How seats work, how to assign and reassign them, what your participants receive, and how to produce the training evidence your auditors will ask for.
A team licence is a pool of seats. One seat carries one named person through every course in your plan. You decide who holds each seat, and you can change your mind later.
Three things are worth understanding before you start, because they explain nearly every question that follows.
There are no accounts to create, no usernames and no passwords. When you add a colleague, we enrol that email address and send it a permanent personal access link. Clicking the link opens the course, and progress is recorded against that address.
Why it is built this way: your IT department has nothing to provision, no SSO project, no password resets and no leaving-employee account to close. Removing a seat in this handbook is the whole offboarding procedure.
Your management page is reached through one private link. Anyone holding that link can add and remove people, so treat it like a credential rather than like a bookmark you paste into a team channel.
Seats are reassignable. If someone changes role or leaves, free their seat and give it to their replacement. What is not transferable is a certificate: it is issued in the name of the person who passed the exam and stays theirs.
You received it by email when the licence was activated. It looks like regulation-dora.eu/academy/team?t=… and the part after t= is a signed token that identifies your team.
If the link is exposed (forwarded by mistake, pasted in a shared document), tell us at info@regulation-dora.eu and we will issue you a new one. The old link stops working. Whoever holds the old link could not have managed the team anyway without the email code above, but a fresh link keeps things tidy.
Everything reaches the participant at the address you enter: the access links, the exam results and the certificate. A shared mailbox or a personal address will work technically, but a certificate is issued in a person's name, so a corporate address per person is what you want in your records.
Ask your IT team to allow info@regulation-dora.eu before you start. Access links arrive by email, and a corporate filter that quarantines the first message is the single most common reason a participant tells you the licence “did not work”. Allowing the sender once, before the rollout, prevents it for all of them.
If someone still cannot find their email, open your manager page and press Resend on their row. It sends the same links again.
Press Remove on a participant's row. Their seat is freed at once and you can add someone else in their place straight away. The person removed loses access to the courses immediately.
One thing to do before you remove someone: if they have passed an exam but have not yet claimed their certificate, ask them to claim it first. A certificate that has been issued stays valid and verifiable for ever, but claiming one requires an active enrolment. Thirty seconds of warning saves an awkward conversation later.
Adding the same person back later restores their access, and their earlier progress and exam results are still there. Nothing is lost by reassigning a seat temporarily.
Your manager page shows a live table: one row per participant, one column per course. Each cell carries a progress bar and a status.
The table updates as people learn, so it is worth opening a fortnight after the rollout: the pattern of who has not started tells you more than any reminder email.
The Export training record button on your manager page downloads a CSV with one row per participant and per course: enrolment date, progress, exam score, result, number of attempts, exam date and last activity. It opens cleanly in Excel.
Why we built the export: DORA Article 13(6) requires financial entities to run ICT security awareness and digital operational resilience training as a compulsory part of staff development, for staff and for senior management alike. When a supervisor or an internal auditor asks how you meet it, the useful answer is a file naming who was trained, on what, and with which result. That is exactly what the export contains.
Export it at the end of each quarter and file it with your training records. It is a snapshot, so keeping the successive versions gives you the progression over time.
Every course ends with a multiple-choice certification exam drawn from a larger question bank, so two attempts are not the same paper.
Participants claim their certificate from the course page once they have passed. Encourage them to download the PDF as well, for their own file.
Each seat unlocks all of them, roughly 44 hours of material in total. Nobody is expected to take everything: the point of an all-access plan is that each person follows the two or three programmes that match their job, and can look into the others when a project demands it.
| Course | Level | Duration | Modules |
|---|---|---|---|
| Certified DORA Project Manager (CDPM) | Expert | 2.5 hours | 9 |
| Certified DORA Advisor (CDA) | Advanced | 2 hours | 5 |
| Certified DORA AI-Resilience Specialist | Advanced | 2 hours | 5 |
| DORA for Boards & Executives | Advanced | 2.5 hours | 8 |
| DORA for ICT Providers & Vendors | Advanced | 3 hours | 8 |
| DORA for IT & Security Teams | Advanced | 2.5 hours | 8 |
| DORA for Developers & DevOps | Advanced | 2.5 hours | 8 |
| DORA for Legal & Contract Teams | Advanced | 2.5 hours | 8 |
| Certified DORA Contract Manager (CDCM) | Intermediate | 2 hours | 6 |
| ICT Risk Management Professional | Intermediate | 2 hours | 6 |
| Incident Reporting Specialist | Intermediate | 2 hours | 5 |
| Third-Party Risk Management Expert | Advanced | 2 hours | 6 |
| TLPT Tester Certification | Advanced | 2 hours | 6 |
| Business Continuity, DRP & Test Exercises | Advanced | 2 hours | 6 |
| DORA Programme Manager | Advanced | 2.5 hours | 9 |
| DORA Implementation Director | Expert | 2 hours | 6 |
| DORA Compliance Officer | Intermediate | 2 hours | 6 |
| DORA × ISO 27001 Lead Implementer | Advanced | 2 hours | 6 |
| DORA Internal Auditor | Advanced | 2 hours | 6 |
| DORA Register of Information Specialist | Intermediate | 2 hours | 6 |
Our introductory course, DORA Fundamentals, is free for everyone and needs no seat. It is the natural first step for anyone in the organisation, including the colleagues you have no seat for.
The most common mistake with an all-access licence is to tell everyone to “go through the Academy”. Give each person a named starting path instead: completion rates roughly double when someone is told which two courses are theirs.
| If their job is | Start with | Then |
|---|---|---|
| Board member, executive | DORA for Boards & Executives | DORA Compliance Officer |
| Compliance, risk | DORA Compliance Officer | ICT Risk Management Professional, Register of Information Specialist |
| IT, infrastructure, security | DORA for IT & Security Teams | ICT Risk Management Professional, Business Continuity & DRP |
| Software engineering, DevOps | DORA for Developers & DevOps | DORA for IT & Security Teams |
| Security testing, red team | TLPT Tester Certification | DORA for IT & Security Teams |
| Legal, contracts | DORA for Legal & Contract Teams | Certified DORA Contract Manager |
| Procurement, vendor management | Third-Party Risk Management Expert | Certified DORA Contract Manager, Register of Information Specialist |
| Incident response, operations | Incident Reporting Specialist | Business Continuity & DRP |
| Internal audit | DORA Internal Auditor | DORA × ISO 27001 Lead Implementer |
| Programme and project leads | DORA Programme Manager | DORA Implementation Director, Certified DORA Project Manager |
| Data, AI teams | Certified DORA AI-Resilience Specialist | ICT Risk Management Professional |
| Serving financial clients as a supplier | DORA for ICT Providers & Vendors | Third-Party Risk Management Expert |
A word on sequencing: whatever the role, DORA Fundamentals first is time well spent. It is free, it takes an afternoon, and it means the specialised courses do not have to keep re-explaining the five pillars.
A licence that sits unused is the normal outcome of an unplanned rollout. This is the pattern we see work in practice.
One practical tip: book the time. Teams that block two hours a week in calendars finish; teams that rely on spare time do not. The material is designed for that rhythm, in modules of twenty to forty minutes with a quiz at the end of each.
Everything above happens on one page: your private manager link. Keep it safe, and it is the only address you need.
Open the team managerWorkbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.