Most DORA training is written for risk officers and lawyers. A second wave was written for security operations. This course is for the third audience nobody trained — the people who design, build and ship the software: application developers, DevSecOps engineers, platform teams and SREs.

The one fact that reframes everything

DORA — Regulation (EU) 2022/2554 — has been fully applicable since 17 January 2025. It is directly applicable law across the EU: no national transposition, no grace period. For a developer that means the resilience and security of the systems you build and deploy are now a regulated property — examined by supervisors against evidence your pipeline and your services produce.

Where a compliance regulation meets the pull request

Almost every DORA obligation resolves, eventually, to something you control at the keyboard. Secure change is a change-management and CI/CD problem. Resilience testing is a SAST/DAST and load-test problem. Detection is an observability problem. Recovery objectives are an architecture and infrastructure-as-code problem. The supplier chain is an open-source dependency problem. When a supervisor inspects a financial entity, a surprising share of the evidence they want — change records, test results, deployment logs, recovery drills — is generated by the software delivery lifecycle you own.

How this course relates to the IT & Security course

Our DORA for IT & Security Teams course is written from the controls-and-evidence side — the framework, the SIEM, TLPT, BC/DR, the supervisory file. This course is its build-and-ship companion: same regulation, viewed from the pipeline and the codebase. Where the two meet — testing, detection, recovery — we stay on how you build and ship it, and point to the ops course for the run-and-evidence side.