does DORA replace NIS2 for financial entities?
Where both cover the same ground, DORA takes precedence. Article 1(2) makes DORA the sector-specific act for financial entities that are also essential or important entities under NIS2.
Who supervises DORA in the Netherlands?
DNB and the AFM, each for its own entities. The European Supervisory Authorities oversee critical ICT third-party providers.
What would your DORA evidence look like after three months?
We walk you through the platform and the reports with your compliance questions in mind: participation per role, board training and phishing results over time.
Schedule a personal demo
