[non-validated] DORA SFS A / SF 5: Management Security Awareness Training
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] For applicable DORA entities, has documented security awareness training specifically for management personnel been implemented per DORA requirements?
Explanation
[non-validated] Has the entity implemented documented security awareness training specifically for management personnel as mandated by DORA, addressing strategic risk management responsibilities and threat awareness?
Criterion and evidence
Verify documented security awareness training schedules with version control covering all management levels, verified completion records including executive participation, and curriculum addressing strategic risk management per DORA Articles 13 and 45.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What specific evidence confirms compliance with management-level training requirements?
Documented training schedules addressing strategic risks with version control, verified completion records showing 100% attendance by all management levels including executives, and curriculum materials updated through regulatory review period.
How are missing management-level training records treated?
Absence of documented training for any management level constitutes non-compliance; pending submission of complete records covering all required personnel levels maintains pending status per evidence rule.
References
DORA: Learning, staff readiness and information sharing