OT Security Auditing for Critical Infrastructure
You're not just managing systems. You're guarding the lifelines of nations. Power grids, water treatment facilities, transportation networks - when cyber threats penetrate these environments, the consequences aren’t measured in downtime. They're measured in lives, national stability, and global trust. And yet, you’re under constant pressure: outdated protocols, siloed operations, vague compliance checklists, and an ever-evolving threat landscape. Your team lacks standardised auditing frameworks. Your leadership demands assurance, but you can’t provide proof. You’re stuck in reactive mode, waiting for the next incident to define your priorities. What if you could shift from guessing to governance? From reactive patching to proactive, repeatable, board-level risk assurance? The OT Security Auditing for Critical Infrastructure course is your definitive roadmap to audit with precision, authority, and measurable impact. This isn’t theoretical. One learner, a senior control system engineer at a national energy provider, used the audit methodology in Module 5 to identify a misconfigured firewall in a major substation network - a flaw third-party assessors had missed for two years. He led the remediation, documented compliance with NERC CIP, and presented findings to the CISO within 18 days. From unstructured vulnerability scanning to a formal, audit-ready OT security posture - this course delivers a complete, step-by-step system. You’ll complete a real-world audit project and walk away with a board-ready report, a fully documented audit trail, and formal recognition through a globally respected certification. Here’s how this course is structured to help you get there.Course Format & Delivery Details Designed for global engineering and security leaders working in high-stakes, time-constrained environments, this course removes every barrier to learning, implementation, and certification. No gimmicks. No hidden phases. Just a clear, trusted path from uncertainty to authority. Self-Paced, On-Demand Access
The course is self-paced, with immediate online access. There are no fixed dates, mandatory live sessions, or time commitments. You progress according to your operational calendar, revisiting complex sections as needed. Most learners complete the core curriculum in 8 to 12 weeks, with many applying the first audit framework to live systems within the first 10 days. Lifetime Access + Continuous Updates
You receive lifetime access to all course materials. As regulations evolve and new OT threats emerge, the content is updated with new modules, templates, and case studies - delivered automatically at no extra cost. This is not a one-time snapshot. It’s a living, evolving audit library you control forever. Mobile-Friendly, 24/7 Global Access
Whether you’re in a control room in Riyadh, monitoring a pipeline in Alberta, or supporting a post-incident assessment in Berlin, your learning ecosystem travels with you. All materials are mobile-optimized, fully downloadable, and accessible offline when needed. You own your progress, on any device, without dependency on connectivity. Instructor Support & Expert Guidance
You’re not navigating alone. All enrolled learners receive direct, asynchronous access to our team of certified OT security auditors. Submit technical questions, request review of audit plans, or get clarification on regulatory mappings. Responses are provided within 48 business hours, ensuring you maintain momentum without interruption. Certificate of Completion from The Art of Service
Upon successful completion, you’ll receive a formal Certificate of Completion issued by The Art of Service. Recognized across 70+ countries, this credential validates your mastery of OT-specific audit frameworks, compliance alignment, and risk-based assessment practices. It is shareable on LinkedIn, included in professional portfolios, and increasingly referenced in engineering and security leadership hiring criteria. Transparent Pricing, No Hidden Fees
The course fee includes full access, lifetime updates, the final audit project evaluation, and certification. There are no recurring charges, no upsells, and no additional costs for support, downloads, or materials. What you see is what you get - one clear investment, with no fine print. Accepted Payment Methods
We accept Visa, Mastercard, and PayPal. Payments are processed securely, with encrypted transaction handling and full audit trails for corporate reimbursement. 100% Satisfied or Refunded Guarantee
We eliminate risk with a 30-day money-back guarantee. If you find the course does not meet your expectations, simply request a refund. No forms. No excuses. No risk. Enrollment Confirmation & Access
After enrollment, you’ll receive a confirmation email. Access instructions and course login details are sent separately once your account is fully provisioned. This ensures secure, controlled access to all materials. This Works Even If…
You're new to auditing. You work in a highly regulated environment with strict change control. Your team resists documentation. Your organisation confuses IT and OT security. Your leadership only speaks risk and ROI - and you need to prove value. Our learners include process engineers transitioning into security roles, compliance officers with limited OT experience, and mid-level IT security leads embedded in industrial plants. Every module is built to close knowledge gaps, leverage existing operational knowledge, and empower you to audit with confidence using proven, repeatable methods. You’ll gain immediate credibility through structured workflows, standardised reporting formats, and audit templates that align with ISA/IEC 62443, NERC CIP, NIST SP 800-82, and other global frameworks. The question isn’t “Will this work for me?” It’s “When will I start auditing like a certified professional?”
