PCN PEP study plan
PCN PEP · Give each week a clear focus.
8 weeks · About 7 hours per week
Process Control Network Fundamentals
Map the Purdue Enterprise Reference Architecture levels 0 through 5 and label at least three devices that typically sit at each level
Differentiate IT and OT priorities by listing five concrete ways availability, patching cadence, and change control diverge between them
Define the core vocabulary of a Process Control Network, including PLC, RTU, DCS, HMI, historian, and safety instrumented system, in your own words
Trace how a sensor reading travels from field device to historian and identify each trust boundary it crosses
Your checkpoint
A one-page annotated Purdue model diagram with devices, trust boundaries, and a written IT-versus-OT comparison table of at least five rows
Industrial Networking and Protocols
Compare Modbus TCP, DNP3, PROFINET, and EtherNet/IP on transport, addressing model, and built-in security features
Explain how OPC Classic differs from OPC UA in terms of ports, discovery, and authentication
Identify where each of these protocols typically appears in an industrial environment and why legacy protocols persist
List the security weaknesses inherent in unauthenticated industrial protocols and the compensating controls that mitigate them
Your checkpoint
A protocol comparison matrix covering at least six protocols across transport, default ports, authentication support, and typical compensating controls
Network Architecture and Segmentation
Design a zone-and-conduit segmentation scheme for a hypothetical plant with a control zone, a DMZ, and an enterprise zone
Explain how a demilitarized zone between IT and OT limits lateral movement and where data diodes or unidirectional gateways fit
Contrast VLAN segmentation, firewall enforcement, and air gaps in terms of real-world effectiveness and operational cost
Describe how a jump host or remote-access broker reduces exposure compared with direct VPN into the control network
Your checkpoint
A network segmentation diagram for a fictional facility showing zones, conduits, firewall rules at a summary level, and the rationale for each boundary
Security Controls and Defense in Depth
Build a defense-in-depth control stack that maps at least two controls to each Purdue level
Explain the role of application allowlisting, endpoint hardening, and patch staging in protecting control endpoints
Describe how security awareness, physical security, and supply chain controls reinforce technical safeguards in an OT setting
Justify why no single control is sufficient and how layered controls create detection opportunities when one fails
Your checkpoint
A defense-in-depth control matrix mapping at least fifteen controls to Purdue levels, with the failure mode each control addresses
Security Controls and Defense in Depth & Risk Assessment and Compliance
Perform a qualitative risk assessment on a sample control system using likelihood and consequence scoring
Map the assessment findings to a recognized OT security framework such as IEC 62443 or NIST SP 800-82 at a high level
Identify the compliance drivers that commonly apply to critical infrastructure operators and how they shape control selection
Prioritize the top five risks and propose a mitigation and residual-risk statement for each
Your checkpoint
A risk register with at least ten identified risks, scored likelihood and consequence, mapped to framework requirements, and paired with prioritized mitigations
Monitoring, Detection, and Incident Response
Identify the telemetry sources that matter for OT detection, including network taps, firewall logs, endpoint logs, and process anomaly signals
Explain how passive monitoring differs from active scanning and why active scanning endangers control environments
Draft an incident response playbook for a suspected control-network intrusion covering containment, isolation, and safe recovery
Describe how to preserve forensic evidence without disrupting a running process
Your checkpoint
A one-page incident response playbook for an OT intrusion scenario, including detection triggers, containment steps, escalation contacts, and evidence-handling notes
Operations, Maintenance, and Lifecycle Management & Process Control Network Fundamentals
Outline a change management process for control system assets that accounts for uptime constraints and vendor involvement
Describe patch and vulnerability management strategies suitable for legacy and unpatchable devices
Explain asset inventory, configuration baselines, and lifecycle planning as foundations of OT security hygiene
Review the Purdue model and vocabulary from week one and correct any gaps you find
Your checkpoint
An asset lifecycle and change management procedure document covering inventory, baseline configuration, patch staging, and end-of-life handling
Risk Assessment and Compliance & Monitoring, Detection, and Incident Response & Operations, Maintenance, and Lifecycle Management
Synthesize the domains into a single reference architecture and control narrative for a sample facility
Complete a timed practice assessment across all seven domains and review every missed question
Close knowledge gaps by revisiting the weakest domains and rewriting your own notes on them
Rehearse explaining the top ten exam concepts aloud in plain language without notes
Your checkpoint
A full practice assessment score log with a written remediation plan for each missed question and a final one-page summary of the ten highest-impact concepts
Milestones
Week 2: Can explain the Purdue model and at least four industrial protocols from memory, and score at least 80 percent on a self-made quiz covering domains 1 and 2
Week 4: Can draw a segmented architecture and justify each control in a defense-in-depth stack without referring to notes
Week 6: Can walk through an OT incident from detection to recovery and correctly identify the telemetry that would reveal it
Week 8: Score at least 85 percent on a full-length timed practice assessment and have a written remediation plan for every missed item