Industrial (ICS/OT) Cyber Security Certifications

One of the most common questions I get is on ICS/OT cyber security certifications.

I am very fortunate to work for a company that has invested in me to take the ISA IEC 62443 and SANS courses.

And yes, I have all the certs.

A few things to remember about certifications:

- Do not replace experience
- Not all require you to take a course
- Can accelerate the learning curve for you
- Can help you demonstrate your knowledge
- Can assist in you standing out for hiring managers

Here is how I explain the main ones:

1. ISA 62443 Cybersecurity Expert Series

The ISA 62443 standard is considered the gold framework for securing ICS OT networks.

ISA (International Society of Automation) put together a course to help others:

- Understand how to implement ISA 62443
- The fundamentals of cyber security in ICS OT

Passing all four ISA courses will reward you with the “ISA IEC 62443 Cybersecurity Expert” certification.

The Expert certification is seen by some as the "CISSP of the ICS OT world."

NOTE: The cert does not make you an expert, but it is a great place to start!

Unfortunately, you must take each course before taking the corresponding exam.

These are often considered more affordable and cost effective than...

2. SANS ICS OT Certifications
The heavy weight of the ICS - OT cyber security space in terms of knowledge.

Sadly, each course and exam cost ~$10,000 USD to take.

The price puts these courses out of reach for a lot of people.

Each of the courses provide great value, depending on where you are at in your career:

- GICSP: Focuses on the fundamentals of ICS OT cyber security
- GRID: Built by Rob Lee to help others understand how to defender their ICS OT networks
- GCIP: Covers how cyber security regulation is met in the North American power industry

NOTE #2: Rob Lee still teaches the GRID course occasionally. Be sure to take it with him!

(No offense to the other instructions, but I’m sure they would agree with me).

3. Other Provider Certifications
Other providers make more affordable options available.

The providers I hear about the most in this space are Exida and TUV.

I do not have any experience with either.

Yet!

What else am I missing in the ICS OT cyber certification world?