Module 1: Foundations of OT Security Auditing - Differences between IT and OT security paradigms
- Why traditional IT audit frameworks fail in OT environments
- Core principles of safety, availability, integrity, and confidentiality in critical infrastructure
- Understanding the operational hierarchy: Level 0 to Level 3
- Common asset types in OT: PLCs, RTUs, DCS, SCADA, HMIs, engineering workstations
- Primary threats to OT: sabotage, espionage, ransomware, insider risk
- Historical OT security incidents and their audit implications
- The role of the auditor in risk-based decision making
- Boundaries of responsibility: IT vs OT vs third-party vendors
- Establishing auditor authority and access protocols
- Defining audit scope and objectives for critical infrastructure
- Recognizing high-risk zones and single points of failure
- Introduction to OT-specific threat actors and attack vectors
- Understanding availability as the primary security pillar in OT
- Impact assessment: from process disruption to environmental and safety risks
- Key performance indicators for OT audit readiness
- How to document asset inventory with technical and functional context
- Identifying critical processes and their dependencies
- Mapping logical and physical network zones
- Creating an audit initiation checklist
Module 2: Audit Frameworks and Regulatory Compliance - Overview of ISA/IEC 62443: Parts 1-1, 1-2, 2-1, 3-2, 3-3
- Mapping audit requirements to ISA 62443 security levels (SL-C and SL-D)
- Implementing the Purdue Model for zoning and conduit design
- NERC CIP v5 and v6: mandatory compliance for North American bulk electric systems
- NIST SP 800-82: Guide to Industrial Control System Security
- EU NIS2 Directive: implications for OT audit scope and reporting
- TSA security directives for pipelines and rail systems
- Aligning audit findings with ISO 27001 and ISO 27002 for hybrid environments
- AUDIT-443: A purpose-built OT auditing framework from The Art of Service
- How to select the right framework based on sector and jurisdiction
- Building a consolidated compliance matrix across multiple standards
- Translating technical findings into executive-level summaries
- Reporting to regulators, boards, and operational leadership
- Documentation standards for defensible audit outcomes
- Version control and retention policies for audit evidence
- Using control objectives to structure audit workpapers
- Risk-based prioritization of controls and findings
- Defining acceptable versus unacceptable control gaps
- How to link non-compliance to real-world incident scenarios
- Integrating safety system requirements into security audits
Module 3: Pre-Audit Planning and Scoping - Defining audit goals: compliance, operational resilience, or incident preparedness
- Developing an OT audit charter with stakeholder sign-off
- Identifying in-scope assets, zones, and systems
- Exclusion criteria: legacy systems, test environments, third-party responsibilities
- Conducting pre-audit stakeholder interviews
- Creating system narratives for each critical process
- Gathering existing documentation: P&IDs, network diagrams, asset lists
- Validating diagram accuracy with operational staff
- Establishing data collection timelines and change windows
- Designing audit sampling strategies for large environments
- Creating system-specific risk profiles
- Developing audit questionnaires for engineering and operations teams
- Preparing access requirements: physical, logical, and administrative
- Coordinating with operations to minimise production impact
- Building a risk-adjusted audit schedule
- Preparing for unplanned outages or system changes
- Legal and confidentiality agreements for audit participants
- Defining escalation paths for critical vulnerabilities
- How to secure executive sponsorship for audit authority
- Creating a pre-audit readiness checklist
Module 4: Data Collection and Asset Verification - Passive vs active data collection in OT environments
- Safe methods for network enumeration without disrupting operations
- Using packet capture tools ethically and within change control
- Verifying asset inventory against operational records
- Identifying unauthorised or undocumented devices
- Validating hardware versions, firmware, and patch levels
- Documenting host configurations using remote read-only protocols
- Extracting HMI display lists and user roles from engineering tools
- Reviewing serial connection logs and modem usage
- Assessing engineering workstation configurations
- Checking for presence of removable media policies
- Validating backup and recovery configurations
- Documenting user access lists and role assignments
- Reviewing group policy and domain integration points
- Identifying shadow IT and unapproved software installations
- How to document wireless OT networks (Wi-Fi, radio telemetry, Bluetooth)
- Validating vendor remote access methods
- Checking firewall rule sets and filtering policies
- Assessing configuration management databases for accuracy
- Creating attribute-rich asset registers with risk tags
Module 5: Network Architecture and Segmentation Audit - Validating implementation of the Purdue Model
- Assessing zone boundaries and interconnectivity
- Identifying unauthorised cross-zone communications
- Validating use of firewalls, DMZs, and data diodes
- Testing effectiveness of access control lists
- Checking for legacy protocols crossing unsecured conduits
- Assessing use of flat networks in Level 2 and Level 1 systems
- Validating restricted use of Internet-facing HMIs
- Identifying bypasses and backdoor connections
- Reviewing network segmentation during maintenance windows
- Assessing VLAN configurations and switch port security
- Validating patch panel access controls
- Testing for VLAN hopping and STP manipulation risks
- Assessing physical network access points
- Reviewing network resiliency and redundancy designs
- Evaluating single points of network failure
- Checking for proper cable labeling and documentation
- Assessing wireless network encryption and authentication
- Validating use of secure tunneling protocols (IPsec, SSH)
- Documenting network traffic flows with sequence diagrams
Module 6: Access Control and Identity Management Audit - Validating least privilege implementation on OT systems
- Reviewing user account lifecycle management
- Checking for shared or generic accounts in control systems
- Assessing password complexity and change policies
- Verifying multi-factor authentication for critical access
- Reviewing remote access policies and session logging
- Validating separation of duties between engineers and operators
- Assessing vendor access controls and time-limited credentials
- Checking for default or hardcoded credentials
- Reviewing console access: physical and logical
- Documenting engineering mode and override access
- Validating break-glass procedures and emergency access
- Assessing identity federation in hybrid IT/OT environments
- Reviewing role-based access control in SCADA and DCS
- Checking for orphaned accounts after staff changes
- Validating audit trail capture for access attempts
- Assessing lockout policies for failed logins
- Reviewing session timeout configurations
- Testing account deprovisioning workflows
