Description

A focused course, tailored for you

The IEC 62443 OT Security Assessment Playbook

Build the zone-conduit methodology and risk-register skills that let you run an OT security engagement end to end.

The gap analysis worksheet identifies the problem. The deliverable that turns three rows in an IEC 62443 gap matrix into a prioritized remediation roadmap both the CISO and the plant manager will fund is the skill most OT security consultants develop slowly, engagement by engagement, without a structured methodology to anchor it.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

OT security assessments fail at the deliverable layer. The technical findings are usually sound. The risk register frames everything by CVSS score and the plant manager cannot connect an 8.7 to a line shutdown. The zone diagram is accurate but not formatted as a consulting deliverable. The NERC CIP section is either missing or bolted on as an afterthought. The result is a report that gets questioned in review, revised under time pressure, and eventually signed off by a client who is not entirely sure what they are getting. The IEC 62443 methodology exists. The assessment workbooks, the consequence-based risk framing, the dual-audience report architecture, the evidence packages that hold under audit review: these are learnable, documentable skills. This course builds them from first principles, with every module producing an artefact you can deploy on the next engagement.

What you walk away with

Run a passive OT asset discovery in a live ICS environment and produce a complete asset register without disrupting operational systems.
Design zone and conduit architecture under IEC 62443-3-2 and document it to consulting deliverable standard.
Build a consequence-based OT risk register that plant leadership will prioritize and fund.
Write a dual-audience OT assessment report that communicates clearly to both the CISO and the OT engineering team.
Map OT assessment findings to NERC CIP requirements for energy sector client engagements.
Produce a repeatable OT security assessment methodology with reusable templates deployable across engagements.

The 12 modules

Module 1. OT Asset Inventory Without Active Scanning

Active network scanning kills PLCs. This module covers passive asset discovery using SPAN port mirroring, traffic inspection on ring topologies, and layer-two broadcast collection. You build an asset register template that captures device type, firmware, protocol, and zone assignment from captured traffic alone. The module also covers how to handle undocumented legacy equipment that appears in captures but has no corresponding entry in any client register.

Module 2. Zone and Conduit Architecture Under IEC 62443-3-2

IEC 62443-3-2 defines the process for partitioning OT networks into security zones and documenting conduit flows between them. This module walks through the zone partitioning decision tree, assigns initial target security levels, and produces the zone and conduit diagram that becomes the structural backbone of the assessment report. Includes a worked example using a multi-site manufacturing network with a central historian and remote OPC DA connections.

Module 3. Security Level Assessment and Capability Gap Documentation

SL-T (target), SL-A (achieved), and SL-C (capability) are different artefacts with different audiences. This module covers how to run a capability assessment for each zone, document the gap between SL-T and SL-A, and present findings in terms the control systems team can verify and the CISO can act on. Includes the assessment workbook and a gap-scoring rubric that holds up under second-party audit review.

Module 4. Network Segmentation Gaps and Remediation Framing

Flat OT networks, DMZ misconfigurations, and historian servers with dual-homed connections to the business network are the three most common findings on OT assessments. This module covers how to document each category, what evidence to capture, and how to frame the remediation recommendation so it reads as an operational risk decision rather than a compliance checkbox. Includes topology diagram templates and firewall rule analysis worksheets.

Module 5. NERC CIP Alignment for Energy Sector Clients

BES Cyber Asset classification, ESP boundary documentation, and mapping an IEC 62443 zone assessment to NERC CIP-005 and CIP-007 requirements unlock a specific client tier. This module covers the classification decision process, what constitutes an Electronic Security Perimeter under NERC standards, and how to produce dual-standard documentation that satisfies both the client's internal compliance team and the third-party auditor reviewing the submission.

Module 6. Passive Traffic Analysis and Protocol Anomaly Detection

A 72-hour SPAN capture on a live SCADA network produces more data than most teams know what to do with. This module covers what to look for in Modbus TCP, DNP3, and EtherNet/IP traffic: unauthorized master-slave communication, unexpected polling rates, and plaintext credential transmissions. Each finding category maps to a risk register entry template and an evidence package format that supports the final assessment deliverable.

Module 7. OT Risk Register Design and Operational Impact Framing

CVSS scores do not resonate with plant managers. This module builds a consequence-based OT risk matrix that frames every finding in terms of production loss, safety incident probability, or regulatory penalty exposure. The result is a risk register that plant leadership will prioritize and fund, operations managers will understand, and the CISO can use to make the business case for OT security investment to the board.

Module 8. The Dual-Audience OT Assessment Report

An OT assessment report has two readers: the CISO, who needs audit-grade documentation, and the plant manager, who needs to know what to authorize. This module covers report architecture, including an executive summary that names the top three operational risks without losing technical substance, a findings hierarchy that connects each gap to a consequence category, and appendices that hold technical detail without overloading the main findings section.

Module 9. Remediation Roadmap Sequencing for OT Environments

OT security remediations cannot be sequenced like IT patch cycles. Production windows, change freeze periods, and equipment vendor support constraints all shape what is achievable. This module covers a phased remediation structure: quick wins that reduce attack surface without a maintenance window, medium-cycle network changes requiring coordinated outage planning, and long-cycle hardware replacement projects requiring capital budgeting and vendor lead time management.

