YTYK You think you know

Card 6 of 15 Governance — the management body owns it ●●○ Working knowledge

The board has to keep up

Members of the management body must actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact, including by following regular specific training, commensurate with the ICT risk being managed.

Why it is like this

Final responsibility is meaningless if the people holding it cannot read the paper in front of them. Making training an explicit obligation gives supervisors something to ask for evidence of.

Not to be confused with

Awareness training for staff. This is a duty on the board members themselves, and it sits beside the same obligation in NIS2 — if you are covered by both regimes across a group, it is the same people, twice.

In practice

Supervisors ask to see the training record. An induction deck from four years ago is the answer nobody wants to give.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 5(4). Read on .

Connects to

  • NIS2 — NIS2 Article 20 places the same training duty on management bodies — the same people, for the same reason
Predict Check yourself

A supervisor asks a bank's board for evidence of its ICT risk training. The bank offers its all-staff annual security awareness module. Sufficient?

  1. No — Article 5(4) places a training duty on the management body members themselves, commensurate with the ICT risk they manage.
  2. Yes — the board members are staff and completed the module.
  3. Yes, provided completion is above 95%.
  4. No, but only for entities using the full rather than the simplified framework.
Show the answer

No — Article 5(4) places a training duty on the management body members themselves, commensurate with the ICT risk they manage.

Awareness training is a different obligation with a different audience. The board's own duty is specific and regular.