IBITGQ C-DORA study plan

Map every article and chapter of DORA Regulation (EU) 2022/2554 that sits in the ICT risk management pillar onto a one-page outline you write yourself

Define the internal governance and accountability structure DORA requires, naming the management body's responsibilities and the three-lines-of-defence implications

Draft your own glossary of at least 25 DORA terms (ICT risk, ICT asset, major ICT-related incident, critical or important function, ICT third-party service provider) in your own words

Explain in writing how the ICT risk management framework must be documented, reviewed and approved, and how often

Break the ICT risk management process into its stages (identification, protection and prevention, detection, response and recovery, learning and evolving) and write concrete control examples for each stage

Compare DORA's ICT risk management requirements with the ISO/IEC 27001 risk assessment and treatment cycle, listing at least six overlaps and four gaps

Design a simplified ICT asset inventory and classification scheme suitable for a mid-sized financial entity

Describe how business impact analysis and mapping of critical or important functions feed into ICT risk tolerance and recovery objectives

Summarise the scope of DORA, including which financial entities are covered and which are excluded, and list the proportionality criteria applied to smaller entities

Explain the relationship between DORA and overlapping regimes (NIS2, GDPR, the EBA ICT and security risk management guidelines) without conflating their obligations

Outline the role and mandate of the supervisory authorities and the European Supervisory Authorities in the DORA framework

Draft a gap analysis of five DORA obligations against a hypothetical entity's current practices

Consolidate domains 1 and 2 into a single mental model by writing a ten-question self-test on governance, risk management stages and proportionality, then answering it closed-book

Explain how the ICT risk management framework connects to the incident reporting and resilience testing pillars

Identify the documentation an entity must retain to evidence compliance with the risk management pillar

Define the classification criteria for an ICT-related incident and for a major ICT-related incident, and apply them to three written scenario descriptions

List the content, format and timing requirements of the initial notification, intermediate report and final report

Describe the incident management process end to end, including detection, triage, escalation, communication to clients and the role of the management body

Explain how incidents affecting ICT third-party providers are captured and reported

Outline the digital operational resilience testing programme, distinguishing the baseline testing every entity must perform from advanced threat-led penetration testing

State who must perform threat-led penetration testing, how often, and what tester independence and scope conditions apply

Design a one-year testing calendar for a hypothetical entity, sequencing vulnerability assessments, scenario-based tests and penetration tests

Describe how testing findings are logged, remediated and escalated, and how remediation is evidenced

Explain the ICT third-party risk management lifecycle from due diligence and contracting through ongoing monitoring and exit

List the contractual clauses DORA requires in ICT service agreements and map each to the risk it mitigates

Describe the register of information requirements for ICT third-party arrangements and the reporting obligations to competent authorities

Explain the oversight framework for critical ICT third-party service providers, including designation and the lead overseer's powers

Explain the exit strategy requirement and what a credible exit plan must contain

Run a full timed mock examination across all four domains and record your score by domain

Re-study only the two weakest sub-topics identified by the mock, using your own notes rather than new material

Recite from memory the key numbers in DORA: reporting timelines, testing frequencies, review cycles and oversight thresholds

Write a one-page cross-domain summary showing how the four pillars interlock