Most DORA training is written for risk officers and lawyers. A second wave was written for security operations. This course is for the third audience nobody trained: the people who design, build and ship the software: application developers, DevSecOps engineers, platform teams and SREs.

The one fact that reframes everything

DORA (Regulation (EU) 2022/2554) has been fully applicable since 17 January 2025. It is directly applicable law across the EU: no national transposition, no grace period. For a developer that means the resilience and security of the systems you build and deploy are now a regulated property, examined by supervisors against evidence your pipeline and your services produce.

Where a compliance regulation meets the pull request

Almost every DORA obligation resolves, eventually, to something you control at the keyboard. Secure change is a change-management and CI/CD problem. Resilience testing is a SAST/DAST and load-test problem. Detection is an observability problem. Recovery objectives are an architecture and infrastructure-as-code problem. The supplier chain is an open-source dependency problem. When a supervisor inspects a financial entity, a surprising share of the evidence they want (change records, test results, deployment logs, recovery drills) is generated by the software delivery lifecycle you own.

How this course relates to the IT & Security course

Our DORA for IT & Security Teams course is written from the controls-and-evidence side, the framework, the SIEM, TLPT, BC/DR, the supervisory file. This course is its build-and-ship companion: same regulation, viewed from the pipeline and the codebase. Where the two meet, testing, detection, recovery, we stay on how you build and ship it, and point to the ops course for the run-and-evidence side.