Cybersecurity · Free
OT and ICS Cybersecurity with ISA/IEC 62443
Free OT security course for automation and IT staff: Purdue zones, ISA/IEC 62443 security levels, risk assessment. The certificate is optional and paid.
Inside the course
From the lessons
ICS/OT Fundamentals and the Threat Landscape
Faceless Security
Control Systems and Industrial Protocols
Mike Holcomb
Secure Network Architecture and Remote Access
Mike Holcomb
Security Levels and Foundational Requirements
CBOOMARANK™
Asset Registers and Inventory
Mike Holcomb
Incident Detection and Response
Mike Holcomb
Lesson frames belong to the creators named in the Credits below and are shown from YouTube.
What you will learn
Explain how ICS and OT differ from IT security, map a plant with the Purdue model into zones and conduits, apply ISA/IEC 62443 security levels and requirements, run a cyber risk assessment, build an asset register and vulnerability programme, plan incident detection and response, manage a security programme and prepare for ISA/IEC 62443 certification exams.
- Explain OT versus IT security and the threat landscape
- Map plants with the Purdue model into zones and conduits
- Apply ISA/IEC 62443 parts, roles and security levels
- Run risk assessments and build asset registers
- Manage vulnerabilities, incidents and a security programme
- Prepare for ISA/IEC 62443 certification exams
For you
Taking OT and ICS Cybersecurity with ISA/IEC 62443 from the United States
- Free in the United States, as everywhere, and self-paced: lessons, notes and the final assessment are open at any hour, so your time zone and shift pattern do not matter.
- The optional certificate for learners in the United States is a one-off US$28.99. What you get for it
- Plants across the Americas most often run Allen-Bradley, Siemens and Inductive Automation; each has its own free course to take next.
- See automation and engineering jobs in the United States, and what the industry looks like in Houston, Detroit and Chicago.
- EDWartens also has a regional site for the United States, for classroom training and local support: edwartens.com/us.
The course project · about 20 hours
Zones, conduits and a detailed risk assessment to IEC 62443-3-2 for an automotive assembly plant
Run the IEC 62443-3-2 workflow end to end on a vehicle assembly plant: define the system under consideration, build the asset inventory, do the initial risk assessment, partition the plant into zones and conduits, compare each zone's risk with the tolerable level, carry out the detailed assessment with threat scenarios mapped to ATT&CK for ICS, set a target security level per zone, write the cybersecurity requirements specification, and design the target architecture with a plant DMZ. You deliver your own inventory, zone model, both risk assessments, CRS and drawing. The sample pack shows what an OT security engineer hands to the asset owner for ZCR 7 approval.
Sample document pack, 7 documents, filled in for the scenario
- Asset inventoryOT Asset Inventory: Castellón Plant 2, by Shop
- Zones & conduitsZone and Conduit Register with Target Security Levels (ZCR 3 and ZCR 6)
- Risk registerCyber Risk Register: Initial (ZCR 2) and Detailed (ZCR 5) Assessments
- CRSCybersecurity Requirements Specification (ZCR 6): Castellón Plant 2
- Network architectureNetwork Architecture, Target State: Plant DMZ and Zoned Shops
- ProcedureProcedure: Patch Management for the Castellón Plant 2 IACS
- Training recordTraining Record: CRS Obligations and the Zoned Network
Read inside the course and download as a workbook. The project is optional practice, marked when you submit it; the certificate needs only the modules and the final assessment.
The course project · about 18 hours
Secure vendor remote access, OT monitoring and an incident response plan for a district cooling plant
Take a district cooling plant whose chiller, BMS and integrator vendors reach the controls through unattended AnyDesk sessions and an Internet-exposed 4G router, and replace every path with one approved, multi-factor, recorded remote-access conduit through an OT DMZ. Put passive network monitoring on the OT network with detection use cases mapped to ATT&CK for ICS, write the OT incident response plan with a playbook that keeps the cooling running while an intruder is cut off, and prove both with an acceptance test and a tabletop exercise. The sample pack shows what an OT security engineer leaves with the plant manager.
Sample document pack, 10 documents, filled in for the scenario
- Asset inventoryRemote Access Path Inventory: As Found and Fate
- Risk registerCyber Risk Register: Remote Access Paths and Plant Consequences
- Zones & conduitsZones and Conduits: Remote-Access Design for DCP-1
- CRSRemote Access and Monitoring Requirements, Traced to IEC 62443-3-3
- RegisterDetection Use-Case Register: Passive Monitoring of DCP-1
- ProcedureProcedure: Vendor and Remote Access to the DCP-1 Control System
- PlanOT Incident Response Plan: DCP-1, with Playbook PB-01 Unauthorised Remote Access
- Test reportAcceptance Test and Tabletop Exercise Report: Remote Access, Monitoring and PB-01
- Network architectureNetwork Architecture: Remote-Access Conduit, OT DMZ and Monitoring, Target State
- Training recordTraining Record: Remote-Access Procedure and Incident Response Roles
Read inside the course and download as a workbook. The project is optional practice, marked when you submit it; the certificate needs only the modules and the final assessment.
