[non-validated] DORA Area A, SF C: Currency of Security Awareness Training Content
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity maintained security awareness training content updated with recent incident lessons and threat intelligence as required by its DORA classification?
Explanation
[non-validated] Has the applicable entity maintained current security awareness training content incorporating recent incident lessons and relevant threat intelligence as required by its DORA classification under Articles 13 and 45?
Criterion and evidence
Verify documented evidence from the current regulatory review period demonstrating security awareness training updated to incorporate recent incident/test lessons and relevant threat intelligence aligned with the entity's risk profile and critical functions, respecting conditional applicability under DORA Articles 13 and 45.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of updated training content?
Documented curriculum revised within the review period showing integration of recent incident lessons and threat intelligence relevant to the entity's risk profile and critical functions, as specified under DORA Articles 13 and 45.
How is missing evidence handled?
Pending submission of updated curriculum and verification records. Absence of evidence does not automatically constitute failure; the entity must demonstrate why requirements do not apply based on its DORA classification or provide compliant documentation per proportional obligations.
References
DORA: Learning, staff readiness and information sharing