PECB DORA Foundation study guide
PECB DORA Foundation · Work through your exam, one topic at a time.
The PECB DORA Foundation credential is an entry-level certificate for professionals who need a working understanding of the EU Digital Operational Resilience Act (DORA) and its application in the financial services sector. According to PECB, the training course provides a comprehensive introduction to DORA and its core principles, covering ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and information sharing practices. It is intended for managers and consultants who need to understand DORA requirements for ICT risk management, professionals involved in digital operational resilience or cybersecurity in the financial sector, risk and compliance officers, individuals responsible for managing third-party ICT risks within financial institutions, and anyone supporting their organization's DORA compliance. The exam covers two competency domains: fundamental concepts of ICT risk management and digital operational resilience, and DORA requirements for an ICT risk management framework. Topics on this exam: Fundamental concepts of ICT risk management and digital operational resilience and DORA requirements for an ICT risk management framework. The PECB DORA Foundation study guide has 2 sections and about 755 words.
01Fundamental concepts of ICT risk management and digital operational resilience
This domain tests whether you can use DORA's vocabulary precisely and connect concepts: ICT risk, digital operational resilience, critical or important functions, ICT-related incidents and major incidents. Expect definitional questions and short scenarios, not article-number recall. ICT risk is the risk of loss or disruption from the failure, misuse, or compromise of ICT systems, including availability, integrity, confidentiality and authenticity failures. Digital operational resilience is the ability to build, maintain and improve IT security and withstand all types of ICT disruption, not only cyberattacks.
384 words, about 2 min02DORA requirements for an ICT risk management framework
This domain tests the governance and process requirements for an ICT risk management framework under DORA: management-body accountability, documented policies, asset and dependency identification, protection, detection, response and recovery, backup, learning, and communication. Expect questions on who approves what and which framework element is missing in a scenario. The management body defines the ICT risk appetite, approves the ICT strategy and framework, and remains accountable; it cannot outsource accountability to IT or a provider. The framework must be documented and proportionate, covering strategies, policies, procedures, protocols and tools to protect all information and ICT assets.
371 words, about 2 min