Team Licence · Manager Handbook

Running your DORA Academy team licence

How seats work, how to assign and reassign them, what your participants receive, and how to produce the training evidence your auditors will ask for.

What is in this handbook

1How the licence works

A team licence is a pool of seats. One seat carries one named person through every course in your plan. You decide who holds each seat, and you can change your mind later.

Three things are worth understanding before you start, because they explain nearly every question that follows.

An email address is the identity

There are no accounts to create, no usernames and no passwords. When you add a colleague, we enrol that email address and send it a permanent personal access link. Clicking the link opens the course, and progress is recorded against that address.

Why it is built this way: your IT department has nothing to provision, no SSO project, no password resets and no leaving-employee account to close. Removing a seat in this handbook is the whole offboarding procedure.

You are the manager, and only you

Your management page is reached through one private link. Anyone holding that link can add and remove people, so treat it like a credential rather than like a bookmark you paste into a team channel.

A seat is a licence, not a person

Seats are reassignable. If someone changes role or leaves, free their seat and give it to their replacement. What is not transferable is a certificate: it is issued in the name of the person who passed the exam and stays theirs.

3Adding participants

  1. Open your manager link. The bar at the top shows the plan, how many seats are in use and how many are free.
  2. Add one person by typing their work email address in the field and pressing Add member, or add everyone at once: open Import a list of members and upload the CSV export from your HR tool or spreadsheet as it is (we pick out the email addresses and ignore name columns and headers), or paste your addresses. Check list previews what is valid, duplicated and how it fits your free seats, so a typo is visible before any access link is sent. Then press Import and watch a live status appear next to each address.
  3. They are enrolled immediately in every course in the plan, and receive an email titled “You have been added to a DORA Academy course” containing their personal links, one per course.
  4. They click and start. No registration step, no password, nothing to install. The courses run in any modern browser, on a laptop, a tablet or a phone.

Use the address they actually read

Everything reaches the participant at the address you enter: the access links, the exam results and the certificate. A shared mailbox or a personal address will work technically, but a certificate is issued in a person's name, so a corporate address per person is what you want in your records.

Ask your IT team to allow info@regulation-dora.eu before you start. Access links arrive by email, and a corporate filter that quarantines the first message is the single most common reason a participant tells you the licence “did not work”. Allowing the sender once, before the rollout, prevents it for all of them.

If someone still cannot find their email, open your manager page and press Resend on their row. It sends the same links again.

4Reassigning a seat

Press Remove on a participant's row. Their seat is freed at once and you can add someone else in their place straight away. The person removed loses access to the courses immediately.

One thing to do before you remove someone: if they have passed an exam but have not yet claimed their certificate, ask them to claim it first. A certificate that has been issued stays valid and verifiable for ever, but claiming one requires an active enrolment. Thirty seconds of warning saves an awkward conversation later.

Adding the same person back later restores their access, and their earlier progress and exam results are still there. Nothing is lost by reassigning a seat temporarily.

5Tracking progress

Your manager page shows a live table: one row per participant, one column per course. Each cell carries a progress bar and a status.

The table updates as people learn, so it is worth opening a fortnight after the rollout: the pattern of who has not started tells you more than any reminder email.

6Training evidence for audit

The Export training record button on your manager page downloads a CSV with one row per participant and per course: enrolment date, progress, exam score, result, number of attempts, exam date and last activity. It opens cleanly in Excel.

Why we built the export: DORA Article 13(6) requires financial entities to run ICT security awareness and digital operational resilience training as a compulsory part of staff development, for staff and for senior management alike. When a supervisor or an internal auditor asks how you meet it, the useful answer is a file naming who was trained, on what, and with which result. That is exactly what the export contains.

Export it at the end of each quarter and file it with your training records. It is a snapshot, so keeping the successive versions gives you the progression over time.

7Exams and certificates

Every course ends with a multiple-choice certification exam drawn from a larger question bank, so two attempts are not the same paper.

Participants claim their certificate from the course page once they have passed. Encourage them to download the PDF as well, for their own file.

8The 20 courses in the Masterclass plan

Each seat unlocks all of them, roughly 44 hours of material in total. Nobody is expected to take everything: the point of an all-access plan is that each person follows the two or three programmes that match their job, and can look into the others when a project demands it.

CourseLevelDurationModules
Certified DORA Project Manager (CDPM) Expert 2.5 hours 9
Certified DORA Advisor (CDA) Advanced 2 hours 5
Certified DORA AI-Resilience Specialist Advanced 2 hours 5
DORA for Boards & Executives Advanced 2.5 hours 8
DORA for ICT Providers & Vendors Advanced 3 hours 8
DORA for IT & Security Teams Advanced 2.5 hours 8
DORA for Developers & DevOps Advanced 2.5 hours 8
DORA for Legal & Contract Teams Advanced 2.5 hours 8
Certified DORA Contract Manager (CDCM) Intermediate 2 hours 6
ICT Risk Management Professional Intermediate 2 hours 6
Incident Reporting Specialist Intermediate 2 hours 5
Third-Party Risk Management Expert Advanced 2 hours 6
TLPT Tester Certification Advanced 2 hours 6
Business Continuity, DRP & Test Exercises Advanced 2 hours 6
DORA Programme Manager Advanced 2.5 hours 9
DORA Implementation Director Expert 2 hours 6
DORA Compliance Officer Intermediate 2 hours 6
DORA × ISO 27001 Lead Implementer Advanced 2 hours 6
DORA Internal Auditor Advanced 2 hours 6
DORA Register of Information Specialist Intermediate 2 hours 6

Our introductory course, DORA Fundamentals, is free for everyone and needs no seat. It is the natural first step for anyone in the organisation, including the colleagues you have no seat for.