Course content
16 modules · 46 lessons · 43h 50m
In order, at whatever pace suits you. Each module ends with a practice task that builds on the last.
- 01ICS/OT Fundamentals and the Threat Landscape4 lessons2h 8m
- 02The OT Security Domain: People, Process and Technology1 lesson1h 58m
- 03Control Systems and Industrial Protocols1 lesson2h 30m
- 04The Purdue Model, Zones and Conduits3 lessons1h 5m
- 05Secure Network Architecture and Remote Access1 lesson1h 30m
- 06The ISA/IEC 62443 Series4 lessons2h 15m
- 07Security Levels and Foundational Requirements3 lessons2h 56m
- 08Risk Assessment and Threat Modelling4 lessons2h 33m
Requirements
- Who it is for
- Intermediate. Networking basics and any PLC or SCADA exposure help.
- Software
- None required. Free tools shown in the lessons are optional. What to download, and how
- Hardware
- None required.
Software you need
What to download, where from, what it costs and how to install it. Every link goes to the maker's own site, never a mirror.
Nothing is required
The free tools shown in the lessons are optional.
Optional
Useful, not needed to finish the course.
- 01Free
Wireshark
Wireshark Foundation
- Runs on
- Windows 11 or 10 64-bit (x64 or Arm64), Windows Server 2016 or later, macOS (Universal disk image), Linux
- Account
- None needed
Free, open source software. No licence fee for any use.
Steps
- 1.Open wireshark.org/download.html.
- 2.Download the Windows x64 Installer (or Arm64, or the macOS Universal Disk Image).
- 3.Run the installer and keep the Npcap option ticked on Windows.
- 4.Open Wireshark, pick your network interface and click the blue fin to start capturing.
- Npcap is needed for live capture on Windows. The Windows installer includes it.
- Only capture traffic on networks you own or have written permission to monitor.
Official download pagewireshark.org
Checked against each maker's own page on 27 September 2026. Trial lengths and editions change; the maker's page is the final word.
OT and ICS Cybersecurity with ISA/IEC 62443 at a glance
OT and ICS Cybersecurity with ISA/IEC 62443 is a free, self-paced online course from EDWartens for automation, OT and IT engineers responsible for security. It has 16 modules and 43h 50m of video lessons by Mike Holcomb, Faceless Security, CBOOMARANK and others, with written notes and worked problems, a practical project with a document pack and a 15-question final assessment (pass mark 60%). Learning is free with an account; an optional certificate with a public verification code is issued when you pass. Last updated 27 September 2026.
All course factsHide course facts
- Price
- Free, for good. No trial, no card. The only paid item is the optional certificate, a small one-off fee.
- Who it is for
- Automation, OT and IT engineers responsible for security
- Format
- 16 self-paced modules, 43h 50m of video, written notes, a practice task per module and one final assessment.
- Level
- Intermediate. Intermediate. Networking basics and any PLC or SCADA exposure help.
- Brand
- Vendor-neutral
- Software
- None required. Free tools shown in the lessons are optional.
- Hardware
- None required.
- Certificate
- Optional EDWartens Certificate of Completion, verifiable by code, for a small one-off fee shown on edwartens.com/certificate. Not a vendor credential.
- Video lessons by
- Mike Holcomb, Faceless Security, CBOOMARANK, A LV, Manjunath Hiregange (independent creators, credited below)
- Language
- English
- Last updated
- 27 September 2026
A shareable EDWartens certificate
Finish every module and pass the final assessment, and the optional EDWartens certificate is yours. It carries a unique verification code on a public page anyone can check, so it stands up when a recruiter looks it up. See it below.
The course itself stays free whether or not you ever buy one.
Stuck? Ask a practising engineer
A free course usually means a comment section and hope. This one does not. Every module has an Ask-your-trainer panel that reaches the same engineers who teach our paid programme: people who commission panels for a living, not moderators.
Pairs well with
FreeCybersecurity · FreeCompTIA Security+ (SY0-701) Exam PrepPrepare for CompTIA Security+ SY0-701 with Professor Messer's complete free video course: every exam objective across the five domains, with EDWartens notes, worked calculations, practice questions and an optional security project. Exam preparation only: the EDWartens certificate is not the CompTIA Security+ certification, which is earned only by passing CompTIA's exam.
