Cybersecurity
ICS Security Foundations: Control Systems, Defence in Depth and the 62443 Requirements
Learn how to protect industrial control systems: the Purdue model, defence in depth and the seven IEC 62443 requirements.
ICS Security Foundations: Control Systems, Defence in Depth and the 62443 Requirements is a free, self-paced online course from EDWartens for automation, OT and IT engineers responsible for security. It has 11 modules and takes about 9 hours, with written notes, a practice task per module, a practical project and a final assessment of 15 questions (pass mark 60%). Learning costs nothing and needs only a free account. The optional EDWartens Certificate of Completion, verifiable by code, is a one-off US$23.99 for you; it is not a vendor credential. Updated 1 November 2026.
- Free
- Beginner
- 9 hours
- Self-paced
- Certificate optional
- Lab practice in your browser
No card, no trial. The course is free for good. Certificate US$23.99, optional.
- Who it is for
- Automation, OT and IT engineers responsible for security
- Jobs
- Roles that use this skill: OT security analyst, security engineer, network engineer and compliance analyst. No course guarantees a job.
- Tools
- None required. Everything is taught with diagrams and worked examples. Hardware: none required.
- Updated
After this course you can
By the end you will be able to:
- Place any plant device on a Purdue level
- Explain why an IT security policy cannot be used unchanged in OT
- Build a layered defence for a control system
- Apply the seven foundational requirements to a real asset
- Keep an asset register and segment a network
Who it is for, and what you need first
Who it is for
Automation, OT and IT engineers responsible for security.
Level: Beginner. Beginner. No security background needed; any plant or PLC exposure helps.
What you need
Software: None required. Everything is taught with diagrams and worked examples..
Hardware: None required..
How this course works
Watch the lessons
Short video lessons, one module at a time, at your own pace.
Read the notes
Open the Reading tab for the written notes and diagrams of the module.
Practise in the 3D labOptional
Try the module in the free 3D lab, in your browser.
Check yourself
Answer the questions to see what stuck before you move on.
Final assessment
Pass the final once you have been through the modules.
Certificate, if you want oneOptional
Optional, with a page anyone can use to verify it.
What you learn
11 modules in order, at your own pace. 9 hours of video lessons, with written notes and a practice task in each module.
- 1The Systems You Are Protecting: DCS, PLC and SCADA25m
- 2Building Automation, Safety Systems and the IIoT18m
- 3The Purdue Model and Why OT Is Not IT, with lab practice: 25m
- 4What Goes Wrong: Attacks, Consequences and What to Secure29m
- 5Defence in Depth and a Layered Architecture, with lab practice: 29m
- 6Foundational Requirements 1 and 2: Who You Are and What You May Do24m
- 7Foundational Requirements 3, 4 and 5: Integrity, Confidentiality and Data Flow, with lab practice: 33m
- 8Foundational Requirements 6 and 7: Responding and Staying Up, with lab practice: 22m
Show the other 3 modules
- 9Knowing What You Have: Asset Management, Segmentation and Discovery30m
- 10Detection, Remote Access, SIEM and Endpoints, with lab practice: 39m
- 11Final Assessment10m
Practise in the 3D lab
Practise the course's ideas on a fictional plant in the OT security lab: levels and the DMZ, zones and conduits, protecting what cannot be patched, remote access, backups and response.
- Map the plant network: put every device on its levelOT security labOpen in the lab (opens in a new tab): Map the plant network: put every device on its level
- Zones and conduits: split a flat networkOT security labOpen in the lab (opens in a new tab): Zones and conduits: split a flat network
- Patch or protect: choose within the maintenance windowOT security labOpen in the lab (opens in a new tab): Patch or protect: choose within the maintenance window
- Remote access: the vendor comes in through the DMZOT security labOpen in the lab (opens in a new tab): Remote access: the vendor comes in through the DMZ
Optional. Skip it whenever you like: it never blocks your progress or your certificate.
Course project, about 16 hours
Baseline security review of a 30 ML/day water-treatment plant against the IEC 62443 foundational requirements
Carry out and document a baseline security review of a municipal water-treatment plant that has never had one. Build the asset inventory from the as-found data and a passive capture, draw the flat network as it is, and partition it into zones and conduits with a target security level for each. Write the risk register and assess the plant against the seven foundational requirements of IEC 62443-3-3. Then hand over a prioritised plan with the backup and remote-access procedures that close the worst gaps first. Do this after you finish ICS10: it uses the whole course.
- 7documents in the pack
- 9steps to follow
- Laboptional: in the 3D lab
- 7things to hand in
- 16 hof work, at your pace
- Asset inventoryOT Asset Inventory: Thornvale 30 MLD Water-Treatment Plant (as found)
- Network architectureNetwork Architecture, Current State: One Flat Network
- Zones & conduitsZone and Conduit Register, Proposed: Thornvale WTP
- Risk registerCyber Risk Register: Thornvale WTP Baseline Review
- ReportBaseline Security Review Report: Findings against IEC 62443-3-3 FR1 to FR7
- PlanPrioritised Remediation Plan: 30, 90 and 365 Days
Do it in the lab: 5 steps.
The project is optional practice. The certificate needs only the modules and the final assessment.