- Documenting privileged access reviews and attestation logs
Module 7: Change and Configuration Management Audit - Reviewing change control process maturity
- Validating pre-approval, testing, and rollback procedures
- Assessing off-hour change window compliance
- Reviewing documentation of software and firmware changes
- Checking for unapproved configuration modifications
- Validating backup procedures before changes
- Reviewing engineering change order (ECO) workflows
- Assessing version control in control logic
- Verifying use of staging environments for updates
- Checking for undocumented emergency changes
- Reviewing vendor-led change procedures
- Assessing emergency change logging and post-review
- Validating backup of Ladder Logic and control programs
- Reviewing rollback readiness and recovery time objectives
- Assessing patch management for OT systems
- Checking for operating system and software end-of-life
- Reviewing use of antivirus and anti-malware in OT
- Validating standard build templates for workstations
- Assessing CMDB integration with operations
- Documenting configuration drift analysis techniques
Module 8: Monitoring, Logging, and Anomaly Detection Audit - Assessing presence of centralised logging in OT
- Validating log content: timestamps, sources, event types
- Checking retention periods and storage security
- Reviewing availability of login, configuration, and access logs
- Assessing ability to correlate logs across systems
- Validating integrity of logs against tampering
- Checking for monitoring of failed login attempts
- Reviewing use of network-based detection systems (IDS/IPS)
- Assessing passive monitoring tools in OT contexts
- Validating alarm system integrity and response workflows
- Reviewing use of SIEM integration with OT
- Checking for misuse of operator acknowledgement features
- Assessing real-time notifications for critical events
- Validating monitoring of engineering workstation activity
- Reviewing anomaly detection using baseline traffic patterns
- Assessing physical security system integration
- Checking for tamper-proof seals and audit trails
- Reviewing video surveillance access logs
- Validating testing of monitoring controls
- Documenting gap analysis for log coverage
Module 9: Incident Response and Disaster Recovery Audit - Reviewing OT-specific incident response plan
- Validating integration with corporate IR teams
- Assessing readiness of OT personnel for cyber incidents
- Checking for documented communication chains
- Reviewing isolation and containment procedures
- Validating safe shutdown and fail-safe operation
- Assessing backup restoration procedures for control systems
- Reviewing availability of offline backups
- Validating testing frequency of disaster recovery plans
- Checking for dependencies on IT systems during recovery
- Reviewing lessons learned from past incidents
- Assessing coordination with first responders
- Validating physical recovery location readiness
- Reviewing alternate control methods (manual override)
- Checking fuel, power, and environmental backups
- Assessing cyber-physical failover testing
- Reviewing regulatory reporting obligations
- Validating evidence preservation procedures
- Assessing post-incident review workflows
- Documenting tabletop exercise records
Module 10: Physical Security and Environmental Controls Audit - Assessing access controls to control rooms and cabinets
- Validating use of badging, biometrics, and visitor logs
- Reviewing camera coverage and retention policies
- Checking for intrusion detection on cabinets and panels
- Assessing locking mechanisms and key management
- Validating environmental monitoring: temp, humidity, airflow
- Reviewing fire suppression systems and testing records
- Assessing power redundancy and UPS performance
- Checking for water and flood detection sensors
- Validating conduit and cable protection
- Reviewing protection of wireless access points
- Assessing site perimeter controls
- Checking for tamper-evident seals on critical devices
- Validating secure storage of backup media
- Reviewing off-site storage conditions
- Assessing vendor escort policies
- Validating training for physical security procedures
- Reviewing third-party maintenance access logs
- Assessing drone and aerial surveillance risks
- Documenting supply chain physical security
Module 11: Third-Party and Vendor Risk Audit - Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Differences between IT and OT security paradigms
- Why traditional IT audit frameworks fail in OT environments
- Core principles of safety, availability, integrity, and confidentiality in critical infrastructure
- Understanding the operational hierarchy: Level 0 to Level 3
- Common asset types in OT: PLCs, RTUs, DCS, SCADA, HMIs, engineering workstations
- Primary threats to OT: sabotage, espionage, ransomware, insider risk
- Historical OT security incidents and their audit implications
- The role of the auditor in risk-based decision making
- Boundaries of responsibility: IT vs OT vs third-party vendors
- Establishing auditor authority and access protocols
- Defining audit scope and objectives for critical infrastructure
- Recognizing high-risk zones and single points of failure
- Introduction to OT-specific threat actors and attack vectors
- Understanding availability as the primary security pillar in OT
- Impact assessment: from process disruption to environmental and safety risks
- Key performance indicators for OT audit readiness
- How to document asset inventory with technical and functional context
- Identifying critical processes and their dependencies
- Mapping logical and physical network zones
- Creating an audit initiation checklist
Module 2: Audit Frameworks and Regulatory Compliance - Overview of ISA/IEC 62443: Parts 1-1, 1-2, 2-1, 3-2, 3-3
- Mapping audit requirements to ISA 62443 security levels (SL-C and SL-D)
- Implementing the Purdue Model for zoning and conduit design
- NERC CIP v5 and v6: mandatory compliance for North American bulk electric systems
- NIST SP 800-82: Guide to Industrial Control System Security
- EU NIS2 Directive: implications for OT audit scope and reporting
- TSA security directives for pipelines and rail systems
- Aligning audit findings with ISO 27001 and ISO 27002 for hybrid environments
- AUDIT-443: A purpose-built OT auditing framework from The Art of Service
- How to select the right framework based on sector and jurisdiction
- Building a consolidated compliance matrix across multiple standards
- Translating technical findings into executive-level summaries
- Reporting to regulators, boards, and operational leadership
- Documentation standards for defensible audit outcomes
- Version control and retention policies for audit evidence
- Using control objectives to structure audit workpapers
- Risk-based prioritization of controls and findings
- Defining acceptable versus unacceptable control gaps
- How to link non-compliance to real-world incident scenarios
- Integrating safety system requirements into security audits
Module 3: Pre-Audit Planning and Scoping - Defining audit goals: compliance, operational resilience, or incident preparedness
- Developing an OT audit charter with stakeholder sign-off
- Identifying in-scope assets, zones, and systems
