Cybersecurity
OT and ICS Cybersecurity with ISA/IEC 62443
Learn to secure industrial control systems with ISA/IEC 62443: zones and conduits, security levels, risk assessment and response.
OT and ICS Cybersecurity with ISA/IEC 62443 is a free, self-paced online course from EDWartens for automation, OT and IT engineers responsible for security. It has 16 modules and takes about 7.5 hours, with written notes, a practice task per module, a practical project and a final assessment of 15 questions (pass mark 60%). Learning costs nothing and needs only a free account. The optional EDWartens Certificate of Completion, verifiable by code, is a one-off US$28.99 for you; it is not a vendor credential. Updated 1 November 2026.
- Free
- Intermediate
- 7.5 hours
- Self-paced
- Certificate optional
- Lab practice in your browser
- 5.0 from 1 learner review
No card, no trial. The course is free for good. Certificate US$28.99, optional.
- Who it is for
- Automation, OT and IT engineers responsible for security
- Jobs
- Roles that use this skill: OT security analyst, security engineer, network engineer and compliance analyst. No course guarantees a job.
- Tools
- None required. Free tools shown in the lessons are optional. Hardware: none required.
- Updated
After this course you can
By the end you will be able to:
- Explain how ICS and OT security differ from IT security
- Map a plant into zones and conduits with the Purdue model
- Apply ISA/IEC 62443 security levels and requirements
- Run a cyber risk assessment for a control system
- Build an asset register and plan incident detection and response
Who it is for, and what you need first
Who it is for
Automation, OT and IT engineers responsible for security.
Level: Intermediate. Intermediate. Networking basics and any PLC or SCADA exposure help.
What you need
Software: None required. Free tools shown in the lessons are optional..
Hardware: None required.. What to download, and how.
How this course works
Watch the lessons
Short video lessons, one module at a time, at your own pace.
Read the notes
Open the Reading tab for the written notes and diagrams of the module.
Practise in the 3D labOptional
Try the module in the free 3D lab, in your browser.
Check yourself
Answer the questions to see what stuck before you move on.
Final assessment
Pass the final once you have been through the modules.
Certificate, if you want oneOptional
Optional, with a page anyone can use to verify it.
What you learn
16 modules in order, at your own pace. 7.5 hours of video lessons, with written notes and a practice task in each module.
- 1ICS/OT Fundamentals and the Threat Landscape54m
- 2The OT Security Domain: People, Process and Technology1h 58m
- 3Control Systems and Industrial Protocols2h 30m
- 4The Purdue Model, Zones and Conduits, with lab practice:
- 5Secure Network Architecture and Remote Access, with lab practice: 1h 30m
- 6The ISA/IEC 62443 Series1h 20m
- 7Security Levels and Foundational Requirements, with lab practice: 1h 55m
- 8Risk Assessment and Threat Modelling, with lab practice: 2h 33m
Show the other 8 modules
- 9Asset Registers and Inventory2h 25m
- 10Threat and Vulnerability Management and OSINT, with lab practice: 4h 24m
- 11Incident Detection and Response, with lab practice: 2h 48m
- 12Standards, Governance and Programme Management3h 11m
- 13Implementing 62443 and Securing Wireless Networks2h 59m
- 14OT Security Assessment, Penetration Testing Basics and Course Review2h 30m
- 15ISA/IEC 62443 Certificates and Exam Preparation3h 37m
- 16Final Assessment
Software you need
What to download, where from, what it costs and how to install it. Every link goes to the maker's own site, never a mirror.
Nothing is required
The free tools shown in the lessons are optional.
Show what to download (1 tool)
Optional
Useful, not needed to finish the course.
- 01Free
Wireshark
Wireshark Foundation
- Runs on
- Windows 11 or 10 64-bit (x64 or Arm64), Windows Server 2016 or later, macOS (Universal disk image), Linux
- Account
- None needed
Free, open source software. No licence fee for any use.
Steps
- 1.Open wireshark.org/download.html.
- 2.Download the Windows x64 Installer (or Arm64, or the macOS Universal Disk Image).
- 3.Run the installer and keep the Npcap option ticked on Windows.
- 4.Open Wireshark, pick your network interface and click the blue fin to start capturing.
- Npcap is needed for live capture on Windows. The Windows installer includes it.
- Only capture traffic on networks you own or have written permission to monitor.
