[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F13":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","13","Article 13(6)","Learning and evolving",0,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Article 13 requires financial entities to gather information on vulnerabilities, threats and incidents, conduct post incident reviews and feed lessons into the ICT risk framework. Article 13(6) requires ICT security awareness programmes and digital operational resilience training as compulsory modules for all employees and senior management.\n\n**In practice.** The entity runs post incident reviews after major disruptions, tracks lessons to completion and reports them to senior management. Awareness and resilience training is mandatory, tailored to role and complexity, and in appropriate cases extended to ICT third party providers. Evidence includes review reports, improvement trackers and training records for staff and management.\n\n**Common gaps.** Training is often generic and does not cover resilience topics such as continuity and recovery. Lessons learned are documented but not implemented.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_13","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]