Art.13 Learning and evolving
Financial entities have the capability and staff to gather and analyse information on vulnerabilities, cyber threats and ICT-related incidents; after a major incident disrupts core activities they run a post-incident review that checks whether procedures were followed and actions worked (alert response speed, forensic quality where appropriate, escalation, communication); they feed lessons from testing, real incidents and plan activations into ICT risk assessment, monitor the resilience strategy and incident trends, have senior ICT staff report findings to the management body at least yearly, and run compulsory ICT security awareness and resilience training for all staff and senior management, including ICT third-party providers where appropriate. Entities other than microenterprises must also tell the authority, on request, what changed after post-incident reviews (Art. 13(2)) and track technological developments continuously for their security impact (Art. 13(7)). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.
Source: DORA (Regulation (EU) 2022/2554), Art.13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.
Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Training completion records for staff and senior management, with provider participation where appropriate · HR system / LMS
periodic reviewEvidence produced at each review
- Post-incident review reports for each major ICT-related incident that disrupted core activities · Document repository
- Lessons-learned log linking test and incident findings to ICT risk assessment updates · SIEM / log platform
- Yearly report from senior ICT staff to the management body · Document repository
- Technology-watch records and change reports supplied to the authority on request (entities other than microenterprises) · Document repository
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Post-incident reviews skipped or not covering escalation and communication
- No yearly report from senior ICT staff to the board
- Training optional or not tailored by role
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.12 Backup policies and procedures, restoration and recovery · Art.14 Communication