A focused course, tailored for you
The IT/OT Security Assessment Playbook for Consultants
Build the gap assessment and roadmap skills that industrial clients pay for.
The standard IT vulnerability assessment methodology stops at the OT boundary. That boundary is where your consulting engagement falls apart.
$199 one-time
Tailored to your situation. Access within 24 hours. 30-day money-back.
Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.
Why this course
Industrial clients hire IT/OT cybersecurity consultants because they need someone who can work in both worlds. What they typically get is an IT security assessment methodology applied to an environment it was not designed for: active scanning that risks controller downtime, gap reports that use enterprise security language the plant manager ignores, and roadmaps that treat a DCS upgrade and a firewall policy change as equivalent workstreams.
The problem is not the consultant's intent. The problem is that IT security training does not include the OT layer. IEC 62443 zone and conduit methodology, passive asset discovery for live control systems, NERC CIP classification for bulk electric assets, and the OT risk translation skills that get findings accepted by operations leadership: none of these appear in CISSP or ISO 27001 Lead Implementer curricula.
This course closes that gap with the specific skills an IT/OT consulting engagement requires.
The 12 modules
Module 1. The OT Architecture Baseline
Industrial control systems follow a different security model than enterprise IT. This module establishes the Purdue Reference Model as a working lens for your consulting engagements: the separation between Level 0 field devices, Level 1 and 2 control systems, and Level 3 and 4 business networks. You map a sample plant's architecture from network diagrams and P&IDs, producing the asset topology your gap assessment is built on.
Module 2. IEC 62443 Zone and Conduit Assessment
Walk through the core IEC 62443-2-1 and 3-2 requirements that manufacturing and energy clients are assessed against. This module covers the zone and conduit methodology: how to define security zones from an OT network diagram, assign Security Levels, and identify conduits that cross zone boundaries. You produce a completed zone-conduit matrix for a representative process environment, the deliverable clients and auditors most commonly request.
Module 3. Passive OT Asset Discovery
Active scanning destroys PLCs. This module teaches the passive discovery methods that work in live OT environments: traffic mirroring from managed switches, protocol analysis for Modbus, DNP3, and EtherNet/IP, and reconciling discovered assets against the client's existing asset register. You build a discovery methodology that produces a defensible inventory without taking a single controller offline, and learn to flag the unmanaged devices that appear in every engagement.
Module 4. Translating NIST CSF to OT Environments
NIST CSF Identify, Protect, Detect, Respond, and Recover read differently when the asset is a turbine rather than a laptop. This module maps CSF subcategories to the OT context: what access control means for a DCS operator console, what anomaly detection requires when there is no EDR equivalent. You produce a CSF-to-OT control mapping table your client can use in their board-level risk reporting.
Module 5. NERC CIP for Utilities Client Engagements
Utilities clients have a specific regulatory overlay: NERC CIP standards govern their bulk electric system cyber assets. This module covers the CIP-002 through CIP-013 requirements most relevant to a consulting assessment: BES Cyber Asset classification, Electronic Security Perimeter definition, and the documentation requirements that appear in every NERC audit. You draft an assessment scope document that uses NERC CIP language your utility client's compliance team recognises.
Module 6. OT Vulnerability Assessment Without Disruption
Patch Tuesday does not exist in OT. This module covers how to assess vulnerabilities in environments where controllers run for years without restart: firmware version review, configuration hardening checks against vendor guides and DISA STIGs, and physical security walk-throughs for remote terminal units. You produce a prioritised vulnerability register formatted for OT risk owners, not IT security teams, with remediation paths that account for production schedules.
Module 7. Translating OT Risk Into IT Security Language
IT security leads and OT engineers speak different languages around the same risks. This module gives you the translation layer: how to frame a Modbus protocol gap in terms an IT CISO understands, how to explain a process safety consequence to someone whose threat model is data exfiltration. You build a risk translation table and practise the summary slide that gets both audiences to agree on priorities in the same room.