- Exclusion criteria: legacy systems, test environments, third-party responsibilities
- Conducting pre-audit stakeholder interviews
- Creating system narratives for each critical process
- Gathering existing documentation: P&IDs, network diagrams, asset lists
- Validating diagram accuracy with operational staff
- Establishing data collection timelines and change windows
- Designing audit sampling strategies for large environments
- Creating system-specific risk profiles
- Developing audit questionnaires for engineering and operations teams
- Preparing access requirements: physical, logical, and administrative
- Coordinating with operations to minimise production impact
- Building a risk-adjusted audit schedule
- Preparing for unplanned outages or system changes
- Legal and confidentiality agreements for audit participants
- Defining escalation paths for critical vulnerabilities
- How to secure executive sponsorship for audit authority
- Creating a pre-audit readiness checklist
Module 4: Data Collection and Asset Verification - Passive vs active data collection in OT environments
- Safe methods for network enumeration without disrupting operations
- Using packet capture tools ethically and within change control
- Verifying asset inventory against operational records
- Identifying unauthorised or undocumented devices
- Validating hardware versions, firmware, and patch levels
- Documenting host configurations using remote read-only protocols
- Extracting HMI display lists and user roles from engineering tools
- Reviewing serial connection logs and modem usage
- Assessing engineering workstation configurations
- Checking for presence of removable media policies
- Validating backup and recovery configurations
- Documenting user access lists and role assignments
- Reviewing group policy and domain integration points
- Identifying shadow IT and unapproved software installations
- How to document wireless OT networks (Wi-Fi, radio telemetry, Bluetooth)
- Validating vendor remote access methods
- Checking firewall rule sets and filtering policies
- Assessing configuration management databases for accuracy
- Creating attribute-rich asset registers with risk tags
Module 5: Network Architecture and Segmentation Audit - Validating implementation of the Purdue Model
- Assessing zone boundaries and interconnectivity
- Identifying unauthorised cross-zone communications
- Validating use of firewalls, DMZs, and data diodes
- Testing effectiveness of access control lists
- Checking for legacy protocols crossing unsecured conduits
- Assessing use of flat networks in Level 2 and Level 1 systems
- Validating restricted use of Internet-facing HMIs
- Identifying bypasses and backdoor connections
- Reviewing network segmentation during maintenance windows
- Assessing VLAN configurations and switch port security
- Validating patch panel access controls
- Testing for VLAN hopping and STP manipulation risks
- Assessing physical network access points
- Reviewing network resiliency and redundancy designs
- Evaluating single points of network failure
- Checking for proper cable labeling and documentation
- Assessing wireless network encryption and authentication
- Validating use of secure tunneling protocols (IPsec, SSH)
- Documenting network traffic flows with sequence diagrams
Module 6: Access Control and Identity Management Audit - Validating least privilege implementation on OT systems
- Reviewing user account lifecycle management
- Checking for shared or generic accounts in control systems
- Assessing password complexity and change policies
- Verifying multi-factor authentication for critical access
- Reviewing remote access policies and session logging
- Validating separation of duties between engineers and operators
- Assessing vendor access controls and time-limited credentials
- Checking for default or hardcoded credentials
- Reviewing console access: physical and logical
- Documenting engineering mode and override access
- Validating break-glass procedures and emergency access
- Assessing identity federation in hybrid IT/OT environments
- Reviewing role-based access control in SCADA and DCS
- Checking for orphaned accounts after staff changes
- Validating audit trail capture for access attempts
- Assessing lockout policies for failed logins
- Reviewing session timeout configurations
- Testing account deprovisioning workflows
- Documenting privileged access reviews and attestation logs
Module 7: Change and Configuration Management Audit - Reviewing change control process maturity
- Validating pre-approval, testing, and rollback procedures
- Assessing off-hour change window compliance
- Reviewing documentation of software and firmware changes
- Checking for unapproved configuration modifications
- Validating backup procedures before changes
- Reviewing engineering change order (ECO) workflows
- Assessing version control in control logic
- Verifying use of staging environments for updates
- Checking for undocumented emergency changes
- Reviewing vendor-led change procedures
- Assessing emergency change logging and post-review
- Validating backup of Ladder Logic and control programs
- Reviewing rollback readiness and recovery time objectives
- Assessing patch management for OT systems
- Checking for operating system and software end-of-life
- Reviewing use of antivirus and anti-malware in OT
- Validating standard build templates for workstations
- Assessing CMDB integration with operations
- Documenting configuration drift analysis techniques
Module 8: Monitoring, Logging, and Anomaly Detection Audit - Assessing presence of centralised logging in OT
- Validating log content: timestamps, sources, event types
- Checking retention periods and storage security
- Reviewing availability of login, configuration, and access logs
- Assessing ability to correlate logs across systems
- Validating integrity of logs against tampering
- Checking for monitoring of failed login attempts
- Reviewing use of network-based detection systems (IDS/IPS)
- Assessing passive monitoring tools in OT contexts
- Validating alarm system integrity and response workflows
- Reviewing use of SIEM integration with OT
- Checking for misuse of operator acknowledgement features
- Assessing real-time notifications for critical events
- Validating monitoring of engineering workstation activity
- Reviewing anomaly detection using baseline traffic patterns
- Assessing physical security system integration
- Checking for tamper-proof seals and audit trails
- Reviewing video surveillance access logs
- Validating testing of monitoring controls
- Documenting gap analysis for log coverage
Module 9: Incident Response and Disaster Recovery Audit - Reviewing OT-specific incident response plan
- Validating integration with corporate IR teams
- Assessing readiness of OT personnel for cyber incidents
- Checking for documented communication chains
- Reviewing isolation and containment procedures
- Validating safe shutdown and fail-safe operation
- Assessing backup restoration procedures for control systems
- Reviewing availability of offline backups
- Validating testing frequency of disaster recovery plans
- Checking for dependencies on IT systems during recovery
- Reviewing lessons learned from past incidents