9Who should take what

The most common mistake with an all-access licence is to tell everyone to “go through the Academy”. Give each person a named starting path instead: completion rates roughly double when someone is told which two courses are theirs.

If their job isStart withThen
Board member, executiveDORA for Boards & ExecutivesDORA Compliance Officer
Compliance, riskDORA Compliance OfficerICT Risk Management Professional, Register of Information Specialist
IT, infrastructure, securityDORA for IT & Security TeamsICT Risk Management Professional, Business Continuity & DRP
Software engineering, DevOpsDORA for Developers & DevOpsDORA for IT & Security Teams
Security testing, red teamTLPT Tester CertificationDORA for IT & Security Teams
Legal, contractsDORA for Legal & Contract TeamsCertified DORA Contract Manager
Procurement, vendor managementThird-Party Risk Management ExpertCertified DORA Contract Manager, Register of Information Specialist
Incident response, operationsIncident Reporting SpecialistBusiness Continuity & DRP
Internal auditDORA Internal AuditorDORA × ISO 27001 Lead Implementer
Programme and project leadsDORA Programme ManagerDORA Implementation Director, Certified DORA Project Manager
Data, AI teamsCertified DORA AI-Resilience SpecialistICT Risk Management Professional
Serving financial clients as a supplierDORA for ICT Providers & VendorsThird-Party Risk Management Expert

A word on sequencing: whatever the role, DORA Fundamentals first is time well spent. It is free, it takes an afternoon, and it means the specialised courses do not have to keep re-explaining the five pillars.

10A 90-day rollout that works

A licence that sits unused is the normal outcome of an unplanned rollout. This is the pattern we see work in practice.

  1. Before you assign anything. Ask IT to allow the sender address. Draw up your list of participants with, next to each name, the starting path from the table above. This is the whole preparation.
  2. Week 1 — assign and announce. Add everyone on the same day and send one short internal message: why the organisation is doing this, which course is theirs to start, and by when. A deadline of four to six weeks for the first course is realistic for people doing this alongside their job.
  3. Weeks 2 to 6 — the first course. Each person completes their starting programme and sits the exam. Open the manager page in week 3: whoever is still at “Not started” is who needs a nudge, and it is far easier at week 3 than at week 6.
  4. Weeks 6 to 12 — the second course, and depth where you need it. People move to the second course of their path. This is also when it becomes obvious which team needs more: an organisation weak on supplier documentation, for example, will want more of its people through Third-Party Risk and the Register of Information.
  5. End of quarter — export and file. Download the training record, file it with your evidence, and reassign any seat that was never used. An unused seat is worth more given to someone who will use it.

One practical tip: book the time. Teams that block two hours a week in calendars finish; teams that rely on spare time do not. The material is designed for that rhythm, in modules of twenty to forty minutes with a quiz at the end of each.

11Questions we are asked

Does the licence expire?
No. The seats and the enrolments have no end date, and neither do the certificates.
Can two people share a seat?
Technically the link would work, but the record would be meaningless and the certificate would carry one name for two people's work. If you need more people trained than you have seats, tell us and we will quote the additional seats at your existing volume price.
Can we add everyone at once?
Yes. On your manager page, open Import a list of members and upload the CSV export from your HR tool or spreadsheet exactly as it comes out: we pick out the email addresses automatically and ignore name columns and header rows. You can also paste addresses directly. Press Check list to preview what will happen, then Import. Each person is added and emailed in turn, with a live status per address, and running the import twice is harmless: anyone already on the team is simply skipped. Prefer to hand it off, or something not working as expected? Email your export to info@regulation-dora.eu and we will load it for you quickly.
A participant changed email address. What do we do?
Remove the old address and add the new one. Progress is tied to the address, so tell us if they were mid-course and we will move their history across.
Is there a mobile app to install?
No. Everything runs in the browser, which is also why there is nothing for your IT department to review or deploy.
What language are the courses in?
English. The certificates are issued in English as well, which is what makes them portable across jurisdictions.
What personal data do you hold on our participants?
Their email address, their course progress and their exam results. Email addresses are encrypted at rest. We do not sell or share them, and a removed participant's data can be deleted entirely on request to info@regulation-dora.eu.
Are the implementation toolkits included?
No. A seat covers the courses, the exams and the certifications. The document toolkits, such as the policy templates and the gap analysis workbooks, are separate products. We are happy to quote them for your team if they would be useful.
Can we add seats later?
Yes, and your volume price is kept for the additional ones. Write to us with the number you need.
Who do we contact if something breaks?
info@regulation-dora.eu. Mention your organisation and, if it concerns one participant, their email address.

Ready to assign your seats

Everything above happens on one page: your private manager link. Keep it safe, and it is the only address you need.

Open the team manager

Practitioner tools for DORA compliance teams

Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.

academy-bundle

DORA Certifications Bundle

399 € excl. VAT
academy

DORA for IT & Security Teams

199 € excl. VAT
academy

DORA for ICT Providers & Vendors

199 € excl. VAT
91
certificates issued
61
certified professionals
14
programmes awarded

Browse the full library · Excel toolkits · Certifications

How Compliant Is Your Institution?

Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.

Get Your Free DORA Score Join Free Monthly Webinar