DORA Lead Manager study plan

Map each of the five DORA pillars (ICT risk management, incident reporting, resilience testing, ICT third-party risk, information sharing) to its articles and to the five exam domains so you can locate any topic quickly

Define the core vocabulary set (ICT risk, digital operational resilience, ICT-related incident, major incident, critical or important function, ICT third-party service provider) in your own words and note where the regulation narrows or widens common usage

Explain to a colleague why DORA is a regulation with direct application rather than a directive, and what that means for scope of entities covered

Trace the proportionality principle: how size, risk profile and complexity of an entity change the expected controls under the ICT risk management framework

Walk through the ICT risk management framework cycle (identify, protect and prevent, detect, respond and recover, learn and evolve, communicate) and assign at least three concrete controls to each stage

Distinguish ICT risk from other risk types and describe how the three lines of defence share ICT risk responsibilities, including management body accountability

Describe the required content of an ICT risk management policy and how risk tolerance and appetite statements link to business strategy

Draft a short gap analysis of a hypothetical mid-sized financial entity against the governance, strategy and policy expectations of the framework

Classify incidents using the criteria for major ICT-related incidents and justify borderline classifications with reasoning based on clients affected, duration, data losses, criticality of services and economic impact

Sequence the incident management process from detection and logging through classification, escalation, root cause analysis and post-incident review, naming the artefacts produced at each step

Outline the reporting workflow to competent authorities, including the initial notification, intermediate report and final report, and state what content each stage requires

Explain how incident management connects to business continuity and disaster recovery plans, including recovery time and recovery point objectives for critical or important functions

Design a small incident register schema that would satisfy supervisory expectations for recording, tracking and evidencing incidents

Design a risk-based digital operational resilience testing programme that separates the baseline annual testing duties from the advanced threat-led penetration testing obligations

List the types of tests in scope for the baseline programme (for example vulnerability assessments, open source analysis, network security assessments, scenario-based tests, performance and end-to-end tests) and state which systems each targets

Explain the conditions, scoping criteria and safeguards for threat-led penetration testing, including who may perform it, the role of the tester, and how findings are remediated and reported

Describe how test results feed back into the ICT risk management framework and into the ICT third-party risk register

Build the lifecycle for ICT third-party risk management from due diligence and onboarding through contract negotiation, ongoing monitoring, concentration risk assessment and exit planning

Identify the contractual clauses DORA expects for ICT service arrangements and distinguish mandatory written provisions from good practice

Analyse concentration risk across the ICT provider register and propose mitigants for over-reliance on a single provider or on a small number of substitutable providers

Explain the oversight framework for critical ICT third-party service providers, including how a provider is designated critical and what supervisory engagement means for the contracting entity

Draft an exit strategy outline for a critical or important function supported by an external provider, covering data portability, transition services and tested fallbacks

Construct a phased DORA implementation roadmap covering gap assessment, governance setup, policy and framework drafting, register building, testing design, contract remediation and reporting readiness

Define the project governance for the implementation: sponsor, steering committee, workstream leads, decision rights and escalation paths

Identify the key dependencies and sequencing constraints, such as registers needing inventory data before concentration analysis can begin

Produce a stakeholder and communication map covering the management body, business lines, internal audit, legal, procurement and external providers

Assess the top five implementation risks and assign a mitigation and owner to each

Design a set of key risk and performance indicators that would evidence whether the ICT risk framework and resilience posture are improving over time

Plan an internal audit or independent review of the DORA implementation, including scope, sampling approach and reporting line to the management body

Describe how lessons learned from incidents, tests and third-party reviews are captured and turned into changes in policies, controls and training

Explain how the management body reviews and approves the digital operational resilience strategy and how often the framework is reassessed

Set up a change-tracking mechanism so regulatory updates and supervisory guidance are assessed and incorporated into the framework

Consolidate all prior deliverables into a single reference pack organised by exam domain so you can revise from one source

Complete two timed mock exams and log every wrong answer against the domain and the underlying concept it tested

Re-explain the weakest five concepts from memory in writing, then verify each against the regulation text and correct your notes

Summarise the governance and management body obligations in one page, since they recur across all five domains