- Assessing coordination with first responders
- Validating physical recovery location readiness
- Reviewing alternate control methods (manual override)
- Checking fuel, power, and environmental backups
- Assessing cyber-physical failover testing
- Reviewing regulatory reporting obligations
- Validating evidence preservation procedures
- Assessing post-incident review workflows
- Documenting tabletop exercise records
Module 10: Physical Security and Environmental Controls Audit - Assessing access controls to control rooms and cabinets
- Validating use of badging, biometrics, and visitor logs
- Reviewing camera coverage and retention policies
- Checking for intrusion detection on cabinets and panels
- Assessing locking mechanisms and key management
- Validating environmental monitoring: temp, humidity, airflow
- Reviewing fire suppression systems and testing records
- Assessing power redundancy and UPS performance
- Checking for water and flood detection sensors
- Validating conduit and cable protection
- Reviewing protection of wireless access points
- Assessing site perimeter controls
- Checking for tamper-evident seals on critical devices
- Validating secure storage of backup media
- Reviewing off-site storage conditions
- Assessing vendor escort policies
- Validating training for physical security procedures
- Reviewing third-party maintenance access logs
- Assessing drone and aerial surveillance risks
- Documenting supply chain physical security
Module 11: Third-Party and Vendor Risk Audit - Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Defining audit goals: compliance, operational resilience, or incident preparedness
- Developing an OT audit charter with stakeholder sign-off
- Identifying in-scope assets, zones, and systems
- Exclusion criteria: legacy systems, test environments, third-party responsibilities
- Conducting pre-audit stakeholder interviews
- Creating system narratives for each critical process
- Gathering existing documentation: P&IDs, network diagrams, asset lists
- Validating diagram accuracy with operational staff
- Establishing data collection timelines and change windows
- Designing audit sampling strategies for large environments
- Creating system-specific risk profiles
- Developing audit questionnaires for engineering and operations teams
- Preparing access requirements: physical, logical, and administrative
- Coordinating with operations to minimise production impact
- Building a risk-adjusted audit schedule
- Preparing for unplanned outages or system changes
- Legal and confidentiality agreements for audit participants
- Defining escalation paths for critical vulnerabilities
- How to secure executive sponsorship for audit authority
- Creating a pre-audit readiness checklist
Module 4: Data Collection and Asset Verification - Passive vs active data collection in OT environments
- Safe methods for network enumeration without disrupting operations
- Using packet capture tools ethically and within change control
- Verifying asset inventory against operational records
- Identifying unauthorised or undocumented devices
- Validating hardware versions, firmware, and patch levels
- Documenting host configurations using remote read-only protocols
- Extracting HMI display lists and user roles from engineering tools
- Reviewing serial connection logs and modem usage
- Assessing engineering workstation configurations
- Checking for presence of removable media policies
- Validating backup and recovery configurations
- Documenting user access lists and role assignments
- Reviewing group policy and domain integration points
- Identifying shadow IT and unapproved software installations
- How to document wireless OT networks (Wi-Fi, radio telemetry, Bluetooth)
- Validating vendor remote access methods
- Checking firewall rule sets and filtering policies
- Assessing configuration management databases for accuracy
- Creating attribute-rich asset registers with risk tags
Module 5: Network Architecture and Segmentation Audit - Validating implementation of the Purdue Model
- Assessing zone boundaries and interconnectivity
- Identifying unauthorised cross-zone communications
- Validating use of firewalls, DMZs, and data diodes
- Testing effectiveness of access control lists
- Checking for legacy protocols crossing unsecured conduits
- Assessing use of flat networks in Level 2 and Level 1 systems
- Validating restricted use of Internet-facing HMIs
- Identifying bypasses and backdoor connections
- Reviewing network segmentation during maintenance windows
- Assessing VLAN configurations and switch port security
- Validating patch panel access controls
- Testing for VLAN hopping and STP manipulation risks
- Assessing physical network access points
- Reviewing network resiliency and redundancy designs
- Evaluating single points of network failure
- Checking for proper cable labeling and documentation
- Assessing wireless network encryption and authentication
- Validating use of secure tunneling protocols (IPsec, SSH)
- Documenting network traffic flows with sequence diagrams
Module 6: Access Control and Identity Management Audit - Validating least privilege implementation on OT systems
- Reviewing user account lifecycle management
- Checking for shared or generic accounts in control systems
- Assessing password complexity and change policies
- Verifying multi-factor authentication for critical access
- Reviewing remote access policies and session logging
- Validating separation of duties between engineers and operators
- Assessing vendor access controls and time-limited credentials
- Checking for default or hardcoded credentials
- Reviewing console access: physical and logical
- Documenting engineering mode and override access
- Validating break-glass procedures and emergency access
- Assessing identity federation in hybrid IT/OT environments
- Reviewing role-based access control in SCADA and DCS
- Checking for orphaned accounts after staff changes
- Validating audit trail capture for access attempts
- Assessing lockout policies for failed logins
- Reviewing session timeout configurations
- Testing account deprovisioning workflows
- Documenting privileged access reviews and attestation logs
Module 7: Change and Configuration Management Audit - Reviewing change control process maturity
- Validating pre-approval, testing, and rollback procedures
- Assessing off-hour change window compliance
- Reviewing documentation of software and firmware changes
- Checking for unapproved configuration modifications
- Validating backup procedures before changes
- Reviewing engineering change order (ECO) workflows
- Assessing version control in control logic
- Verifying use of staging environments for updates
- Checking for undocumented emergency changes
- Reviewing vendor-led change procedures
- Assessing emergency change logging and post-review
- Validating backup of Ladder Logic and control programs
- Reviewing rollback readiness and recovery time objectives
- Assessing patch management for OT systems
- Checking for operating system and software end-of-life
- Reviewing use of antivirus and anti-malware in OT
- Validating standard build templates for workstations
- Assessing CMDB integration with operations
- Documenting configuration drift analysis techniques