Module 10. Preparing OT Assessments for Second-Party and Regulatory Audit

When a client's insurance underwriter, a regulator, or an IEC 62443 certification body reviews your assessment, they look for specific evidence packages. This module covers what DNV, TUV, and energy regulators ask for, how to structure the documentation trail, and which gaps most commonly result in re-assessment requests. Includes an evidence checklist used as a pre-submission review step before handing the final assessment to the client.

Module 11. IT/OT Convergence Scoping and Handoff Artefacts

When a client's IT security team is handed OT responsibility during a convergence programme, the risk of IT methodology being applied to OT environments is immediate. This module covers how to scope the convergence engagement, what handoff artefacts the IT team needs before taking ownership, and how to write scope statements that explicitly exclude active scanning and IT-standard patch cycles from live OT assets.

Module 12. Building a Repeatable OT Engagement Methodology

This module synthesizes the course into a consulting methodology you own. Proposal templates, discovery interview guides scoped for OT environments, assessment workbooks pre-populated with zone and conduit schemas, and a pricing model for OT engagements based on site count and system complexity. The outcome is that the next OT engagement you scope and deliver runs from the artefacts built in this course, not from scratch each time.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

You are three days into a client site visit and the asset inventory is a spreadsheet from four years ago. Two thirds of the IP addresses do not resolve and nobody on site can account for the gap.

The risk register from the previous engagement was rejected by the plant manager because it ranked vulnerabilities by CVSS score and he could not connect a 9.8 to anything on the production floor.

The OT network has no DMZ between the historian and the business network. The IT team says they are working on it. You need to document the risk in a way that creates urgency without creating panic, in language both the CISO and the operations director will act on.

You are scoping a NERC CIP engagement and the client's OT security team does not know which assets qualify as BES Cyber Assets or where the Electronic Security Perimeter boundary sits under their current topology.

What you get with this course

12 structured modules covering the complete OT security assessment methodology from passive asset discovery through final deliverable.
Downloadable zone and conduit design worksheets ready for use in client engagements.
Consequence-based OT risk register template framed for dual audiences: operational impact language for plant leadership, audit-grade documentation for the CISO.
IEC 62443 security level assessment workbook with guidance for SL-T, SL-A, and SL-C for each zone.
NERC CIP alignment checklists covering BES Cyber Asset classification and ESP boundary documentation.
Dual-audience OT assessment report template with executive summary and technical findings sections.
Passive traffic analysis worksheet covering Modbus TCP, DNP3, and EtherNet/IP anomaly categories.
Hand-built implementation playbook delivered alongside course access.
Lifetime access to all module updates and additional templates.

What you will have in hand by Day 1, Week 1, Month 1

Course access provisioned within 24 hours of purchase.

Hand-built implementation playbook delivered alongside course access.

All module templates and worked examples available at first login.

Before and after

Before

You identify the gap and know the finding technically. The deliverable that connects the gap to an operational consequence, frames it as a priority the plant manager will fund, and holds up under audit review takes three times longer than it should and still gets questioned.

After

You run zone and conduit design, produce a consequence-based risk register, and deliver a dual-audience assessment report in a single engagement cycle. The CISO and the OT engineer read the same document. The client signs off.

What happens if you do not address this

Without an OT-specific deliverable methodology, every engagement reinvents the zone-conduit worksheet and every risk register gets questioned by someone who reads it as an IT audit. The gap between technical competence and consulting credibility limits the quality of OT assessment work and the complexity of engagements a consultant can lead independently.

Who it is for

Senior associates and consultants at professional services and advisory firms, working on OT security engagements for industrial clients across energy, manufacturing, oil and gas, and utilities. Typically three to six years into a cybersecurity career, with strong IT security fundamentals and growing OT exposure. The gap this course closes is between technical competence in OT environments and the deliverable methodology that makes assessment findings actionable for clients.

Who this is NOT for. IT security analysts who have not engaged with OT or industrial environments. Independent OT practitioners already running a mature assessment practice. SCADA engineers looking for control systems programming or operational technology training. Security architects designing greenfield OT networks from scratch rather than assessing and advising on existing client environments.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Four to six hours per module, structured to fit around active client engagements. Most consultants complete the core methodology modules over two to three weeks and continue with the advanced modules during a bench period or between client assignments.

Why $199 is the right number

Free frameworks (IEC 62443, NIST CSF) give you the vocabulary but no delivery methodology. Internal training at advisory firms teaches the firm's existing approach. This course gives you the methodology you build and own, applicable across any firm's delivery framework and any client's industrial sector.

FAQ

Does this cover NERC CIP specifically?

Yes. Module 5 is dedicated to NERC CIP alignment for energy sector clients, including BES Cyber Asset classification, ESP boundary documentation, and mapping IEC 62443 zone work to NERC CIP-005 and CIP-007 evidence requirements.

I come from an IT security background. Will I follow the OT content?

Yes. The course is designed for IT-trained professionals moving into OT security engagements. Module 1 explicitly bridges IT and OT mental models before the methodology modules begin, and all worked examples include the IT parallel for context.

Does this apply to oil and gas as well as power?

Yes. The zone and conduit methodology applies across all ICS environments. Examples in the course draw from energy, manufacturing, and water treatment to show how the IEC 62443 framework adapts across industrial sectors.

Is there live session support?

No live sessions. The hand-built implementation playbook is the personalised component and is delivered with course access. Any follow-up questions can be sent by reply to the course enrolment email.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.