DORA Foundation — Lesson 2: ICT Risk Management, Asset Dependencies, Protection, Detection, Continuity, and Recovery

Learning Objectives

• Interpret the requirements, principles, roles, and dependencies shaping ict risk management, asset dependencies, protection, detection, continuity, and recovery.
• Apply a practical workflow and create a reviewable ICT resilience control workbook.
• Evaluate the exception where incident severity decisions lack consistent thresholds and determine proportionate follow-up.

Detailed Topics

• ICT Risk Management applied to the course scenario and expected evidence.
• Asset Dependencies applied to the course scenario and expected evidence.
• Protection applied to the course scenario and expected evidence.
• Detection applied to the course scenario and expected evidence.
• Continuity applied to the course scenario and expected evidence.
• and Recovery applied to the course scenario and expected evidence.

Instructor Demonstration

The instructor traces a case involving a financial entity mapping regulatory resilience responsibilities across business, technology, security, continuity, and suppliers. The demonstration links decisions to objective evidence, records the result in ICT resilience control workbook, and tests the condition where incident severity decisions lack consistent thresholds.

Hands-On Exercise

Complete a controlled exercise covering ICT Risk Management, Asset Dependencies, Protection, Detection, Continuity, and Recovery. Confirm scope and responsibilities, examine the stated exception, reach a supported conclusion, and preserve the outcome in ICT resilience control workbook.

1. Define the objective, boundaries, stakeholders, criteria, and expected work product.
2. Perform the activity while recording assumptions, observations, evidence, and decisions.
3. Test normal operation, the exception, and an escalation or follow-up condition.
4. Document conclusions, owners, deadlines, verification methods, and review triggers.

Scenario Analysis

• Identify the requirement or control with the strongest influence on the scenario outcome.
• Compare two defensible responses and explain their risk, operational, and evidence trade-offs.
• Decide how the ICT resilience control workbook should be approved, retained, reviewed, and updated.

Troubleshooting Guidance

Start where expected practice and observed evidence first diverge. Separate a missing record from an ineffective process, distinguish unclear ownership from a control failure, and treat “incident severity decisions lack consistent thresholds” as a hypothesis until tested against the applicable criteria and intended outcome.

Validation Checklist

• Scope, roles, criteria, stakeholders, dependencies, and intended outcomes are explicit.
• The ICT resilience control workbook connects conclusions to objective, reviewable support.
• Normal operation, the stated exception, escalation, and follow-up were evaluated.
• Owners, due dates, verification methods, review triggers, and improvement actions are clear.

Lesson Outcome

Learners can apply ICT Risk Management, Asset Dependencies, Protection, Detection, Continuity, and Recovery, explain the reasoning used, and defend the result through ICT resilience control workbook.