PECB DORA Foundation study plan

Define DORA's scope, addressees, and key definitions (ICT risk, digital operational resilience, ICT incident, important or critical function) in your own words

Distinguish DORA from adjacent EU instruments (NIS2, GDPR, EBA ICT guidelines) by listing what each covers and where they overlap

Map the five pillars of DORA (ICT risk management, incident management, resilience testing, third-party risk, information sharing) to their chapters and articles

Explain the proportionality principle and how entity size and risk profile change obligations

Describe the governance model: management body accountability, roles of the ICT risk management function and independent control functions

Explain the three lines of defence as applied to ICT risk under DORA and where the compliance function sits

Outline the ICT risk management framework components (strategies, policies, procedures, protocols, tools) and their interrelation

Identify documentation, review, and audit obligations attached to the framework

Explain the ICT risk management process: identification, protection and prevention, detection, response and recovery, learning and evolving

Describe how ICT asset inventories and business process mapping support identification of important or critical functions

Apply business impact analysis logic to determine criticality and recovery objectives (RTO/RPO)

Compare detection mechanisms and their dependency on logging, monitoring, and alerting

Explain business continuity policy, disaster recovery plans, and crisis communication under DORA

Describe backup policies, restoration and recovery methods, and redundancy requirements for critical functions

Summarize the incident management pillar: classification criteria, reporting timelines, and reporting content

Contrast the incident management and testing pillars in terms of purpose, frequency, and outputs

Break the ICT risk management framework article-by-article into its required policies, procedures, and protocols

Draft the information security policy elements DORA expects, including access control, encryption, and change management

Specify requirements for ICT project and acquisition risk, including security testing before deployment

Explain the requirement for a documented ICT risk tolerance level and how it is approved and reviewed

Describe the digital operational resilience testing programme: scope, independent parties, and risk-based prioritization

Differentiate vulnerability assessments, penetration tests, scenario-based tests, and threat-led penetration testing (TLPT)

State the conditions, frequency, and supervisory expectations for TLPT for significant entities

Explain remediation of testing findings and how results feed back into the risk framework

Explain the ICT third-party risk management lifecycle from due diligence through exit strategies

Describe contractual requirements for ICT service agreements and the register of information obligations

Outline the oversight framework for critical ICT third-party service providers, including designation and lead overseer powers

Summarize the information-sharing arrangements on cyber threat intelligence and their voluntary nature and limits

Consolidate all eight weeks into a single condensed review sheet of definitions, timelines, and article references

Complete two full timed practice exams and analyze error patterns by domain

Re-explain the weakest five concepts aloud without notes to confirm recall

Verify recall of numeric obligations (reporting deadlines, testing intervals, register requirements) with a self-quiz