Official download pagewireshark.org
Checked against each maker's own page on 27 September 2026. Trial lengths and editions change; the maker's page is the final word.
Practise in the 3D lab
Practise the course's design work on a fictional plant in the OT security lab: levels, zones and conduits, firewall rules, remote access, patch choices, log reading, backups and response.
- Map the plant network: put every device on its levelOT security labOpen in the lab (opens in a new tab): Map the plant network: put every device on its level
- Zones and conduits: split a flat networkOT security labOpen in the lab (opens in a new tab): Zones and conduits: split a flat network
- Firewall rules: the minimum, then deny by defaultOT security labOpen in the lab (opens in a new tab): Firewall rules: the minimum, then deny by default
- Remote access: the vendor comes in through the DMZOT security labOpen in the lab (opens in a new tab): Remote access: the vendor comes in through the DMZ
Optional. Skip it whenever you like: it never blocks your progress or your certificate.
Course project, about 20 hours
Zones, conduits and a detailed risk assessment to IEC 62443-3-2 for an automotive assembly plant
Run the IEC 62443-3-2 workflow on a vehicle assembly plant. Define the system, assess the risk, split it into zones and conduits, set a target security level per zone, write the requirements specification and draw the target architecture with a plant DMZ. The sample pack shows what an OT security engineer hands to the asset owner for approval.
- 7documents in the pack
- 9steps to follow
- Laboptional: in the 3D lab
- 7things to hand in
- 20 hof work, at your pace
- Asset inventoryOT Asset Inventory: Ibex Plant 2, by Shop
- Zones & conduitsZone and Conduit Register with Target Security Levels (ZCR 3 and ZCR 6)
- Risk registerCyber Risk Register: Initial (ZCR 2) and Detailed (ZCR 5) Assessments
- CRSCybersecurity Requirements Specification (ZCR 6): Ibex Plant 2
- Network architectureNetwork Architecture, Target State: Plant DMZ and Zoned Shops
- ProcedureProcedure: Patch Management for the Ibex Plant 2 IACS
Do it in the lab: 5 steps.
The project is optional practice. The certificate needs only the modules and the final assessment.
After the course, your next step
Show what you can do, then keep going in the same field.
A certificate you can verify
Finish the modules and pass the final assessment (15 questions, pass mark 60%) and you can add a certificate with a public verification page. One-off, US$28.99 for you. It is not a vendor credential.
Want a free certificate? Do the matching Free internship: 4 weeks, nothing to buy, with a free certificate of completion.
Cybersecurity (IT and OT)
Eight short weeks of security basics, networks, access control, a security operations centre, industrial (OT) security, IEC 62443 and incident response: notes, diagrams, a few videos and worked exercises. Finish weeks 1 to 4 and the final, then claim a free Internship Completion Certificate with your real dates and study hours, and a QR code anyone can scan to verify it. Training, not employment.
See the internshipPart of a learning path
Courses in a planned order, so each one builds on the last.
More free courses
Roles that use this skill
- OT security analyst
- Security engineer
- Network engineer
- Compliance analyst
These are the kinds of roles where the skill is used. We make no promise of a job or an interview.
Plain notes
- Free: the whole course, the notes, the practice tasks, the final assessment and support from practising engineers.
- Paid, and optional: the course certificate, and the Engineer-verified internship (the Free internship costs nothing).
- No job promise: the course teaches a skill. It does not place you in a job.
- Lessons by: Mike Holcomb, exida, ISA, ISASecure, Manjunath Hiregange. Independent creators; the lessons stream from their own channels. EDWartens wrote the study plan, notes, practice tasks and assessments.
Mike Holcomb · exida · ISA · ISASecure · Manjunath Hiregange. If you are one of these creators and want a lesson removed or credited differently, write to info@edwartens.com.
Practise what you learn in the free 3D lab
Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.
- Practise safely, so a mistake costs nothing.
- The lab checks your work like a site test, so you know when it is right.
- Free, in your browser, with nothing to install.
Why learn with EDWartens
What you get with this course, and what comes after it.
- Free from the first lesson to the final assessment.
- Practice in a free 3D lab in your browser, with nothing to install.
- Video lessons with written notes and a project.
- An optional certificate that anyone can verify online.
- Free internships to keep practising afterwards.
Common questions
What is IEC 62443?