Module 8: Monitoring, Logging, and Anomaly Detection Audit - Assessing presence of centralised logging in OT
- Validating log content: timestamps, sources, event types
- Checking retention periods and storage security
- Reviewing availability of login, configuration, and access logs
- Assessing ability to correlate logs across systems
- Validating integrity of logs against tampering
- Checking for monitoring of failed login attempts
- Reviewing use of network-based detection systems (IDS/IPS)
- Assessing passive monitoring tools in OT contexts
- Validating alarm system integrity and response workflows
- Reviewing use of SIEM integration with OT
- Checking for misuse of operator acknowledgement features
- Assessing real-time notifications for critical events
- Validating monitoring of engineering workstation activity
- Reviewing anomaly detection using baseline traffic patterns
- Assessing physical security system integration
- Checking for tamper-proof seals and audit trails
- Reviewing video surveillance access logs
- Validating testing of monitoring controls
- Documenting gap analysis for log coverage
Module 9: Incident Response and Disaster Recovery Audit - Reviewing OT-specific incident response plan
- Validating integration with corporate IR teams
- Assessing readiness of OT personnel for cyber incidents
- Checking for documented communication chains
- Reviewing isolation and containment procedures
- Validating safe shutdown and fail-safe operation
- Assessing backup restoration procedures for control systems
- Reviewing availability of offline backups
- Validating testing frequency of disaster recovery plans
- Checking for dependencies on IT systems during recovery
- Reviewing lessons learned from past incidents
- Assessing coordination with first responders
- Validating physical recovery location readiness
- Reviewing alternate control methods (manual override)
- Checking fuel, power, and environmental backups
- Assessing cyber-physical failover testing
- Reviewing regulatory reporting obligations
- Validating evidence preservation procedures
- Assessing post-incident review workflows
- Documenting tabletop exercise records
Module 10: Physical Security and Environmental Controls Audit - Assessing access controls to control rooms and cabinets
- Validating use of badging, biometrics, and visitor logs
- Reviewing camera coverage and retention policies
- Checking for intrusion detection on cabinets and panels
- Assessing locking mechanisms and key management
- Validating environmental monitoring: temp, humidity, airflow
- Reviewing fire suppression systems and testing records
- Assessing power redundancy and UPS performance
- Checking for water and flood detection sensors
- Validating conduit and cable protection
- Reviewing protection of wireless access points
- Assessing site perimeter controls
- Checking for tamper-evident seals on critical devices
- Validating secure storage of backup media
- Reviewing off-site storage conditions
- Assessing vendor escort policies
- Validating training for physical security procedures
- Reviewing third-party maintenance access logs
- Assessing drone and aerial surveillance risks
- Documenting supply chain physical security
Module 11: Third-Party and Vendor Risk Audit - Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Validating implementation of the Purdue Model
- Assessing zone boundaries and interconnectivity
- Identifying unauthorised cross-zone communications
- Validating use of firewalls, DMZs, and data diodes
- Testing effectiveness of access control lists
- Checking for legacy protocols crossing unsecured conduits
- Assessing use of flat networks in Level 2 and Level 1 systems
- Validating restricted use of Internet-facing HMIs
- Identifying bypasses and backdoor connections
- Reviewing network segmentation during maintenance windows
- Assessing VLAN configurations and switch port security
- Validating patch panel access controls
- Testing for VLAN hopping and STP manipulation risks
- Assessing physical network access points
- Reviewing network resiliency and redundancy designs
- Evaluating single points of network failure
- Checking for proper cable labeling and documentation
- Assessing wireless network encryption and authentication
- Validating use of secure tunneling protocols (IPsec, SSH)
- Documenting network traffic flows with sequence diagrams
Module 6: Access Control and Identity Management Audit - Validating least privilege implementation on OT systems
- Reviewing user account lifecycle management
- Checking for shared or generic accounts in control systems
- Assessing password complexity and change policies
- Verifying multi-factor authentication for critical access
- Reviewing remote access policies and session logging
- Validating separation of duties between engineers and operators
- Assessing vendor access controls and time-limited credentials
- Checking for default or hardcoded credentials
- Reviewing console access: physical and logical
- Documenting engineering mode and override access
- Validating break-glass procedures and emergency access
- Assessing identity federation in hybrid IT/OT environments
- Reviewing role-based access control in SCADA and DCS
- Checking for orphaned accounts after staff changes
- Validating audit trail capture for access attempts
- Assessing lockout policies for failed logins
- Reviewing session timeout configurations
- Testing account deprovisioning workflows
- Documenting privileged access reviews and attestation logs
Module 7: Change and Configuration Management Audit - Reviewing change control process maturity
- Validating pre-approval, testing, and rollback procedures
- Assessing off-hour change window compliance
- Reviewing documentation of software and firmware changes
- Checking for unapproved configuration modifications
- Validating backup procedures before changes
- Reviewing engineering change order (ECO) workflows
- Assessing version control in control logic
- Verifying use of staging environments for updates
- Checking for undocumented emergency changes
- Reviewing vendor-led change procedures
- Assessing emergency change logging and post-review
- Validating backup of Ladder Logic and control programs
- Reviewing rollback readiness and recovery time objectives
- Assessing patch management for OT systems
- Checking for operating system and software end-of-life
- Reviewing use of antivirus and anti-malware in OT
- Validating standard build templates for workstations
- Assessing CMDB integration with operations
- Documenting configuration drift analysis techniques
Module 8: Monitoring, Logging, and Anomaly Detection Audit - Assessing presence of centralised logging in OT
- Validating log content: timestamps, sources, event types
- Checking retention periods and storage security
- Reviewing availability of login, configuration, and access logs
- Assessing ability to correlate logs across systems
- Validating integrity of logs against tampering
- Checking for monitoring of failed login attempts
- Reviewing use of network-based detection systems (IDS/IPS)
- Assessing passive monitoring tools in OT contexts
- Validating alarm system integrity and response workflows
- Reviewing use of SIEM integration with OT