Module 8. Building the Gap Assessment Report
The gap assessment report is the primary deliverable. This module covers the structure that works: an executive summary with a three-level heat map, a finding register with OT-specific severity ratings, and a maturity scorecard aligned to IEC 62443 Security Levels. You build a report template, practise populating it from assessment evidence, and learn which sections the CISO and which sections the plant manager each read first.
Module 9. OT Network Segmentation Review
Flat OT networks remain the most common finding in industrial assessments. This module covers how to evaluate existing segmentation against IEC 62443-3-2 zone requirements: firewall rule review, VLAN analysis, and identifying uncontrolled pathways between the corporate network and the process control layer. You produce a segmentation gap finding formatted as a remediation roadmap, with architecture diagram annotations your client can hand to their network team.
Module 10. OT Incident Response Planning
When a ransomware variant enters the process network, the IT incident response playbook rarely applies. This module covers OT-specific IR planning: defining notification chains that include plant safety officers, isolating a compromised segment without stopping production, and the forensic constraints of OT environments where evidence collection competes with continuity. You draft an OT IR plan annex designed to sit alongside the client's existing IT IR policy.
Module 11. Running the Client Workshop
Gap assessments fail when findings are delivered into a document and nothing moves. This module gives you the workshop structure that produces a prioritised action register: how to run the OT-IT joint session where plant managers and IT security leads are in the same room, how to surface the ownership conflicts that block remediation, and how to get sign-off on a security roadmap before you leave the building.
Module 12. Building the OT Security Roadmap
The roadmap is what the client funds next. This module covers multi-year OT security programme structure: phasing remediation across immediate quick wins, near-term architecture changes, and longer-term programme maturity, mapped against budget cycles and production windows. You produce a roadmap template that ties each initiative to a specific IEC 62443 Security Level improvement, and practise presenting it to a steering committee that includes the CISO and the Head of Operations.
How this addresses your situation
Specific modules that map to what you said you are dealing with.
The client's OT network diagram shows a flat architecture with no documented security zones. You have five days to assess it against IEC 62443.
The IT security lead wants to run the standard vulnerability scanner against the DCS. The OT engineer says that will take the plant offline. You need to find a path that works for both.
Your gap assessment findings are complete, but the plant manager says the issues do not apply to their environment. The client presentation is tomorrow.
The engagement scope is finished and the client is asking what comes next. You need a roadmap that translates your findings into a funded programme.
Who it is for
IT/OT cybersecurity consultants at professional services firms, typically Associates to Senior Associates, who hold IT security credentials and have started taking on OT-side client work. They know NIST CSF, ISO 27001, and enterprise vulnerability management. They struggle when the engagement moves into the OT layer and their standard methodology stops working.
Who this is NOT for. IT security generalists with no OT client exposure. OT engineers who are not doing security consulting work. Senior managers who delegate assessment delivery to their teams.
How it arrives
Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.
Time investment. 6 to 8 hours across 12 modules. Each module is self-contained and can be worked through between client engagements.
Why $199 is the right number
IEC 62443 certifications cost over $1,000 and require weeks of study. SANS ICS courses are 5-day in-person programmes at $5,000 or more. This course costs $199 and delivers the engagement-ready skills, templates, and roadmap structure you need for your next client assignment, not a credential that proves you studied the standard.
FAQ
Do I need OT engineering experience to take this course?
No. The course is built for IT security professionals moving into OT consulting. It assumes familiarity with IT security frameworks like NIST CSF and ISO 27001, and builds the OT-specific layer on top of that foundation.
Is this relevant for clients outside manufacturing?
Yes. The frameworks covered, including IEC 62443, NERC CIP, and NIST SP 800-82, apply across manufacturing, energy, oil-and-gas, water treatment, and transportation. Module 5 is utilities-specific; the remaining 11 modules apply across all industrial sectors.
What is the implementation playbook?
It is a hand-built document created specifically for your engagement context. It translates the course content into a ready-to-use methodology for your actual client type, sector, and assessment scope.