ISA/IEC 62443 is a series of international standards for the cybersecurity of industrial automation and control systems, such as PLCs, SCADA and distributed control systems. ISA says its ISA99 committee developed the series, together with IEC Technical Committee 65 Working Group 10. The committee was established in 2002. ISA says the series applies to asset owners, automation product suppliers, integrators and service suppliers. This course teaches the parts most engineers use day to day. These are zones and conduits, security levels, risk assessment and the security programme.
What ISA/IEC 62443 certifications are there?
ISA runs an ISA/IEC 62443 Cybersecurity Certificate Program with four certificates. They are Fundamentals Specialist, Risk Assessment Specialist, Design Specialist and Maintenance Specialist. ISA states that the Cybersecurity Expert certificate is awarded automatically when all four are completed. It also states that the certificates do not need to be renewed. This free course includes mock tests to help you prepare. Its own certificate is an EDWartens certificate of completion, not an ISA certificate.
Is this a hacking course?
No. It is defensive: architecture, standards, risk, inventory, response and governance. The testing module covers how authorised assessments are scoped safely, not how to attack a plant.
Who is the OT and ICS Cybersecurity with ISA/IEC 62443 course for?
Automation engineers, IT staff moving into OT, and anyone preparing for ISA/IEC 62443 certificates.
How long is it?
The lessons teach everything without video. About an hour of video is required, and the rest, over thirty hours of lectures and mock tests, is optional extra depth. Take it a module a week.
Is the OT and ICS Cybersecurity with ISA/IEC 62443 course really free?
Yes. Every module, practice task and assessment. You create an account so your progress is saved and the assessments can be marked. The certificate is the only paid item, and only if you want it.
What certificate do I get, and is it a vendor qualification?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a verification code anyone can check. It is not a vendor credential and is never described as one.
Who made the video lessons in the OT and ICS Cybersecurity with ISA/IEC 62443 course?
The creators named in the Credits block at the foot of this page, on their own YouTube channels. EDWartens did not make the videos and the creators are not affiliated with EDWartens. What EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.
Do I need any software or hardware?
No. Nothing needs to be installed and no hardware is needed; the free tools shown in some lessons are optional.
Do I have to use the lab?
No. The lab is optional practice. You can skip it whenever you like, and it never blocks your progress, the final assessment or your certificate.
Is the lab free?
Yes. Every lab level for this course opens in your browser, free, with nothing to install.
What topics does the OT and ICS Cybersecurity with ISA/IEC 62443 course cover, module by module?
The OT and ICS Cybersecurity with ISA/IEC 62443 course has 16 modules. It opens with "ICS/OT Fundamentals and the Threat Landscape", goes through "The OT Security Domain: People, Process and Technology", "The ISA/IEC 62443 Series", "Incident Detection and Response" and "ISA/IEC 62443 Certificates and Exam Preparation" and ends with "Final Assessment". The full list with minutes is under "What you learn" on this page.
What can I do after the OT and ICS Cybersecurity with ISA/IEC 62443 course?
After the OT and ICS Cybersecurity with ISA/IEC 62443 course: Explain OT versus IT security and the threat landscape; Map plants with the Purdue model into zones and conduits; Apply ISA/IEC 62443 parts, roles and security levels. These are the practical outcomes the course is written around, and the final assessment of 15 questions checks them.
What software and hardware do I need for the OT and ICS Cybersecurity with ISA/IEC 62443 course, and does it cost anything?
For the OT and ICS Cybersecurity with ISA/IEC 62443 course, software: None required. Free tools shown in the lessons are optional. Hardware: none required. The course itself is free.
Is the OT and ICS Cybersecurity with ISA/IEC 62443 course suitable for me, and what level is it?
OT and ICS Cybersecurity with ISA/IEC 62443 is rated intermediate. Intermediate. Networking basics and any PLC or SCADA exposure help. It is written for automation, OT and IT engineers responsible for security, and takes about 7.5 hours at your own pace.
Which jobs use the skills from the OT and ICS Cybersecurity with ISA/IEC 62443 course?
Skills from the OT and ICS Cybersecurity with ISA/IEC 62443 course (for example: explain OT versus IT security and the threat landscape) are used in roles such as OT security analyst, security engineer, network engineer and compliance analyst, and in OT security engineer work. The course gives you practical evidence of the skill; it does not promise a job, and employers decide on experience and interview.
Start free today
OT and ICS Cybersecurity with ISA/IEC 62443, at your own pace. Add the certificate only if you want one.