Learnlytica
Book a demo
← All 186 courses
SEC-107 Security

EU Cyber Regulation Foundations: NIS2 & DORA

A practical orientation to the two regulations reshaping European security programmes. Learners determine scope and entity classification, walk DORA's five pillars, master the incident reporting clocks and thresholds, and understand what management-body accountability means in practice. The course ends with a one-page obligation map showing where existing ISO 27001 and NIST control work already counts and where it does not.

B2Foundation
5modules
43skill atoms
2role journeys
Curriculum

What this course covers.

5 modules, 43 named skill atoms. Expand any module to see them.

1NIS2 Scope & Duties7 skill atoms
essential vs important entitiesthe size-cap ruleAnnex I and Annex II sectorsnational transposition varianceregistration with competent authoritiesArticle 21 risk-management measuresdiffering supervision and enforcement regimes
2Management Body Accountability9 skill atoms
approval of risk-management measuresongoing oversight dutytraining obligations for leadershipliability for infringements under Article 20temporary management bans as an enforcement power available against essential entities onlywhy important entities face ex post supervision insteadevidencing that oversight actually happenedboard agenda and minute qualitydelegation without abdication
3DORA Five Pillars10 skill atoms
financial entity categories in scopethe simplified ICT risk framework for small and non-interconnected entitiesthe DORA lex specialis carve-out under NIS2 Article 4ICT risk management frameworkincident management and reportingdigital operational resilience testingICT third-party risk managementinformation sharing arrangementsthe register of informationcritical third-party provider oversight
4Reporting Clocks & Thresholds10 skill atoms
NIS2 24-hour early warning72-hour incident notificationfinal report one month after notificationNIS2 intermediate and progress reports for ongoing incidentsDORA initial report within 4 hours of classification as major and within 24 hours of awarenessDORA intermediate report within 72 hours of the initialDORA final report within one month of the intermediatesignificance and materiality criteriadeciding when the clock actually startedcite the RTS rather than assert a figure from memory
5Overlap With What You Have7 skill atoms
ISO 27001 Annex A crosswalkNIST CSF mappingreusing SOC 2 evidenceGDPR Article 33 vs NIS2 timelinesone control satisfying several obligationsgap classes nothing existing coversbuilding a one-page obligation map
Where it fits

SEC-107 in the role journeys.

This course appears in 2 of our 45 role journeys. Here is what a learner takes immediately before and after it in each.

Executive / SLT

Foundation stage
AI-106→SEC-107→AI-505

GRC / Compliance Analyst

Foundation stage
SEC-102→SEC-107→SEC-503

Roles this course serves

Executive / SLTGRC / Compliance Analyst
The capability ladder

This course is authored to band B2.

Every course we run is written to one rung of the CASI ladder, so a plan can be assembled to take a team from where they are to where they need to be.

What do B1–B6 mean?The CASI Capability Ladder — click to expand

Every course targets a band on the CASI Capability Ladder — our six-band proficiency scale, anchored to open standards (O*NET, ESCO, NICE, NIST AI RMF, Bloom's). A band tells you how deep a course goes, and what evidence proves it.

What the learner can doTypical evidence
B1
AwareUnderstands concepts and vocabulary; uses tools with guidance
Knowledge checks
B2
FoundationPerforms standard tasks correctly in familiar contexts
Guided labs, autograded exercises
B3
PractitionerDelivers complete pieces of work independently
Scenario labs, proctored hands-on exams
B4
ProfessionalHandles production-grade complexity, trade-offs and failure modes
Break-fix drills, design defenses
B5
AdvancedEngineers systems end-to-end under constraints; leads others
Rubric-scored capstones, vivas
B6
ExpertSets direction; recognised authority across teams
Portfolio + panel evaluation

A note on B6. Courses in this catalog target B1–B5. B6 is not taught — it is recognised, through a portfolio and a panel, once someone is setting direction for others. Every journey here is built to land a learner at B5.

Related

Other Security courses at this level.

SEC-102

Identity & Access Management Fundamentals

B2 · Foundation
SEC-103

Applied Cryptography & PKI Essentials

B2 · Foundation
SEC-105

OT & ICS Security Foundations

B2 · Foundation
SEC-106

Post-Quantum Readiness & Cryptographic Inventory

B2 · Foundation
SEC-201

Cloud Security Fundamentals

B2 · Foundation
SEC-101

Security Foundations & Threat Landscape

B1 · Aware
Next step

Run SEC-107 for your team.

This course runs at several lengths depending on how deep you need to go and how much of it your people already have. Tell us who is being trained and we will scope it.

Add it to a training plan Talk to our team Check your team’s level free