Lead SCADA Security Manager study plan

Map the full SCADA/ICS reference architecture for one utility you know (field devices, RTUs/PLCs, HMIs, historians, DMZ, enterprise) and label every trust boundary and conduit

Enumerate Purdue Model levels 0-5 and write one sentence per level describing what a compromise at that level would let an attacker do

List the top six ICS-specific protocols in your environment (e.g., Modbus TCP, DNP3, OPC UA, IEC 61850, PROFINET) and note which have no native authentication or encryption

Draft a one-page threat-actor profile distinguishing nation-state, insider, and ransomware crews by intent, dwell time, and likely initial access vector against OT

Walk through the ICS Cyber Kill Chain and the MITRE ATT&CK for ICS tactics, and place two realistic techniques under each stage

Analyze at least two public ICS incident case studies and extract the initial access path, the pivot into OT, and the safety consequence

Explain how an OT network monitoring sensor passively baselines traffic and which anomalies (new device, new protocol, unauthorized command) it should alert on

Compare three OT segmentation approaches (air gap, data diode, industrial firewall DMZ) on cost, operational friction, and residual risk

Build a role-and-responsibility RACI for a converged SOC that spans IT and OT monitoring and escalation

Design a vulnerability management workflow that triages OT CVEs by exploitability, asset criticality, compensating controls, and safe patch window rather than CVSS alone

Write the detection and escalation runbook steps for a suspected unauthorized HMI login, naming who gets paged and in what order

Draft a security awareness module for control-room operators covering USB hygiene, phishing, and reporting anomalies

Draft an OT asset inventory schema (owner, criticality, firmware, network segment, safety impact) and populate it for ten representative assets

Compare identity and access controls for OT: MFA at the enterprise edge, jump hosts, privileged access management, and vendor remote access

Explain defense-in-depth layering for an ICS and identify where each layer fails if the DMZ is bypassed

Review a sample incident response plan and mark which steps assume IT-only assumptions that break in OT

Explain cryptographic controls relevant to OT (TLS for OPC UA, signed firmware, code signing) and where legacy devices force compensating controls

Describe secure remote-access architecture for vendors: bastion host, session recording, time-bound accounts, and approval workflow

Map the security controls required by a recognized standard framework to the layers of your architecture

Draft a data-classification note for process data, engineering drawings, and safety setpoints, and specify handling rules for each

Build a risk register with at least eight OT risks, each scored on likelihood, safety impact, regulatory exposure, and residual risk after controls

Map the obligations from relevant regulations and standards (e.g., NERC CIP, IEC 62443, NIS2) to specific controls in your program

Draft a governance structure clarifying who owns OT security decisions versus plant operations and who accepts residual risk

Write a third-party/vendor risk questionnaire with at least ten questions specific to ICS suppliers and integrators

Define RTO and RPO for each critical OT system and identify which systems cannot be restored from backup alone

Design and document a tested backup and recovery procedure for PLC logic, HMI configurations, and historian data, including offline media handling

Distinguish between business continuity, disaster recovery, and incident response in an OT context and assign the trigger for each

Write a tabletop exercise scenario for a ransomware infection that reaches the historian and plan the facilitation questions

Synthesize all domains into a single program maturity self-assessment scored across the five exam domains

Complete timed practice sets weighted to the domain percentages and log every missed question by domain

Re-teach the three weakest domain areas in writing without notes, then verify against source material

Rehearse explaining a board-level OT security posture summary in under five minutes