As financial services become increasingly dependent on technology, managing cybersecurity threats, ICT disruptions and third-party risks is more important than ever.
The Digital Operational Resilience Act (DORA), applicable since 17 January 2025, establishes a harmonised EU framework covering ICT risk management, incident reporting, resilience testing and ICT third-party risk management.
For Cyprus Investment Firms (CIFs), Crypto-Asset Service Providers (CASPs), Alternative Investment Fund Managers (AIFMs) and other financial entities within its scope, understanding DORA is key to ensuring regulatory compliance and strengthening operational resilience against ICT-related disruptions.
With this blog post,
Evdokia Pitsillidou, Global Chief Risk & Compliance Officer at
SALVUS Funds and instructor at the Institute for Professional Excellence (IforPE), introduces the key themes covered in the course “
Understand Digital Operational Resilience Act (DORA) and Information and Communications Technology (ICT) Requirements in 2026.”
The self-study course provides professionals with an understanding of DORA's regulatory framework, its five key pillars and the governance, documentation and control measures required to support effective digital operational resilience.
Understanding DORA and Its Regulatory Requirements
DORA establishes a comprehensive regulatory framework designed to strengthen the financial sector's ability to manage ICT-related risks and maintain operational continuity during technological disruptions.
The Regulation recognises that ICT incidents, cybersecurity threats and failures involving third-party service providers can significantly affect the operations of financial entities, potentially disrupting critical services and compromising the security of information and systems.
To address these risks, DORA introduces common requirements for the identification, assessment, management and monitoring of ICT risks, while reinforcing the responsibilities of financial entities and their management bodies.
For regulated entities, compliance with DORA requires more than implementing technical safeguards. It involves establishing appropriate governance arrangements, maintaining documented policies and procedures, and ensuring that ICT risk management is integrated into the firm's wider operational and risk management framework.
Understanding these requirements enables professionals to recognise their responsibilities and contribute to the development of a more resilient and compliant financial services environment.
The Five Pillars of Digital Operational ResilienceDORA establishes five core pillars of digital operational resilience, designed to help financial entities manage ICT risks, respond to incidents and withstand operational disruptions.
The first pillar,
ICT Risk Management, focuses on identifying, assessing and mitigating ICT-related risks. Financial entities must establish appropriate governance frameworks, policies and internal controls to safeguard their ICT systems and ensure business continuity.
The second pillar,
Incident Management & Reporting, addresses the detection, management, classification and reporting of ICT-related incidents. Financial entities must establish appropriate response mechanisms and report major ICT-related incidents to competent authorities, while reporting significant cyber threats remains voluntary.
The third pillar,
Digital Operational Resilience Testing, focuses on evaluating the effectiveness of ICT systems and controls through risk-based testing, considering applicable proportionality requirements. Testing helps identify vulnerabilities and strengthen preparedness against potential disruptions.
The fourth pillar,
ICT Third-Party Risk Management, addresses risks arising from external ICT service providers. Financial entities must oversee third-party arrangements, assess dependencies, maintain a register of information and comply with applicable contractual and risk management requirements.
Finally, the fifth pillar,
Information & Intelligence Sharing, allows financial entities to voluntarily exchange cyber threat information and intelligence through appropriate arrangements, strengthening collective awareness and resilience. Participating entities must comply with applicable notification requirements.
Together, these five pillars provide a structured framework for managing ICT risks and strengthening digital operational resilience across financial entities within DORA's scope.
What is the “Understand Digital Operational Resilience Act (DORA) and Information and Communications Technology (ICT) Requirements in 2026” course and what does it include? Delivered by
Evdokia Pitsillidou, Global Chief Risk & Compliance Officer at
SALVUS Funds, the course has been developed to equip financial services professionals with an understanding of the regulatory requirements governing digital operational resilience.
The course focuses on the key provisions of DORA, providing professionals with an understanding of ICT risk management, incident management and reporting, digital operational resilience testing, ICT third-party risk management and information-sharing arrangements.
Particular attention is given to the governance, documentation and internal control measures required for regulated entities to strengthen their ICT risk management frameworks and maintain compliance with applicable regulatory obligations.
The syllabus of the course includes:
- Understanding ICT and Digital Resilience
- Why do we need Security?
- ICT Fundamentals
- Common ICT risks
- The Importance of Digital Resilience - Introduction to the Digital Operational Resilience Act (Dora)
- Digital Operational Resilience Act
- Regulatory and Supervisory Authorities
- Definitions and Terminology
- RTS and ITS
- Delegated Acts
- Relationship with NIS2, GDPR, MiFID ll
- ESAs report major ICT-related incidents - The Five Core Pillars of DORA
- ICT Risk Management
- Incident Management & Reporting
- Digital Operational Resilience Testing
- ICT Third-Party Risk Management
- Information & Intelligence Sharing
- Key Takeaway - ICT Controls and Protection
- Identity and Access Management
- Network and Infrastructure Security
- Asset and Configuration Control
- Data Security and Protection
- Monitoring and Detection
- Emerging ICT and Cybersecurity Risk in 2026 - Circular C751 - Digital Operational Resilience Act – Reporting, Governance and Portal related obligations
- Circular C784 - Digital Operational Resilience Act - updated reporting templates for Major ICT-Related Incident and Significant Cyber Threats
- Circular C786 - Frontier Artificial Intelligence Models and Cybersecurity Risks under the Digital Operational Resilience Act (DORA)
- Circular C799 - Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU 2022/2554) - DORA Compliance in Practice
- Internal Audit
- Gap Assessment
- DORA Compliance Checklist
- Best Practices
The course is delivered through online video recordings and downloadable PDF study material, allowing professionals to learn whenever and wherever it suits them best. Participants can progress at their own pace, revisit topics as needed and reinforce their knowledge through accessible and structured learning resources.
Upon successful completion, participants receive a certificate awarding 5 CPD hours, recognised by CySEC, the Central Bank of Cyprus, and other professional supervisory bodies. The course contributes towards the annual CPD requirements of CySEC Advanced and Basic Certification holders, as well as professionals registered with ICPAC and the Cyprus Bar Association.
