DORA Lead Manager

PECB lists five competency domains: fundamental concepts of ICT risk management and digital operational resilience; preparation for and planning of DORA project implementation; ICT risk and ICT-related incident management; digital operational resilience testing and ICT third-party risk management; and review and continual improvement. Expect questions that ask you to interpret DORA requirements and apply the five main pillars rather than recite definitions.

PECB describes the exam as covering the five domains and states that the course uses essay-type exercises and multiple-choice quizzes, some scenario-based, with quiz structure closely mirroring the certification exam. For the exam type, available languages, and other specifics, PECB directs candidates to its List of PECB Exams and Exam Rules and Policies.

Five days. Day 1 covers DORA concepts and requirements, Day 2 ICT-related risk and incident management, Day 3 ICT third-party risk management and information sharing, Day 4 review and continual improvement, and Day 5 is the certification exam. PECB delivers the course in classroom, online live virtual, and other formats, in several languages.

No. PECB states the main requirement is a fundamental understanding of information security and cybersecurity concepts plus familiarity with ICT risk management principles. Separate certification requirements apply after the exam: the Certified DORA Lead Manager credential needs five years of professional experience, including two years in ICT risk management, and 300 hours of ICT project experience.

A free retake is available within 12 months of the course completion date. For self-study or eLearning formats, the 12 months run from the purchase date. PECB also states the training fee includes the first exam attempt, one free retake, the certification application fee, and the first year of the Annual Maintenance Fee, all to be completed within that same 12-month cycle.

PECB states candidates receive more than 450 pages of training materials including practical examples, exercises, and quizzes, and that completing the course earns an attestation worth 31 CPD credits. Treat the exercises as rehearsal for the scenario-based items rather than optional reading, and keep your own notes on the five domains.

Follow the course sequence: DORA purpose and requirements first, then ICT risk and incident management, then third-party risk and information sharing, then testing, review, and continual improvement. The later domains assume you can already speak precisely about risk frameworks and incident classification, so skipping ahead usually costs more time than it saves.

Two things. First, answering from general cybersecurity instinct instead of DORA's specific framing of ICT risk, incident management, and third-party arrangements. Second, treating the pillars as a checklist to memorise rather than a sequence to implement, which shows in scenario questions. Practise explaining how you would plan, implement, monitor, and correct within a financial entity.

No. This page is independent study material and is not affiliated with, endorsed by, or sponsored by PECB. Certification requires passing the official exam and then applying for a credential and meeting its experience, project-hour, and Code of Ethics requirements. Verify all details against PECB's own published exam and certification rules before you enrol.