IBITGQ C-DORA study guide
IBITGQ C-DORA · Work through your exam, one topic at a time.
The IBITGQ Certified DORA (C-DORA) qualification is a personnel certification offered by the International Board for IT Governance Qualifications (IBITGQ), a personnel certification body that certifies individuals in the field of IT governance. IBITGQ states that it is dedicated to the provision of qualifications to experts working in information security, business resilience and IT governance, and that it offers accredited qualifications recognised on a global basis, guidelines for organisations wishing to offer training courses based on IBITGQ certifications, and guidance on continued professional development. IBITGQ also states that it has demonstrated compliance with ISO/IEC 17024:2012 and is ISO/IEC 17024:2012 accredited by IAS, noting that the scope of that accreditation covers its Certified ISO 27001 ISMS Lead Implementer and Certified ISO 27001 ISMS Lead Auditor certification schemes. The qualification sits in IBITGQ's cyber security and DORA-related exam portfolio and is aimed at professionals who need to understand the EU Digital Operational Resilience Act and how it applies to ICT risk, incident reporting, resilience testing and third-party risk. The IBITGQ C-DORA study guide has 4 sections and about 1,341 words.
01DORA compliance and ICT resilience
Domain 1 - DORA compliance and ICT resilience. This domain tests whether you can place DORA in the EU regulatory landscape, identify who and what is in scope, and apply its governance and proportionality rules rather than treating it as a generic cybersecurity checklist.
358 words, about 2 min02ICT risk management
Domain 2 - ICT risk management. This domain tests Chapter II: whether you can design and operate an ICT risk management framework that is governed, documented, tested and proportionate.
307 words, about 2 min03ICT incident reporting and resilience testing
Domain 3 - ICT incident reporting and resilience testing. This domain tests Chapters III and IV: classification, the reporting clock, and the testing programme including threat-led penetration testing (TLPT).
338 words, about 2 min04Third-party / ICT third-party risk and governance
Domain 4 - Third-party / ICT third-party risk and governance. This domain tests Chapter V: how financial entities select, contract with, monitor and exit ICT providers, and how the EU oversees providers designated as critical.
338 words, about 2 min