Management body briefing
DORA training for the management body, tailored to your institution
We train your institution’s management board or senior management on DORA: in-house, remotely or on site, in about four hours and with examples from your own organisation. The briefing fits the full framework, where Article 5(4) requires regular training of the management body, and the simplified framework under Article 16, where training of management follows from Article 16(1)(h). Each participant receives a confirmation of attendance.
What does DORA require of the management body on training?
Under the full framework (Articles 5 to 15 DORA), Article 5(4) applies: members of the management body “actively keep up to date with sufficient knowledge and skills”, including by following specific training on a regular basis, commensurate to the ICT risk being managed. Article 13(6) adds that ICT security awareness programmes and digital operational resilience training are compulsory and apply to all employees and senior management staff. The management body itself allocates the budget for this and reviews it periodically (Article 5(2)(g)). DORA sets no frequency and no number of hours.
Under the simplified framework of Article 16, which from 1 January 2027 includes, among others, the institutions under Section 1a(2a) of the German Banking Act (KWG) (here: KWG group), Article 5(4) does not apply. BaFin makes clear, however, that the members of the management body must have appropriate ICT competence because of their overall responsibility for the framework (RTS 2024/1774 Article 28(2)(a)). In BaFin’s assessment, training obligations carry more weight there than in BAIT (BaFin’s supervisory requirements for IT in banks): financial entities develop ICT security awareness programmes and training for their staff and management (Article 16(1)(h) DORA in conjunction with RTS Article 28(2)(e), supervisory notice of 21 August 2025, section 3.3). Scope and frequency depend on need and the ICT risk profile.
Who belongs to the management body is defined in Article 3(30) DORA by reference to the relevant sectoral law. Which framework applies to your institution is covered on our page on DORA applicability, and has to be checked in each individual case.
What can your management body do after the briefing?
The aim is for the management body to be able to take and oversee the decisions that DORA assigns to it. Technical details stay with IT, information security and service providers.
What is our responsibility?
Placing responsibility
Which tasks DORA assigns to the management body, under the full framework in Article 5(2), under the simplified framework in RTS Article 28(2), and what can be delegated.
DORA Article 16Which framework applies?
Understanding the classification
Why your institution is under the full framework or the Article 16 framework, and what follows for documents and roles.
DORA applicabilityWhat do we decide?
Strategy, tolerance and policies
Under the full framework the DOR strategy and the risk tolerance level, under the Article 16 framework the information security objectives and the policies required by the RTS.
ICT risk managementWhat is allowed to fail?
Functions and business continuity
Critical or important functions, business impact analysis and business continuity plans. Under the Article 16 framework the management body expressly approves them (RTS Article 28(2)(d)). Under the full framework it approves, oversees and reviews the ICT business continuity policy and the ICT response and recovery plans (Article 5(2)(e)), and DORA does not mention the BIA there.
Critical or important functionsWho decides in an emergency?
Incidents and reporting
Classification of major ICT-related incidents, reporting deadlines and who in the institution decides on a report.
DORA incident reportingHow do we see progress?
Reading reports and asking questions
Assess reports on information security, tests, service providers and incidents, and ask the right questions of IT, the control function and service providers.
What do you receive?
The initial briefing includes preparation, materials and evidence.
01
Pre-read
A few pages on classification, functions, service providers, reporting process and open points, prepared from the preparatory call and sent a few working days before the date.
02
Slide deck as PDF
The slides presented, with version, date and references, for filing in your training records.
03
Confirmation of attendance for each participant
With name and role, date, time and duration, provider and the content covered with the references of your framework.
04
Signed attendance list
All participating members of the management body and other participants, for presentation on request.
05
Draft resolution for the management body
The decisions due after the briefing, for example on responsibilities, list of functions and business impact analysis, reporting to the management body and the training plan.
06
Review questions and frequency recommendation
Questions the management body can put to IT, the control function and service providers, and a written recommendation on the interval between refreshers.
Agenda of the initial briefing
Six modules in about four hours. The framework columns show which references each module relies on under your framework, the right-hand column how we relate it to your institution.
| Module | Duration | Full framework | Article 16 framework | Link to your institution |
|---|---|---|---|---|
| 1 Scope and framework | 30 min | Article 2, Articles 5 to 15 DORA | Article 16 DORA, RTS Title III | Your classification and your business lines from the preparatory call |
| 2 Responsibility of the management body | 40 min | Article 5(2) and (4) | RTS Article 28(2) to (6) | Your current allocation of tasks between management, IT, control function and internal audit |
| 3 ICT risks as business risks | 40 min | Articles 6, 8 | RTS Articles 30, 31 | Attack sequences that fit your business model, shown with reconstructed examples |
| 4 Functions, business continuity and testing | 50 min | Articles 11, 12, 24, 25 | RTS Articles 39, 40 | Your critical or important functions and the status of your recovery tests |
| 5 Service providers and incidents | 45 min | Articles 17 to 19, 28 to 30 | Articles 17 to 19, 28 to 30 with the exemptions of the Article 16 framework | Your most important ICT service providers and your reporting process |
| 6 Reporting, evidence and resolutions | 35 min | Article 5(2), Article 13 | RTS Article 28(2)(i), Article 41 | Draft resolution for your management body and recommendation on frequency |
Agenda and timings are a proposal by Blackfort Technology, not a requirement of DORA or BaFin. We adjust weighting and order to your institution in the preparatory call.
