DORA Lead Manager case studies

DORA Lead Manager · Put your knowledge to work in context.

The PECB Certified DORA Lead Manager is a professional certification for people who lead and oversee the implementation of digital operational resilience strategies inside financial entities working toward compliance with the EU Digital Operational Resilience Act (DORA). PECB positions the course for financial institution executives and decision-makers, compliance officers and risk managers, IT professionals, legal and regulatory affairs personnel, and consultants specialising in financial regulation and cybersecurity. The DORA Lead Manager case studies are 5 cases and about 5,013 words.

Sequencing a nine-month DORA programme at a mid-sized bank

Northbank is a mid-sized EU credit institution with 4,200 staff, a leasing subsidiary in Switzerland and a payments joint venture in Ireland. In January its programme office completed a DORA gap assessment: 41% of the 260 ICT contracts lack documented exit strategies, the ICT risk register has not been reconciled with the operational risk register since 2022, and the register of information for third-party arrangements is a spreadsheet maintained by procurement.

1,045 words, about 5 min 2

A duplicated settlement batch at a 40-person payment institution

PayNow Europe is a licensed payment institution processing 1.4 million card and account-to-account transactions daily for 900 merchants. On a Friday at 19:42 a database failover in its primary data centre triggered duplicate settlement files.

957 words, about 5 min 3

A vendor blocks threat-led penetration testing of a shared SaaS platform

Helios Life is a life insurer with 900 staff, EUR 14 billion of assets under management and 620,000 policyholders. Its policy administration, claims and premium collection run on a single SaaS platform provided by a US-headquartered vendor that hosts more than 30 European insurers in one regional cloud tenancy, with data replicated across two availability zones in a single Member State.

1,012 words, about 5 min 4

Four inventories, no business impact analysis, and an accountability conflict

Corvus Bank is a cooperative bank with EUR 9 billion in assets and 1,700 ICT assets recorded across four inventories: a CMDB maintained by infrastructure, a vendor list held by procurement, a spreadsheet of internally developed applications, and an application register owned by the business. A reconciliation found 214 assets appearing in only one source and 38 applications with no named owner.

1,043 words, about 5 min 5

A 40-indicator scorecard after a supervisory inspection

After a supervisory inspection in March, Vantage Clearing received four findings: its digital operational resilience testing plan had not been updated after a change of core platform; two of nine improvement actions from a 2023 incident had passed their due dates without escalation; the ICT risk appetite statement had not been reviewed since 2022; and the board's ICT dashboard reported only availability percentages. The COO responded by asking for a monthly resilience scorecard with 40 indicators, including counts of open vulnerabilities and helpdesk tickets.

956 words, about 5 min