FreeCybersecurity · FreeMicrosoft Sentinel and Defender: SC-200 Exam PrepPreparation for Microsoft's SC-200 Security Operations Analyst exam, mapped to the skills measured as of 21 October 2026: KQL from first query to hunting, Microsoft Defender XDR incidents and attack disruption, Defender for Endpoint, Office 365, Identity and Cloud Apps, Purview investigations, Microsoft Sentinel setup, data connectors, analytics rules, automation, Security Copilot and threat hunting.
FreePLC programming · FreeSiemens TIA PortalFree Siemens TIA Portal course for beginners: write ladder logic for a simulated S7-1200 and WinCC HMI. Learning is free; the certificate is optional and paid.
FreePLC programming · FreeSiemens TIA Portal in Three HoursThe first three hours of the Siemens TIA Portal course, cut to end on a win: what a PLC is, how it is wired, a project configured in TIA Portal, and your first ladder program running in simulation. Finish it in an evening or two, earn a certificate, and carry straight on into the full course.More free courses: Free cyber security courses · Free OT and ICS security courses
Learning paths with this course
- IIoT and OT security · 3 coursesIndustrial networks, Node-RED for data and dashboards, and ISA/IEC 62443 to keep the plant safe once it is connected.
Learner reviews
5.0
1 review from learners who finished the course
- 51
- 40
- 30
- 20
- 10
- A learner· finished the course · October 2026
easy to understand and freedom to learn
Common questions
What is IEC 62443?
ISA/IEC 62443 is a series of international standards for the cybersecurity of industrial automation and control systems, such as PLCs, SCADA and distributed control systems. ISA says the series was developed by its ISA99 committee, established in 2002, together with IEC Technical Committee 65 Working Group 10, and that it applies to asset owners, automation product suppliers, integrators and service suppliers. This course teaches the parts most engineers use day to day: zones and conduits, security levels, risk assessment and the security programme.
What ISA/IEC 62443 certifications are there?
ISA runs an ISA/IEC 62443 Cybersecurity Certificate Program with four certificates: Fundamentals Specialist, Risk Assessment Specialist, Design Specialist and Maintenance Specialist. ISA states that the ISA/IEC 62443 Cybersecurity Expert certificate is awarded automatically when all four are completed, and that the certificates do not need to be renewed. This free course includes mock tests to help you prepare, but its own certificate is an EDWartens certificate of completion, not an ISA certificate.
Is this a hacking course?
No. It is defensive: architecture, standards, risk, inventory, response and governance. The testing module covers how authorised assessments are scoped safely, not how to attack a plant.
Who is the OT and ICS Cybersecurity with ISA/IEC 62443 course for?
Automation engineers, IT staff moving into OT, and anyone preparing for ISA/IEC 62443 certificates.
How long is it?
Long: about forty hours of video, because Mike Holcomb's course alone is twenty. Take it a module a week.
Is the OT and ICS Cybersecurity with ISA/IEC 62443 course really free?
Yes. Every module, practice task and assessment. You create an account so your progress is saved and the assessments can be marked. The certificate is the only paid item, and only if you want it.
What certificate do I get, and is it a vendor qualification?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a verification code anyone can check. It is not a vendor credential and is never described as one.
Who made the video lessons in the OT and ICS Cybersecurity with ISA/IEC 62443 course?
The creators named in the Credits block at the foot of this page, on their own YouTube channels. EDWartens did not make the videos and the creators are not affiliated with EDWartens. What EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.
Do I need any software or hardware?
No. Nothing needs to be installed and no hardware is needed; the free tools shown in some lessons are optional.
What you walk away with
Your certificate for OT and ICS Cybersecurity with ISA/IEC 62443
Finish the course, pass the final, and this is the document with your name on it.
Verifiable by anyone
Adds to LinkedIn in one click
QR code on the certificate
Names what you can do
A permanent link
Earned, not attended
Learning is free. The certificate is optional.
Add it now and pay only when you have finished the course, or come back for it later. One-off, US$28.99, with a receipt.
Issued by Wartens Ltd (England and Wales, company no. 15262249) through the EDWartens training portal, as a Certificate of Completion for this self-paced course. Sold by Wartens Ltd. It is not a vendor certification, a university award or a CPD-accredited activity, and it does not certify competence on live equipment. Delivered electronically; see the refund policy.
Credits
Who made the video lessons
The video lessons in this course were created by the people below, not by EDWartens. Every lesson streams from its creator's own YouTube channel; EDWartens neither hosts nor sells that footage, and the creators are not affiliated with EDWartens and do not endorse this course. What EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.
- Mike Holcombthe Getting Started with ICS/OT Cyber Security full course
- Faceless Securitythe OT/ICS introduction modules
- CBOOMARANKthe ISA/IEC 62443 full course
- A LVthe IEC 62443 webinar collection
- Manjunath Hiregangethe ISA/IEC 62443 mock tests
If you are one of these creators and would like a lesson removed or credited differently, write to info@wartens.com.