Course in Academic Regulation in OT Cybersecurity
Online 300-hour course in academic regulation in OT cybersecurity. 6 modules covering IEC 62443 (security of industrial automation and control systems), Directive (EU) 2022/2555 (NIS2) and Nozomi Networks Guardian. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this programme. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Characterise operational technology and its differences from IT.
Interpret the legal obligations for essential operators and critical infrastructure.
Apply the IEC 62443 series to zones and conduits in an industrial system.
Assess risks and select proportionate security controls.
Plan resilience exercises and OT incident response.
Audit the security level of an industrial facility.
Develop an OT cybersecurity programme for an organisation.
Who it's for
- Industrial cybersecurity engineer who wants to specialise in Academic Regulation in OT Cybersecurity.
- OT security manager who wants to specialise in Academic Regulation in OT Cybersecurity.
- Auditor of industrial control systems who wants to specialise in Academic Regulation in OT Cybersecurity.
- Risk analyst for critical infrastructure who wants to specialise in Academic Regulation in OT Cybersecurity.
- NIS2 compliance consultant who wants to specialise in Academic Regulation in OT Cybersecurity.
- Secure automation engineer who wants to specialise in Academic Regulation in OT Cybersecurity.
- Engineering or science graduates looking to enter the energy sector.
What you'll work with
- IEC 62443 (security of industrial automation and control systems)
- Directive (EU) 2022/2555 (NIS2)
- NIST SP 800-82 (security of industrial control systems)
- Directive (EU) 2022/2557 (resilience of critical entities)
- Law 8/2011 (protection of critical infrastructure)
- Royal Decree 43/2021 (security of networks and information systems)
- ISO/IEC 27019 (security in the energy sector)
6 modules · 300 h
1.1Differences between operational technology and information technology1.2Affected sectors and their particularities1.3Typical layered architecture1.4Industrial protocols and their original security1.5Physical consequences of a logical incident1.6Regulatory and supervisory landscape1.7Competent authorities and their division of responsibilities1.8Vocabulary and acronyms of the field1.9Sources of guidance and good practice1.10Exercise: locating a plant's assets by layer
2.1European directive on resilience and cybersecurity2.2National transposition and obligated entities2.3Critical infrastructure protection law2.4Operator security plans and sector-specific plans2.5Mandatory incident notification and deadlines2.6Supply chain obligations2.7Sector regulation: energy, water, transport and health2.8Penalty regime and liability2.9Supervision, inspection and requirements2.10Practice: mapping an operator's obligations
3.1Family of security standards for control systems3.2Security levels and their assignment3.3Requirements for the operator, the integrator and the manufacturer3.4Zones and conduits model3.5Product and process certification3.6Relationship with information management standards3.7Guidance from national cybersecurity centres3.8Equivalences between frameworks3.9Documentation required in an audit3.10Practice: assigning security levels to a plant
4.1Inventory of assets and data flows4.2Combined security and process risk analysis4.3Analysis of consequences in the physical process4.4Technical controls: segmentation, access and monitoring4.5Organisational controls and procedures4.6Vulnerability management in environments that cannot be shut down4.7Management of remote access by suppliers4.8Management of removable media and laptops4.9Residual risk and its documented acceptance4.10Practice: risk assessment of a control system
5.1Industrial incident response plan5.2Manual and degraded mode operation5.3Business continuity and recovery5.4Backups of configurations and logic5.5Sector-specific exercises and drills5.6Coordination with the national centre and the sector5.7Maturity and compliance indicators5.8Internal and external audit5.9Training for operations and maintenance staff5.10Practice: designing a sector-specific exercise
6.1Choice of operator and its facility6.2Map of applicable legal obligations6.3Inventory of assets and assignment of levels6.4Risk and consequence assessment6.5Design of technical and organisational controls6.6Response and continuity plan6.7Audit programme and indicators6.8Training and exercise plan6.9Cybersecurity plan report6.10Project defence
How you'll learn
Fully 100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it possible to combine the programme with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Nozomi Networks Guardian, Claroty, Wireshark, CSET (CISA), in free, academic or evaluation versions. Tests are studied using real laboratory procedures for PLCs and SCADA, IEC 62443 risk assessment and industrial incident response exercises. Assessment is continuous across each module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Characterise operational technology and its differences from IT.
Interpret the legal obligations for essential operators and critical infrastructure.
Apply the IEC 62443 series to zones and conduits in an industrial system.
Assess risks and select proportionate security controls.
Plan resilience exercises and OT incident response.
Where this takes you
Requirements
- No prior degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours, spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme works with Nozomi Networks Guardian, Claroty, Wireshark, CSET (CISA). Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
An SEIUM own diploma upon passing the continuous assessment and the integrative project. It is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area count towards the higher-level programme. Check the recognition policy when you enrol.
Related programmes
Baja 1000 Vehicle Preparation Course
Online 300-hour course in Baja 1000 vehicle preparation. 6 modules covering the SCORE International Rulebook (Baja technical regulations), SFI 38.1 (head and neck restraint systems) and…
Multimodal Accessibility Course in Airports
The Multimodal Accessibility in Airports Course focuses on adapting airport infrastructure to ensure the inclusion of people with diverse needs. Key aspects covered include signage, space…
ISO 21448 (SOTIF) Course: Safety of the Intended Functionality
Online 300 h course in ISO 21448 (SOTIF): safety of the intended functionality. 6 modules covering ISO 21448 (SOTIF), ISO 26262 (functional safety) and CARLA. Assigned…
More in Electromobility, Batteries & Hydrogen
All Electromobility, Batteries & Hydrogen programmes → · How to apply · Fees & financing · Scholarships