ICS/SCADA
ICS/SCADA Cybersecurity
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ICS/SCADA Cybersecurity offering from EC-Council is a hands-on training course built around defending industrial control and supervisory control and data acquisition environments. The vendor frames ICS/SCADA security as a higher priority than traditional IT security because an attack can affect the physical safety of communities, employees, or customers, and it points to malware such as Triton/TRISIS and Stuxnet as evidence that threats capable of disrupting operational technology already exist. The course teaches the foundations of security and defending architectures from attacks, and it deliberately adopts a "thinking like a hacker" perspective so defenders can anticipate the attack types commonly conducted against oil and gas IT corporate and control networks.
The vendor describes the audience as IT professionals who manage or direct their organization's IT infrastructure and are responsible for establishing and maintaining information security policies, practices, and procedures, with a focus on ICS and SCADA systems. Related roles named include SCADA systems personnel, business system analysts supporting SCADA interfaces, system administrators and engineers who administer, patch, and secure SCADA or ICS, and security consultants performing assessments of those environments.
Exam coverage follows eight modules: ICS/SCADA network defense, TCP/IP fundamentals and ICS/SCADA protocols, hacking methodology, vulnerability management, standards and regulations, securing the ICS network, bridging the air gap, and IDS/IPS. The exam has 75 multiple-choice questions in a two-hour window and is available through the EC-Council Exam Portal. Stated prerequisites include Linux command-line fundamentals, conceptual programming or scripting knowledge, essential networking concepts, basic security concepts, and familiarity with traffic inspection tools such as Wireshark, TShark, or TCPdump. Preparation should combine the module labs with hands-on packet analysis and review of the standards the course names.
What you'll study
About ICS/SCADA preparation
What is the exam format and how long is it?
The exam is multiple choice, with 75 questions and a duration of two hours, according to the vendor's exam details. It is available through the EC-Council Exam Portal. The published materials do not state a passing score, so plan to answer every question and use the full time rather than rushing.
Is the training hands-on or lecture only?
The vendor describes it as a hands-on training module that teaches the foundations of security and defending network architectures from attacks. The course outline lists labs alongside several modules, including a hacking ICS/SCADA networks protocols lab and a vulnerability assessment lab, so expect practical exercises rather than pure theory.
What prerequisites should I have before starting?
The vendor lists Linux operating system fundamentals including basic command-line usage, conceptual knowledge of programming or scripting, a solid grasp of essential networking concepts such as the OSI model, TCP/IP, networking devices and transmission media, and understanding of basic security concepts such as malware, intrusion detection systems, firewalls and vulnerabilities. Familiarity with Wireshark, TShark or TCPdump is highly recommended.
Who is this course actually designed for?
The vendor targets IT professionals who manage or direct their organization's IT infrastructure and are responsible for establishing and maintaining information security policies, practices and procedures, with a focus on ICS and SCADA systems. Named roles include SCADA systems personnel, business system analysts supporting SCADA interfaces, administrators and engineers securing SCADA or ICS, and consultants assessing those environments.
What does the exam cover?
The outline spans eight modules: introduction to ICS/SCADA network defense, TCP/IP 101 including ICS/SCADA protocols, introduction to hacking, vulnerability management, standards and regulations, securing the ICS network, bridging the air gap, and intrusion detection and prevention systems. Topics range from security posture and risk management to NERC CIP, ISA99, IEC 62443 and NIST SP 800-82.
How much does it cost and what training options exist?
The vendor advertises a single on-demand certification course starting at $999, a single live online certification course starting at $1,399, and unlimited on-demand certification courses starting at $3,999. Pricing and packaging can change, so confirm current options on the vendor site before purchasing.
What is the best study order?
Follow the module sequence: network defense foundations and the IT versus ICS/SCADA security model first, then TCP/IP and ICS/SCADA protocols, then hacking methodology, vulnerability management, standards, network hardening, air gap bridging, and finally IDS/IPS. The later modules assume the networking and vulnerability vocabulary built earlier, and IDS/IPS carries the largest weight.
What are common failure modes on this kind of exam?
Candidates often treat ICS like ordinary IT and miss safety and availability priorities, or skim the standards module and confuse NERC CIP, ISA99, IEC 62443 and NIST SP 800-82. Others memorize hacking steps without understanding how ICS/SCADA protocols differ. Weakness in TCP/IP layering or vulnerability scoring concepts such as CVSS also costs easy points.
Does the vendor publish a retake policy or certification validity period?
The source page does not state a retake policy or a validity period for this credential. It directs readers to the vendor's certification website for certification policies and FAQs. Check that site directly before scheduling, since those terms are set by the vendor and may change.