- Checking for misuse of operator acknowledgement features
- Assessing real-time notifications for critical events
- Validating monitoring of engineering workstation activity
- Reviewing anomaly detection using baseline traffic patterns
- Assessing physical security system integration
- Checking for tamper-proof seals and audit trails
- Reviewing video surveillance access logs
- Validating testing of monitoring controls
- Documenting gap analysis for log coverage
Module 9: Incident Response and Disaster Recovery Audit - Reviewing OT-specific incident response plan
- Validating integration with corporate IR teams
- Assessing readiness of OT personnel for cyber incidents
- Checking for documented communication chains
- Reviewing isolation and containment procedures
- Validating safe shutdown and fail-safe operation
- Assessing backup restoration procedures for control systems
- Reviewing availability of offline backups
- Validating testing frequency of disaster recovery plans
- Checking for dependencies on IT systems during recovery
- Reviewing lessons learned from past incidents
- Assessing coordination with first responders
- Validating physical recovery location readiness
- Reviewing alternate control methods (manual override)
- Checking fuel, power, and environmental backups
- Assessing cyber-physical failover testing
- Reviewing regulatory reporting obligations
- Validating evidence preservation procedures
- Assessing post-incident review workflows
- Documenting tabletop exercise records
Module 10: Physical Security and Environmental Controls Audit - Assessing access controls to control rooms and cabinets
- Validating use of badging, biometrics, and visitor logs
- Reviewing camera coverage and retention policies
- Checking for intrusion detection on cabinets and panels
- Assessing locking mechanisms and key management
- Validating environmental monitoring: temp, humidity, airflow
- Reviewing fire suppression systems and testing records
- Assessing power redundancy and UPS performance
- Checking for water and flood detection sensors
- Validating conduit and cable protection
- Reviewing protection of wireless access points
- Assessing site perimeter controls
- Checking for tamper-evident seals on critical devices
- Validating secure storage of backup media
- Reviewing off-site storage conditions
- Assessing vendor escort policies
- Validating training for physical security procedures
- Reviewing third-party maintenance access logs
- Assessing drone and aerial surveillance risks
- Documenting supply chain physical security
Module 11: Third-Party and Vendor Risk Audit - Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Reviewing change control process maturity
- Validating pre-approval, testing, and rollback procedures
- Assessing off-hour change window compliance
- Reviewing documentation of software and firmware changes
- Checking for unapproved configuration modifications
- Validating backup procedures before changes
- Reviewing engineering change order (ECO) workflows
- Assessing version control in control logic
- Verifying use of staging environments for updates
- Checking for undocumented emergency changes
- Reviewing vendor-led change procedures
- Assessing emergency change logging and post-review
- Validating backup of Ladder Logic and control programs
- Reviewing rollback readiness and recovery time objectives
- Assessing patch management for OT systems
- Checking for operating system and software end-of-life
- Reviewing use of antivirus and anti-malware in OT
- Validating standard build templates for workstations
- Assessing CMDB integration with operations
- Documenting configuration drift analysis techniques
Module 8: Monitoring, Logging, and Anomaly Detection Audit - Assessing presence of centralised logging in OT
- Validating log content: timestamps, sources, event types
- Checking retention periods and storage security
- Reviewing availability of login, configuration, and access logs
- Assessing ability to correlate logs across systems
- Validating integrity of logs against tampering
- Checking for monitoring of failed login attempts
- Reviewing use of network-based detection systems (IDS/IPS)
- Assessing passive monitoring tools in OT contexts
- Validating alarm system integrity and response workflows
- Reviewing use of SIEM integration with OT
- Checking for misuse of operator acknowledgement features
- Assessing real-time notifications for critical events
- Validating monitoring of engineering workstation activity
- Reviewing anomaly detection using baseline traffic patterns
- Assessing physical security system integration
- Checking for tamper-proof seals and audit trails
- Reviewing video surveillance access logs
- Validating testing of monitoring controls
- Documenting gap analysis for log coverage
Module 9: Incident Response and Disaster Recovery Audit - Reviewing OT-specific incident response plan
- Validating integration with corporate IR teams
- Assessing readiness of OT personnel for cyber incidents
- Checking for documented communication chains
- Reviewing isolation and containment procedures
- Validating safe shutdown and fail-safe operation
- Assessing backup restoration procedures for control systems
- Reviewing availability of offline backups
- Validating testing frequency of disaster recovery plans
- Checking for dependencies on IT systems during recovery
- Reviewing lessons learned from past incidents
- Assessing coordination with first responders
- Validating physical recovery location readiness
- Reviewing alternate control methods (manual override)
- Checking fuel, power, and environmental backups
- Assessing cyber-physical failover testing
- Reviewing regulatory reporting obligations
- Validating evidence preservation procedures
- Assessing post-incident review workflows
- Documenting tabletop exercise records
Module 10: Physical Security and Environmental Controls Audit - Assessing access controls to control rooms and cabinets
- Validating use of badging, biometrics, and visitor logs
- Reviewing camera coverage and retention policies
- Checking for intrusion detection on cabinets and panels
- Assessing locking mechanisms and key management
- Validating environmental monitoring: temp, humidity, airflow
- Reviewing fire suppression systems and testing records
- Assessing power redundancy and UPS performance
- Checking for water and flood detection sensors
- Validating conduit and cable protection
- Reviewing protection of wireless access points
- Assessing site perimeter controls
- Checking for tamper-evident seals on critical devices
- Validating secure storage of backup media
- Reviewing off-site storage conditions
- Assessing vendor escort policies
- Validating training for physical security procedures
- Reviewing third-party maintenance access logs
- Assessing drone and aerial surveillance risks
- Documenting supply chain physical security
Module 11: Third-Party and Vendor Risk Audit - Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Reviewing OT-specific incident response plan
- Validating integration with corporate IR teams
- Assessing readiness of OT personnel for cyber incidents
- Checking for documented communication chains
- Reviewing isolation and containment procedures
- Validating safe shutdown and fail-safe operation