How does the training work?
From request to management body resolution in six steps.
1
Request and scoping call
You tell us the body, the number of participants, remote or on site and the preferred period. In a short call we clarify framework and scope.
2
Proposal
You receive a proposal with a fixed price.
3
Preparatory call
60 minutes with one contact person as part of the commissioned service: classification, functions, service providers, implementation status.
4
Pre-read
Sent a few working days before the date.
5
Briefing
About four hours, remotely or on site at your premises.
6
Evidence and follow-up
Confirmations of attendance, attendance list, slide deck and draft resolution.
We do not offer open-enrolment dates. In addition, there is a yearly refresher of 90 to 120 minutes remotely and a crisis simulation exercise of two to three hours, separate from the initial briefing.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
How do you evidence the training?
Neither DORA nor the RTS prescribes a particular form of evidence. We therefore issue a confirmation of attendance for each participant with content and references, and hand over the signed attendance list. Participants are not examined.
A confirmation of attendance proves attendance, not knowledge. That the management body performs its tasks shows in its resolutions, for example on approving the business impact analysis and business continuity plans (RTS Article 28(2)(d) under the Article 16 framework), on the list of functions or on the DOR strategy under the full framework. That is why the draft resolution is part of the deliverables.
Who should take part?
All members of the management board or senior management. Whether and to what extent members of a supervisory or administrative body belong to the management body within the meaning of Article 3(30) DORA depends on the sectoral law the provision refers to. They can take part in any case. We recommend including the person responsible for information security in the institution and, under the full framework, the ICT risk control function.
What the training is not
So that expectations match:
- No certificate and no examination. You receive a confirmation of attendance.
- No legal advice. On classification, obligations and liability we provide general information, and you clarify the individual case with your legal counsel.
- No staff training. Awareness and training of all staff under Article 13(6) DORA or Article 16(1)(h) are a separate measure in your training programme.
- No NIS2 training. If the BSIG (German BSI Act, which implements NIS2) also applies to your company, you will find information at https://nis2-readiness.de (in German).
- No recognition by BaFin. DORA does not provide for recognition of training providers.
The information reflects DORA, RTS 2024/1774 and the supervisory notice of 21 August 2025 as of 6 November 2026. Whether and under which framework DORA applies to your institution has to be checked in each individual case.
Frequently asked questions
How often must the management body be trained?+
DORA sets no frequency. Under the full framework, Article 5(4) refers to specific training on a regular basis, and under the Article 16 framework training depends on need and the ICT risk profile. After the initial briefing we recommend a yearly refresher, plus a briefing on occasions such as a change in the management body or a new legal situation, for example the move of the KWG group into the Article 16 framework.
We are a factoring firm. Does Article 5(4) apply to us?+
From 1 January 2027 the simplified framework under Article 16 applies to institutions of the KWG group, and Article 5(4) does not apply there. Article 16(1)(h) does require training for management, however, and BaFin expects appropriate ICT competence of the management body. For your briefing we use the references of the Article 16 framework. Questions on the move are answered on our page on DORA for factoring and leasing. We support the whole transition from BAIT in our transition service.
What does the DORA training cost?+
We state the price in our proposal. It depends on the number of participants, whether the briefing is remote or on site and whether a simulation exercise or refresher is added. After the scoping call you receive a fixed price.
Where does the simulation exercise take place?+
Ideally on site at your premises, because the emergency exercise works better in the room. The initial briefing and the refresher are also possible remotely.
Read more
- DORA Article 16: the simplified ICT risk management framework
- DORA for factoring and leasing: obligations and evidence from 2027
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA scope: who does DORA apply to, and which framework?
- ICT risk management under DORA: framework and DOR strategy
- Classifying critical or important functions under DORA
- DORA certification and DORA audits: who audits what?
- DORA gap analysis: quick check, Article 16 and full framework
Sources
- Regulation (EU) 2022/2554 (DORA), Article 3(30), Article 5(2)(g) and (4), Article 13(6), Article 16(1)(h), English version (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management), Article 28(2), English version (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on implementing DORA with the simplified ICT risk management framework (Article 16 DORA), section 3.3 (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Request training
Tell us which body is to take part, which framework you apply, whether remote or on site and in which period. We flag borderline cases for your legal counsel. After a short scoping call you receive a proposal.