Use case · DORA and ISO 27001
Awareness training an auditor can trace line by line
Financial entities under DORA must run ICT security awareness programs and digital operational resilience training as compulsory parts of their staff training, covering staff and the management body alike. ISO/IEC 27001:2022 asks for the same thing in its own words: personnel receive appropriate awareness, education and training, kept up to date.
Neither is satisfied by a program description. Both are satisfied by records.
Four things that have to be true, not just intended
Everyone is enrolled
Directory sync and automatic enrollment mean a new joiner cannot fall through the gap between intakes.
Completion is enforced
Curricula can require a passed quiz, reminders run until completion, and end dates extend automatically when completion is low.
The management body is covered
A separate directors’ curriculum, with its own completion report.
Third parties are included where they need to be
Contractors with access can be added as users and assigned the same training.
Six artefacts, and where each comes from
- 01
Training records per person
Assigned, sent, completed, quiz score against the pass mark — from the training and education campaign exports, as Excel or CSV.
- 02
Policy acceptance per person
With the date, from policy acknowledgement campaigns.
- 03
Effectiveness over time
Simulation results and awareness scores, baseline against now.
- 04
Continuous awareness activity
The awareness content report: newsletters, tips, posters and podcasts delivered, and to whom.
- 05
Management oversight
Management reports and scheduled executive summaries.
- 06
Integrity of the records
The platform audit log — who changed what, and when — forwardable to your SIEM.
What your second-line function will ask about
- Role-based access, including a read-only Auditor role
- Encrypted user data, and an audit trail of administrator actions
- Syslog forwarding in JSON, CEF or LEEF
- Passwords from credential-capture tests never stored in usable form
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
On its own it is a test, not training. Combined with the training that follows each failed test, and recorded against the named person, it becomes part of the training program and — more usefully — a measure of whether that program works.
That is how we run it, and it is the combination rather than the simulation that we would put in front of an auditor.
Through the calendar and the records together: new modules and new simulation topics through the year, newsletters and tips between them, and an export showing what each person received and when.
The awareness content report is the one most organizations do not know they have. It answers the specific question of whether awareness was continuous rather than annual, in a single file.
Yes. It is an Excel or CSV file per period, with named people, the trainings, the dates and the results. Most auditors want exactly that and nothing more, and the platform produces it without anyone assembling it by hand.
Where to go next
Integrations & security
Entra ID, LDAP, Microsoft 365 delivery and forwarding to your SIEM.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.