- Assessing backup restoration procedures for control systems
- Reviewing availability of offline backups
- Validating testing frequency of disaster recovery plans
- Checking for dependencies on IT systems during recovery
- Reviewing lessons learned from past incidents
- Assessing coordination with first responders
- Validating physical recovery location readiness
- Reviewing alternate control methods (manual override)
- Checking fuel, power, and environmental backups
- Assessing cyber-physical failover testing
- Reviewing regulatory reporting obligations
- Validating evidence preservation procedures
- Assessing post-incident review workflows
- Documenting tabletop exercise records
Module 10: Physical Security and Environmental Controls Audit - Assessing access controls to control rooms and cabinets
- Validating use of badging, biometrics, and visitor logs
- Reviewing camera coverage and retention policies
- Checking for intrusion detection on cabinets and panels
- Assessing locking mechanisms and key management
- Validating environmental monitoring: temp, humidity, airflow
- Reviewing fire suppression systems and testing records
- Assessing power redundancy and UPS performance
- Checking for water and flood detection sensors
- Validating conduit and cable protection
- Reviewing protection of wireless access points
- Assessing site perimeter controls
- Checking for tamper-evident seals on critical devices
- Validating secure storage of backup media
- Reviewing off-site storage conditions
- Assessing vendor escort policies
- Validating training for physical security procedures
- Reviewing third-party maintenance access logs
- Assessing drone and aerial surveillance risks
- Documenting supply chain physical security
Module 11: Third-Party and Vendor Risk Audit - Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Reviewing vendor risk assessment methodology
- Validating contractual security requirements
- Assessing remote access practices by vendors
- Checking for time-limited and monitored access
- Reviewing use of jump servers for vendor access
- Validating vendor-provided equipment security
- Assessing software supply chain integrity
- Checking for signed firmware and code verification
- Reviewing SLAs for security incident response
- Validating vendor audit rights in contracts
- Assessing vendor patch management responsibilities
- Reviewing use of outsourced engineering services
- Checking for segregation of vendor networks
- Validating background checks for contractor personnel
- Assessing training and awareness for vendor staff
- Reviewing termination of vendor access procedures
- Validating remote monitoring of vendor systems
- Checking for use of secure file transfer methods
- Assessing vulnerability disclosure processes
- Documenting vendor compliance with industry standards
Module 12: Security Awareness and Organisational Culture Audit - Assessing OT-specific security training programs
- Validating frequency and content of awareness sessions
- Reviewing phishing simulation results
- Assessing understanding of social engineering risks
- Checking for reporting procedures for suspicious activity
- Validating inclusion of operators in security drills
- Reviewing signage and policy visibility in control rooms
- Assessing language accessibility of training materials
- Checking for integration of security in onboarding
- Validating leadership communication on cyber risk
- Reviewing incentive structures for compliance
- Assessing blame-free incident reporting culture
- Checking for anonymous reporting channels
- Validating measurement of security culture maturity
- Reviewing audit team training and refreshers
- Assessing knowledge of regulatory obligations
- Checking for OT-specific tabletop scenario training
- Validating documentation of training attendance
- Reviewing integration with safety culture initiatives
- Documenting opportunities for culture improvement
Module 13: Audit Reporting and Communication - Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Structuring the executive summary for leadership
- Writing technical findings with severity ratings
- Using CVSS scoring adapted for OT impact
- Linking findings to business and safety risks
- Providing clear remediation recommendations
- Documenting evidence sources for each finding
- Creating visual risk heatmaps by zone and system
- Developing risk treatment plans with timelines
- Using RACI matrices for responsibility assignment
- Presenting findings in board-ready format
- Reviewing draft reports with operational teams
- Ensuring accuracy without operational disruption
- Validating confidentiality and distribution controls
- Archiving audit records securely
- Creating appendixes for technical details
- Using standardised templates for consistency
- Documenting management response and action plans
- Validating follow-up audit schedules
- Providing status updates to regulators when required
- Archiving final report with digital signature
Module 14: Advanced OT Audit Practices - Conducting audits in high-noise or RF-sensitive environments
- Assessing legacy systems with no patching capability
- Validating compensating controls for unpatchable devices
- Reviewing safety instrumented system (SIS) security
- Assessing protection of sequence of events (SOE) recorders
- Checking for manipulation of historian data
- Validating secure time synchronisation (NTP security)
- Assessing GPS and satellite timing risks
- Reviewing security of analytical and optimisation servers
- Validating protection of cloud-connected OT gateways
- Assessing security of digital twin implementations
- Checking for insider threat detection mechanisms
- Reviewing use of USB data diodes and secure transfer
- Assessing firmware validation processes
- Validating secure boot and trusted platform modules
- Reviewing print server security in OT networks
- Checking for acoustic or electromagnetic side-channel risks
- Assessing supply chain audit trails for hardware
- Validating use of software bill of materials (SBOM)
- Reviewing AI-driven anomaly detection systems
Module 15: Final Audit Project and Certification Preparation - Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network
- Selecting a real or simulated OT environment for audit
- Defining scope and objectives for your final project
- Creating a detailed audit plan with timeline
- Conducting stakeholder interviews and data collection
- Documenting asset inventory and network segmentation
- Reviewing access control and configuration management
- Identifying at least 5 high, medium, and low severity findings
- Writing clear, evidence-based observations
- Developing a risk matrix and remediation roadmap
- Creating an executive summary for leadership
- Formatting the report to The Art of Service standards
- Submitting your audit report for evaluation
- Receiving expert feedback and improvement guidance
- Revising and resubmitting if required
- Meeting proficiency benchmarks for certification
- Tracking progress through the certification dashboard
- Receiving your Certificate of Completion
- Adding certification to your professional profile
- Accessing alumni resources and updated frameworks
- Invitation to join the OT Security Auditor Network