Postgraduate Diploma in Compliance Programmes and OT CSMS
Online 800 h Postgraduate Diploma in Compliance Programmes and OT CSMS. 8 modules covering IEC 62443-2-1 (security programme for asset owners), IEC 62443-3-3 (system security requirements) and Nozomi Guardian. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Define the governance structure of OT security.
Interpret the NIS2 regulatory framework and sector regulations.
Carry out OT risk analysis using zones and conduits.
Determine target security levels and technical requirements.
Document the processes of a cybersecurity management system.
Define metrics and continuous monitoring of the programme.
Plan the phased implementation of a CSMS.
Who it's for
- OT cybersecurity manager looking to specialise in Compliance Programmes and OT CSMS.
- Industrial security auditor looking to specialise in Compliance Programmes and OT CSMS.
- NIS2 compliance consultant looking to specialise in Compliance Programmes and OT CSMS.
- Control systems security engineer looking to specialise in Compliance Programmes and OT CSMS.
- OT risk analyst looking to specialise in Compliance Programmes and OT CSMS.
- Security programme manager looking to specialise in Compliance Programmes and OT CSMS.
- Graduates in engineering or sciences seeking to enter the energy sector.
What you'll work with
- IEC 62443-2-1 (security programme for asset owners)
- IEC 62443-3-3 (system security requirements)
- IEC 62443-3-2 (risk assessment and zones and conduits)
- Directive (EU) 2022/2555 (NIS2)
- ISO/IEC 27001 (information security management systems)
- ISO/IEC 27019 (information security in the energy sector)
- NIST SP 800-82 Rev. 3 (OT systems security)
8 modules · 800 h
1.1Differences between IT and OT security1.2Purdue model and ISA-95 architecture1.3Roles: owner, integrator and manufacturer1.4Structure of the ISA/IEC 62443 series1.5CSMS concept according to IEC 62443-2-11.6Policies and responsibilities1.7Alignment with ISO/IEC 270011.8Security committee and executive sponsorship1.9Security culture on the plant floor1.10Case study: OT maturity assessment
2.1NIS2 Directive (EU) 2022/25552.2CER Directive on critical entities2.3Law 8/2011 on critical infrastructure2.4Cyber Resilience Act (CRA)2.5Machinery Regulation (EU) 2023/12302.6Spanish National Security Scheme (Esquema Nacional de Seguridad)2.7NERC CIP and TSA in the USA2.8Incident notification obligations2.9Management responsibility2.10Workshop: obligations map for an industrial company
3.1Industrial asset inventory3.2Zones and conduits according to IEC 62443-3-23.3Initial and detailed risk assessment3.4Security levels SL-T, SL-C and SL-A3.5Consequences for physical safety3.6Integration with HAZOP and LOPA3.7CyberPHA methodology3.8Threats and adversaries in OT3.9Risk register and treatment3.10Practice: zoning and conduit partitioning of a plant
4.1Foundational Requirements (FR) of IEC 62443-3-34.2Identification and authentication4.3Use control and privileges4.4System integrity4.5Data confidentiality4.6Restricted data flow4.7Timely response to events4.8Resource availability4.9Component requirements of IEC 62443-4-24.10Laboratory: assessment of a controller against 4-2
5.1Patch management according to IEC 62443-2-35.2Change management in OT5.3Account management and remote access5.4Backup and recovery5.5Removable media management5.6Supplier security under IEC 62443-2-45.7Training and awareness5.8Physical security of facilities5.9Vulnerability management5.10Case study: patching procedure in a continuous process plant
6.1Passive monitoring of industrial networks6.2Anomaly detection in OT protocols6.3Integration with the SOC6.4Compliance indicators: KPI and KRI6.5OT security dashboard6.6C2M2 maturity model6.7Self-assessments and internal audits6.8ISASecure and IECEE certification6.9Continuous improvement of the programme6.10Workshop: designing an OT dashboard
7.1Multi-year roadmap7.2Budget and investment justification7.3Risk-based prioritisation7.4Organisational change management7.5Integration into new projects7.6Contracts and cybersecurity clauses7.7Security across the asset lifecycle7.8Lessons from incidents such as TRITON7.9Communication with senior management7.10Case study: CSMS roadmap
8.1Scope and context of the organization8.2Inventory and partition of the plant8.3RISK ASSESSMENT8.4Compliance Gap Analysis8.5Key Policies and Procedures8.6Implementation plan8.7Metrics and Audit8.8Budget and Government8.9Memory and presentation8.10Final review with the tutor
How you'll learn
Fully 100 % online training on the SEIUM Institute campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it compatible with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Nozomi Guardian, Claroty, Wireshark, advanced Excel, in free, academic or evaluation versions. Case studies are based on real procedures for segmentation into zones and conduits, gap analysis against IEC 62443, and NIS2 compliance audits. Assessment is continuous per module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Define the governance structure of OT security.
Interpret the NIS2 regulatory framework and sector regulations.
Carry out OT risk analysis using zones and conduits.
Determine target security levels and technical requirements.
Document the processes of a cybersecurity management system.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical standards texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme uses Nozomi Guardian, Claroty, Wireshark and advanced Excel. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
An own diploma from SEIUM Institute upon passing the continuous assessment and the integrative project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the advanced programme. Check the recognition policy when you enrol.
Related programmes
Postgraduate Diploma in HPC Depot Design and Peak Management
Online postgraduate diploma of 800 hours in HPC depot design and peak management, structured in 8 modules covering fleet electrification, high-power chargers, depot design, demand simulation,…
Postgraduate Diploma in PPAs, Auctions and Regulatory Risk Management
Online 800-hour Postgraduate Diploma in PPAs, Auctions and Regulatory Risk Management. 8 modules covering Royal Decree 960/2020 (Renewable Energy Economic Regime), Order TED/1161/2020 (REER auction timetable)…
Postgraduate Diploma in Active/Static Compensation and Power Quality
Online 800-hour Postgraduate Diploma in Active/Static Compensation and Power Quality. 8 modules covering IEEE 519-2022 (harmonic control), IEC 61000-3-6 (harmonic emission limits in MV and HV)…
More in Energy and Networks
All Energy and Networks programmes → · How to apply · Fees & financing · Scholarships