Critical Infrastructure and OT Security Training

Our OT security training and critical infrastructure courses help engineers, operators and risk teams protect industrial control systems and meet obligations such as the SOCI Act Critical Infrastructure Risk Management Program (CIRMP), the AESCSF and ISA/IEC 62443. SSC delivers practical courses for energy, water, transport, manufacturing and other critical sectors, live online or on-site.

Courses at a glance

Course details

OT security fundamentals for engineers

Typical duration: 2 days. Who it is for: engineers and operators who are new to cyber security.

• How IT and OT differ: safety, availability, legacy systems and change windows
• Common attack paths into control systems: remote access, removable media, vendors and flat networks
• Asset inventory, secure remote access, segmentation and backups for control systems
• Recognising and reporting suspicious activity safely

You will be able to: apply practical security measures without putting safety or availability at risk.

ISA/IEC 62443 fundamentals

Typical duration: 3 days. Who it is for: asset owners, integrators and suppliers.

• The structure of the ISA/IEC 62443 series and the roles it addresses
• The security programme for asset owners in 62443-2-1
• Zones and conduits, risk assessment and target security levels SL1 to SL4
• The seven foundational requirements, FR1 to FR7
• Product and component requirements, and certification schemes such as ISASecure

You will be able to: use IEC 62443 to design, specify and assess secure industrial systems.

SOCI Act and CIRMP practitioner

Typical duration: 1 day. Who it is for: responsible entities for critical infrastructure assets in Australia.

• Who the Security of Critical Infrastructure Act 2018 applies to, and its positive security obligations
• The four CIRMP hazard domains: cyber and information security, personnel, supply chain, and physical security and natural hazards
• Meeting the cyber requirement through a recognised framework such as the AESCSF, Essential Eight, ISO/IEC 27001 or the NIST Cybersecurity Framework
• Preparing the board-approved annual CIRMP report
• Incident reporting duties for critical infrastructure assets

You will be able to: maintain a CIRMP that satisfies the rules and stands up to regulator scrutiny.

AESCSF assessment practitioner

Typical duration: 2 days. Who it is for: energy sector participants completing AESCSF assessments.

• The AESCSF domains, maturity indicator levels and security profiles
• Determining criticality and target security profile
• Collecting evidence and avoiding common anti-patterns
• Turning results into a prioritised uplift roadmap

You will be able to: complete a credible AESCSF assessment and plan the uplift that follows.

Exercising for the worst day

Our OT incident response tabletop brings operations, engineering, IT security and leadership into one room to work through a realistic scenario, such as ransomware spreading from the corporate network towards control systems. The exercise tests decisions about isolation, manual operation, safety, regulator notification and communication, and ends with an action plan.

Courses can also cover regional OT requirements, such as Saudi Arabia’s Operational Technology Cybersecurity Controls and Singapore’s Cybersecurity Code of Practice for critical information infrastructure, for organisations operating in those markets.

How the OT and critical infrastructure training is delivered

• Live online. Instructor-led virtual classes over Microsoft Teams or Zoom, with breakout exercises, shared workbooks and the option to split longer courses into half-day sessions across a week or two.
• On-site at your premises. Private training for your team at your office, delivered by a consultant who can use your own policies, systems and examples in the exercises.
• Private and tailored. Every course can be run for a single organisation, with case studies drawn from your sector and the depth adjusted to your team’s experience.

On-site courses can include a walk-through of a real site or control room, agreed in advance with your operations team and always following your safety rules.

What participants receive

• A course workbook and the slides used in class
• Reusable templates and checklists, such as audit checklists, risk registers and report formats, depending on the course
• A case study pack and practice questions
• A certificate of completion from Security Solution Consultants

Certificates and accredited exams

Every participant who completes a course receives a certificate of completion from Security Solution Consultants. Lead Auditor and Lead Implementer courses can include an accredited certification exam through our accredited training partner, for standards where the partner offers one. Your quote confirms the exam body, exam format and certificate for each course, so there are no surprises on the day.

Why train with SSC

• Taught by practitioners. Our trainers are working consultants and auditors who assess OT environments, AESCSF maturity and CIRMP programmes for energy and infrastructure clients, so examples come from real engagements rather than slides.
• We hold ourselves to the same standard. SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach. See our Trust Centre.
• Hands-on with real tools. Exercises can use GRCLens, the GRC platform built by SSC, so participants practise with risk registers, control libraries and evidence the way they will at work.
• Training that connects to delivery. If your team needs help after the course, the same people can support implementation, internal audits and certification readiness.

Related: energy sector security assessment and advisory, and the GRCLens AESCSF and SOCI and IEC 62443 modules. See all training courses.