Welcome. An industrial plant is not an office with machinery inside. The priorities are reversed compared with those of business IT: the safety of people comes first, then continuity of production, and only after that the confidentiality of data. A system is updated when the line is stopped, and the line stops when production decides. A component installed in 2009 will still be in service in 2035. Many protocols that govern valves and motors were born in an era when nobody imagined that network could be reached from outside, and they provide no authentication at all.

That is why IT practices are not transplanted: they are translated. The IEC 62443 series is the body of standards that has already done that translation, and it has become the common reference between those who own the plant, those who integrate it and those who supply the components.

The path teaches it as an assessment method, not as a reading. Each module takes you one step further in the work an assessment actually requires: understanding the domain, taking inventory, partitioning, assessing risk, choosing requirements, measuring the gap, demonstrating.

A second question runs through the whole path, and it is the one that makes the work sustainable: who else does this evidence serve? The same survey that satisfies IEC 62443 almost always also answers a control of ISO/IEC 27001 and a measure of Article 21 of NIS2. Each module closes by showing where the three coincide, where they diverge and what needs to be written so that a single survey counts for all three.

Path objectives

By the end of the path you will be able to:

• explain why an industrial automation and control system requires a different approach from IT, and recognise the constraints - people's safety, availability, long lifecycles, protocols without authentication - that make many IT practices inapplicable (Module 1);
• find your way around the IEC 62443 series, know which part applies to the asset owner, the integrator and the product supplier, and not confuse documents that answer different questions (Module 1);
• build the inventory of automation assets and the map of the architecture and data flows, consciously choosing the discovery techniques and knowing when an active scan is a risk rather than a measure (Module 2);
• partition a system into zones and conduits with defensible criteria, conduct the risk assessment and assign each zone its target security level, documenting the choices so that they stand up to an audit (Module 3);
• read the seven foundational requirements of the series and the security levels, distinguish target level, capability level and achieved level, and derive from that gap a treatment plan ordered by priority (Module 4);
• assess the organisation's security programme and its maturity, and write verifiable security requirements in specifications for integrators and suppliers, without settling for the name of a certification (Module 5);
• make the same work count for ISO/IEC 27001 and NIS2, extend an existing management system to the industrial domain and keep ready the evidence file that an inspection, an audit or a customer will ask to see (Module 6).

Who it is for and prerequisites

The path is for those who work on the plant and those who must answer for it: automation, maintenance and production managers, process engineers, IT managers who find themselves in charge of OT, security specialists entering a plant for the first time, system integrators and suppliers, compliance managers, NIS contacts, auditors and consultants.

Prerequisites. You do not need to know how to program a PLC or know the 62443 series: the path builds both from scratch. What you do need is a basic familiarity with the concepts of risk, threat and control, which Information Security Fundamentals provides. It is useful, but not mandatory, to have first taken Compliance and frameworks for the NIS2 picture, and Incident management and response, which this path borders on: an incident on an industrial network is handled with the same phases and very different constraints, because isolating a segment may mean stopping a process that cannot be stopped.

A note on scope. This path teaches you to assess the security of an automation system. It does not teach you to design the plant, it does not replace the assessment of risks to personal safety required by occupational safety legislation, and it does not authorise intervening on systems in service: every activity on a live plant is agreed with whoever is responsible for it.

Format

The path takes place entirely online, asynchronously: you can study whenever you like, at your own pace, from any device. The estimated total duration is 26 hours, to be spread out within the completion deadline indicated further on.

Each module has the same three-step structure:

1. Lesson. A reasoned treatment of the topic, with diagrams, examples and concrete cases.
2. Module test. Closed questions on the whole module. Passing requires at least 70%; attempts are unlimited and the best grade counts. At the end of each attempt you receive a detailed explanation of every answer, including the correct ones.
3. Exercise. A case to work through by choosing: each decision opens a different road and the outcome depends on what you chose, with the explanation of what would have happened otherwise. Assessment is automatic and you can redo it as many times as you like.

Progression. The 6 modules are taken in sequence: each module unlocks only after you pass the test of the previous module. The exercises do not block progress, but they are an integral part of the path and of the overall assessment.

Final test and certificate

Once you pass the tests of all modules, the final test unlocks: 30 questions drawn at random from topics across the whole path, with the same 70% threshold. You have three attempts, at least one week apart: if none of them reaches the threshold, the path starts again from the first module. When you pass it you obtain the path certificate, downloadable as a PDF, with a unique code that allows its authenticity to be verified.

Warning

The content is up to date as of October 2026. Three caveats specific to this subject.

The first. The standards in the IEC 62443 series are paid documents protected by copyright: the path explains their method, structure and requirements in its own words and with original examples, but does not reproduce their text. To conduct a formal assessment, and all the more so to declare conformity, you need to obtain the applicable parts in their current edition.

The second. The series is alive: parts are revised and new editions replace the previous ones. Before citing a requirement in a contractual document or in an assessment report, always check which edition applies to your case.

The third. The numerical values used in the examples - assigned levels, times, costs, plant sizes - are realistic but remain examples. A security level copied from another plant is the leading cause of assessments that do not hold up: it is derived from the risk of your own context, and justified.

Support

In the Announcements forum you will find messages from the instructor. For questions about the content or the exercises, use the channels indicated by your training contact.