CYBERSECURITY MONTH 2026
DORA: the human side of operational resilience.
DORA expects your staff, your executives and your ICT providers to be aware, trained for a crisis, and expects you to prove it. BlueSecure provides all three, and the evidence.
- Applicable since 17 January 2025
- Paths in 12 languages
- Dated, exportable evidence
DORA
- Raise awareness
- Train for a crisis
- Include providers
- Prove it
A European regulation, directly applicable
DORA needs no transposition: the regulation has applied as is to financial entities since 17 January 2025, under the supervision of national authorities such as the ACPR and the AMF in France.
27 December 2022
Published in the Official Journal of the European Union
17 January 2025
Directly applicable, no transposition
Today
Document-based reviews by supervisors
- Article 13. DORA, applicable since 17 January 2025, requires ICT security awareness programmes and digital operational resilience training, compulsory for all staff and senior management.
- Article 5. The management body is responsible for the ICT risk management framework, and its members follow specific training on a regular basis.
- Articles 13 and 30. ICT third-party service providers are included in these programmes where relevant.
The financial entities in scope
- Credit institutions
- Payment and e-money institutions
- Investment firms
- Asset management companies
- Insurers and reinsurers
- Mutual insurers
- Occupational retirement institutions
- Crypto-asset service providers
- Market infrastructures
The regulation applies proportionately, according to the size and risk profile of each entity.
For financial entities covered by DORA, DORA applies to ICT risk management instead of NIS 2. A programme designed for DORA is therefore the right starting point for a bank, an insurer or an asset manager.
Four human requirements, one platform.
BlueSecure contributes to implementing and documenting the awareness, training and crisis exercise requirements set by DORA.
Raise everyone’s awareness
A DORA path for every employee, with content adapted to each role: staff authorised to make payments, IT teams and developers, everyone else.
Train for a crisis
An online crisis management game for everyone, and an in-person crisis workshop for the executive committee: qualification, notification, key messages, communications.
Include your providers
Providers who access your information system come into the programme’s scope, with content on supply chain attacks.
Prove it
Dated history, certificates, scores by person, team and entity, automatic reports and exports: your documentation is ready for review.
A programme assembled from proven building blocks.
DORA path for employees
A DORA module in 12 languages with a quiz, then the right reflexes against fraud and social engineering: CEO fraud, IBAN fraud, incident handling, access management, responsible use of AI.
Executive path
An online path on digital resilience, a 30 to 60 minute talk for the executive committee and a 2 to 4 hour crisis workshop.
Crisis training
BlackOut, the Game Studio’s crisis management game, for every employee: each player takes on in turn the crisis lead, the DPO, leadership, support and communications.
Simulations and providers
Simulations inspired by fraud in the financial sector: fake CEO, fake IBAN, vishing, deepfake. Reporting of suspicious messages and retargeting based on the risk score.
Evidence and steering
The BlueSecure Risk Index tracks the level of risk by person, team and entity. Smart Report reports go out automatically to your governance bodies.
What DORA asks, what we provide
Each requirement on the human side is met by a building block of the platform.
- Raise all staff’s awarenessDORA path in 12 languages, quiz and certificateLearning Academy
- Adapt to each roleContent for payment roles, IT teams and developers, everyone elseLearning Academy, CyberGames
- Train senior managementExecutive path, talk and crisis workshopLearning Academy, Workshop
- Train for crisis and communicationsBlackOut online for all, in-person crisis workshop for the committeeCyberGames, Workshop
- Detect and report quicklyFraud simulations, reporting of suspicious messages, retargetingPhishing 360
- Include providersProviders in scope, content on the supply chainLearning Academy
- Prove it to the supervisorDated history, certificates, scores, reports and exportsRisk Index, Smart Report
- Steer several regulated entitiesSegregated data, delegated administration, consolidated reportingMulti-tenant
From a first baseline to a documented review.
Baseline
A first simulation campaign measures the starting point.
DORA path for all
Every employee follows their path, providers included.
Executive highlight
Talk and crisis workshop with the executive committee.
Targeted campaigns
Scenarios follow each team’s risk score.
Documented review
A dated file, ready to present during a review.
Documentation ready for review.
Supervisors review the evidence. Every action leaves a dated trace you can consult and export.
- Dated history
- Certificates
- Score by person, team and entity
- Automatic PDF reports
- Excel and API exports
A provider that fits into your own third-party risk management.
The platform is hosted in France, by an ISO 27001 certified French hosting provider. Your data falls under no jurisdiction outside Europe and is not subject to extraterritorial laws such as the US CLOUD Act.
What the programme does not cover
DORA goes well beyond the human factor. We would rather say so upfront.
- The ICT risk management framework
- Business continuity and backups
- Penetration testing
- The register of providers and contract drafting
- Formal incident reporting
The crisis workshop does not replace the formal annual test of your continuity plan. The executive path contributes to the Article 5 obligation and produces the evidence of it.
Frequently asked questions
- Is my organisation subject to DORA?
- DORA targets financial entities: banks, payment and e-money institutions, investment firms, asset managers, insurers, mutual insurers, occupational retirement institutions, crypto-asset service providers and market infrastructures. Your compliance function remains best placed to confirm your status.
- Does the programme make us DORA compliant?
- No, no tool can do that alone. BlueSecure contributes to implementing and documenting the awareness, training and crisis exercise requirements set by DORA. The rest of the regulation belongs to your ICT risk management framework.
- Do we need a NIS 2 programme as well?
- For financial entities covered by DORA, DORA applies to ICT risk management. The DORA programme is therefore the reference framework.
- Does the crisis workshop replace the annual continuity plan test?
- No. It trains the executive committee to decide and communicate under pressure. The formal test of your continuity plan remains a separate obligation.
- How do we include our providers?
- Providers who access your information system can be added to the platform’s scope. They follow the appropriate paths and appear in your indicators.
- We are a group with several regulated entities. How do we steer?
- Multi-tenant mode segregates each entity’s data, delegates administration locally and consolidates reporting at group level.
Let’s build your DORA programme.
A first conversation to review your audiences, your providers and the evidence expected during a review.