PECB DORA Foundation

The exam is multiple choice and is taken on Day 2 of the two-day course. PECB states that the exam fully meets its Examination and Certification Program requirements and covers two competency domains: fundamental concepts of ICT risk management and digital operational resilience, and DORA requirements for an ICT risk management framework. For exam type, available languages, and other details, PECB directs candidates to its List of PECB Exams and Exam Rules and Policies.

The course is an introduction, so difficulty is moderate, but the exam is domain-based and expects you to explain requirements, not just recognize terms. Study in the order the course is delivered: Day 1 concepts and requirements first, then Day 2 requirements for an ICT risk management framework. Use the quizzes in the training materials, which PECB says closely mirror the exam structure, and revisit the two domains before exam day.

Yes, under conditions. Candidates who completed the training course with one of PECB's partners and failed the first exam attempt are eligible to retake the exam for free within a 12-month period from the date the coupon code is received, because the course fee includes a first attempt and one retake. Otherwise, retake fees apply. Contact PECB support for your specific situation.

No. PECB states there are no prerequisites to participate in the training course. For the certificate, the requirements are to pass the PECB DORA Foundation exam, with no professional experience and no ICTMS project experience required, and to sign the PECB Code of Ethics. This makes the credential accessible to newcomers as well as experienced risk and compliance professionals.

The course is two days. Day 1 introduces the concepts and requirements of DORA. Day 2 covers DORA requirements and includes the certificate exam. The course addresses ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and information sharing practices, and includes lecture sessions with discussion questions and examples. Participants receive more than 150 pages of training materials.

After passing the exam, you can apply for the “PECB Certificate Holder in DORA Foundation” credential. PECB states that this certificate demonstrates your understanding of DORA and its application in the financial services sector. The certificate requirements include passing the exam and signing the PECB Code of Ethics, with no professional experience or ICTMS project experience required.

Yes. Participants who attend the training course receive an attestation of course completion worth 14 CPD (Continuing Professional Development) credits. This is separate from the exam credential and recognizes your participation in the two-day course. Keep the attestation for your CPD records, as it documents 14 credits earned through PECB training.

Candidates often memorize definitions without connecting them to the two domains. Because Domain 1 covers fundamental concepts of ICT risk management and digital operational resilience and Domain 2 covers DORA requirements for an ICT risk management framework, you should be able to explain how requirements fit into a framework, not just list them. Skipping the course quizzes, which mirror the exam structure, is another avoidable mistake.

PECB lists managers and consultants seeking to understand DORA requirements for ICT risk management; professionals involved in digital operational resilience or cybersecurity in the financial sector; risk and compliance officers seeking foundational DORA knowledge; individuals responsible for managing third-party ICT risks within financial institutions; and anyone interested in supporting their organization's DORA compliance. The course is introductory, so no prior DORA-specific experience is assumed.