ISA/IEC 62443 PROGRAM
IC33Cybersecurity Risk Assessment for New and Existing Industrial Systems
Version 4.00
Assess IACS systems and document their cybersecurity requirements.
From assessment to
security requirements.
Learn to systematically assess existing and new industrial automation and control systems (IACS), identify vulnerabilities, analyze threats and consequences, and develop a risk-based cybersecurity requirements specification (CRS).
IC33 begins with the first phase of the IACS Cybersecurity Lifecycle, as defined in ISA/IEC-62443-1-1. Students identify and document IACS assets and assess cybersecurity vulnerabilities and risks to understand the high-risk vulnerabilities that require mitigation. Under ISA/IEC-62443-2-1, these assessments apply to both new (greenfield) and existing (brownfield) applications.
The assessment process includes developing a zone and conduit model, identifying security level targets, and documenting project cybersecurity requirements in a CRS.
Course at a glance
Duration: 24 hours / 3 days
Credits: 2.1 CEUs
Language: Spanish · slides in English
Labs: approximately 10 hours
Course version: 4.00
Mandatory prerequisites
Successful completion of IC32: Using the ISA/IEC-62443 Standards to Secure Your Control Systems and passing the ISA/IEC-62443 Cybersecurity Fundamentals Specialist certificate exam are mandatory prerequisites for this course.
Learning objectives
- Identify and document the scope of the IACS under assessment
- Specify, gather, or generate the cybersecurity information required to perform the assessment
- Identify or discover cybersecurity vulnerabilities inherent in IACS products or system design
- Interpret the results of a Process Hazard Analysis (PHA)
- Organize and facilitate a cybersecurity risk assessment for an IACS
- Identify and evaluate realistic threat scenarios
- Identify and assess the effectiveness of existing countermeasures
- Identify gaps in existing policies, procedures, and standards
- Evaluate the cost, complexity, and effectiveness of new countermeasures to make meaningful recommendations
- Establish and document security zones and conduits
- Develop a CRS
Course content
A structured approach to industrial cybersecurity assessment.
01 Preparing for an Assessment
- Security lifecycle
- Scope
- System architecture diagrams
- Network diagrams
- Asset inventory
- Cyber criticality assessment
02 Cybersecurity Vulnerability Assessment
- Risk
- Types of cybersecurity vulnerability assessments
- High-level assessments
- Passive and active assessments
- Penetration testing
- Conducting high-level assessments
- Assessment tools
- Cyber Security Evaluation Tool (CSET)
03 Conducting Vulnerability Assessments
- Vulnerability process
- Pre-assessment
- Standards
- Research
- Kickoff and walkthrough
- Passive data collection
- Active data collection
- Penetration testing
04 Cyber Risk Assessments
- Understanding risk
- Risk identification, classification and assessment
- ISA/IEC-62443-2-1
- System under Consideration (SuC)
- Conduct high-level risk assessment
- Consequence scale
- Establish zones and conduits
- Zone and conduit drawings and documentation
- Document cybersecurity requirements
05 Conducting Cyber Risk Assessments
- Detailed cyber risk assessment process
- Threats
- Vulnerabilities
- Consequences
- Likelihood
- Calculate risk
- Security levels
- Countermeasures
- Residual risk
- Documentation
06 Critiquing System Architecture Diagrams
- Asset inventory
- Gap assessment
- Windows vulnerability assessment
- Capturing Ethernet traffic
- Port scanning
- Using vulnerability scanning tools
- Perform a high-level risk assessment
- Creating a zone and conduit diagram
- Perform a detailed cyber risk assessment
- Critiquing a cybersecurity requirements specification
07 Documentation and Reporting
- Document to maintain
- Required reports
- Zone and conduit diagrams
- CRS
Hands-on laboratories
Apply concepts through guided exercises, including:
- Asset inventory
- Perform a high-level cybersecurity risk assessment
- High-level risk assessment using CSET
- Vulnerability scanning
- Penetration testing of Windows XP using Kali Linux
- Creating a zone and conduit diagram
- Detailed risk assessment
- Optional: Basic security analysis (GFI Languard)
Laboratory access
- Students use the cyber lab at ISA headquarters to complete the laboratory exercises.
- Access to a virtual lab is available during class only.
- Approximately 10 hours of laboratory activity.
ISA certification
IC33 is the second course in the ISA/IEC-62443 Cybersecurity Certificate Program. Pass the exam to earn the ISA/IEC-62443 Cybersecurity Risk Assessment Specialist certificate.
Course registration includes one exam fee. The certification exam is in English.
A certificate of completion indicating the total number of CEUs earned is provided upon successful completion of the course.
Completion of training and earning the professional certificate are separate: the certificate requires passing the examination.
Who should attend?
- Control systems engineers and managers
- System integrators
- IT engineers and managers in industrial facilities
- Plant managers
- Plant safety and risk management personnel
Recommended resources
Standards
- ISA-62443-1-1-2007 — Security for Industrial Automation and Control Systems, Part 1-1: Terminology, Concepts, and Models
- ISA-62443-2-1 (99.02.01)-2009 — Security for Industrial Automation and Control Systems, Part 2-1: Establishing an Industrial Automation and Control Systems Security Program
- ANSI/ISA-62443-3-2-2020 — Industrial Automation and Control Systems, Part 3-2: Security Risk Assessment for System Design
- ANSI/ISA-62443-3-3 (99.03.03)-2013 — Industrial Automation and Control Systems, Part 3-3: System Security Requirements and Security Levels
Books and recommended reading
- ISA Cybersecurity Library
- Industrial Automation and Control System Security Principles, Second Edition, by Ronald L. Krutz, PhD, PE
Language and study materials
For Spanish- and Portuguese-speaking audiences, study materials are provided in English. The professional certification exam is available only in English.
The editions listed above are the recommended resources identified on the supplied course page.
Training scope
ISA training focuses on helping participants correctly understand and interpret the requirements of the ISA/IEC-62443 series of standards and what needs to be done. Laboratory exercises and products support understanding of the concepts. The course does not aim to recommend a particular solution or demonstrate how to comply with every requirement.
Prepare for your next professional step.
Not sure this course is right for you? Contact our experts for guidance based on your professional objectives and your organization’s needs.
