DORA Lead Manager study guide
DORA Lead Manager · Work through your exam, one topic at a time.
The PECB Certified DORA Lead Manager is a professional certification for people who lead and oversee the implementation of digital operational resilience strategies inside financial entities working toward compliance with the EU Digital Operational Resilience Act (DORA). PECB positions the course for financial institution executives and decision-makers, compliance officers and risk managers, IT professionals, legal and regulatory affairs personnel, and consultants specialising in financial regulation and cybersecurity. The DORA Lead Manager study guide has 5 sections and about 1,565 words.
01Fundamental concepts of ICT risk management and digital operational resilience
This domain tests whether you can explain DORA's purpose, scope and core definitions, and distinguish digital operational resilience from narrower cybersecurity compliance. DORA is Regulation (EU) 2022/2554, applying from 17 January 2025.
330 words, about 2 min02Preparation for and planning of DORA project implementation
This domain tests how you scope and sequence a DORA implementation programme, assign accountability and convert legal obligations into an executable plan. Start with a structured gap analysis against each DORA chapter, mapping current policies, controls, contracts, incident processes and testing arrangements to the regulation.
303 words, about 2 min03ICT risk and ICT-related incident management
This domain tests the ICT risk management framework, incident handling and the DORA reporting clock, including how to classify and escalate major incidents. The ICT risk management framework must identify, protect, detect, respond and recover, and include business continuity, backup, redundancy and crisis communication arrangements.
314 words, about 2 min04Digital operational resilience testing and ICT third-party risk management
This domain tests the design of a risk-based testing programme, threat-led penetration testing, and the DORA requirements for managing ICT third-party dependencies. Financial entities must run a proportionate digital operational resilience testing programme, with critical ICT systems tested at least annually.
316 words, about 2 min05Review and continual improvement
This domain tests how DORA obligations are monitored, reviewed and improved over time, including how evidence from incidents, testing and third-party monitoring feeds back into the framework. The ICT risk management framework is reviewed at least annually and after significant events or material changes.
302 words, about 2 min