After the course, your next step
Show what you can do, then keep going in the same field.
A certificate you can verify
Finish the modules and pass the final assessment (15 questions, pass mark 60%) and you can add a certificate with a public verification page. One-off, US$23.99 for you. It is not a vendor credential.
Want a free certificate? Do the matching Free internship: 4 weeks, nothing to buy, with a free certificate of completion.
Cybersecurity (IT and OT)
Eight short weeks of security basics, networks, access control, a security operations centre, industrial (OT) security, IEC 62443 and incident response: notes, diagrams, a few videos and worked exercises. Finish weeks 1 to 4 and the final, then claim a free Internship Completion Certificate with your real dates and study hours, and a QR code anyone can scan to verify it. Training, not employment.
See the internshipMore free courses
Roles that use this skill
- OT security analyst
- Security engineer
- Network engineer
- Compliance analyst
These are the kinds of roles where the skill is used. We make no promise of a job or an interview.
Plain notes
- Free: the whole course, the notes, the practice tasks, the final assessment and support from practising engineers.
- Paid, and optional: the course certificate, and the Engineer-verified internship (the Free internship costs nothing).
- No job promise: the course teaches a skill. It does not place you in a job.
- Lessons by: Instrumentation Tools. Independent creators; the lessons stream from their own channels. EDWartens wrote the study plan, notes, practice tasks and assessments.
Instrumentation Tools. If you are one of these creators and want a lesson removed or credited differently, write to info@edwartens.com.
Practise what you learn in the free 3D lab
Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.
- Practise safely, so a mistake costs nothing.
- The lab checks your work like a site test, so you know when it is right.
- Free, in your browser, with nothing to install.
Why learn with EDWartens
What you get with this course, and what comes after it.
- Free from the first lesson to the final assessment.
- Practice in a free 3D lab in your browser, with nothing to install.
- Video lessons with written notes and a project.
- An optional certificate that anyone can verify online.
- Free internships to keep practising afterwards.
Common questions
Is this the same as the ISA/IEC 62443 course?
No, and it is the one to take first. This course teaches the systems and the seven foundational requirements from the ground up. The 62443 course goes on to security levels, risk assessment, governance and certification preparation.
Do I need a security background?
None. It starts from what a PLC is.
Do I need any software or hardware?
Neither. Every module is diagrams and worked examples you can follow on paper.
Does it prepare me for a certification?
It is the groundwork rather than exam preparation. Take the ISA/IEC 62443 course after this one for the certification material.
How long does the ICS Security Foundations course take?
Plan on about 9 hours in all, including the video lessons, notes and practice tasks. It is self-paced, so you work through the eleven modules at your own speed.
Is the ICS Security Foundations course really free?
Yes. Every module, practice task and assessment is free. You create an account so your progress is saved and the assessments can be marked; the certificate is optional.
What certificate does the ICS Security Foundations course give?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a verification code anyone can check. It is not an ISA, IEC or vendor credential, and EDWartens is not affiliated with those bodies.
Who made the video lessons in the ICS Security Foundations course?
Instrumentation Tools, on its own YouTube channel, as credited at the foot of this page. EDWartens did not make the videos and the creator is not affiliated with EDWartens; what EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.
Do I have to use the lab?
No. The lab is optional practice. You can skip it whenever you like, and it never blocks your progress, the final assessment or your certificate.
Is the lab free?
Yes. Every lab level for this course opens in your browser, free, with nothing to install.
What topics does the ICS Security Foundations course cover, module by module?
The ICS Security Foundations course has 11 modules. It opens with "The Systems You Are Protecting: DCS, PLC and SCADA", goes through "Building Automation, Safety Systems and the IIoT", "Defence in Depth and a Layered Architecture", "Foundational Requirements 3, 4 and 5: Integrity, Confidentiality and Data Flow" and "Detection, Remote Access, SIEM and Endpoints" and ends with "Final Assessment". The full list with minutes is under "What you learn" on this page.
What can I do after the ICS Security Foundations course?
After the ICS Security Foundations course: Tell a DCS, PLC, SCADA, BACS and safety system apart; Place any device on a Purdue level and defend the choice; Explain why an IT security policy cannot be applied to a plant. These are the practical outcomes the course is written around, and the final assessment of 15 questions checks them.
What software and hardware do I need for the ICS Security Foundations course, and does it cost anything?
For the ICS Security Foundations course, software: None required. Everything is taught with diagrams and worked examples. Hardware: none required. The course itself is free.
Is the ICS Security Foundations course suitable for me, and what level is it?
ICS Security Foundations is rated beginner. Beginner. No security background needed; any plant or PLC exposure helps. It is written for automation, OT and IT engineers responsible for security, and takes about 9 hours at your own pace.
Which jobs use the skills from the ICS Security Foundations course?
Skills from the ICS Security Foundations course (for example: tell a DCS, PLC, SCADA, BACS and safety system apart) are used in roles such as OT security analyst, security engineer, network engineer and compliance analyst, and in OT security engineer work. The course gives you practical evidence of the skill; it does not promise a job, and employers decide on experience and interview.
Start free today
ICS Security Foundations: Control Systems, Defence in Depth and the 62443 Requirements, at your own pace. Add the certificate only if you want one.