How to use this map
Three OT security certifications are arriving or growing at once: Cisco's OT Security Practitioner exam (810-115), CompTIA SecOT+ and GIAC's GICSP. Their topics overlap heavily. This map takes each exam's published topic areas, in our own words, and points to the free page or Book 1 chapter that teaches it.
It is a study aid for the underlying skills, not exam prep in the question-bank sense. There are no exam questions here, and nothing from any live exam. Always study from the exam body's current published objectives; this map follows them, it doesn't replace them.
Where we don't cover a topic, the map says so. Use the standards themselves (ISA/IEC 62443, NIST SP 800-82) and the exam body's own course for those.
Start here if you're new to OT: OT security basics for IT people, then the Purdue model chapter.
The core: topics every exam shares
| Topic | Free | Book 1 |
|---|---|---|
| IT vs OT priorities, safety first | OT security basics | Ch. 0, 1 |
| Purdue model levels and the industrial DMZ | Purdue model chapter | Ch. 3 |
| Zones, conduits and target security levels | 62443 zones and conduits | Ch. 3, 10 |
| Restricting traffic: default deny and the flow register | Flow register chapter | Ch. 9, 10 |
| Frameworks: ISA/IEC 62443 and NIST SP 800-82 | 62443 guide, 800-82 guide | Ch. 3, 16 |
| Asset inventory | OT asset inventory, NetBox import appendix | Ch. 5, 12, App. F |
| Remote access paths | 800-82 guide | Ch. 9, 14 |
| Redundancy and availability | Ch. 7 | |
| Checking the firewall enforces the design | Ch. 16 |
Cisco OT Security Practitioner (810-115)
Cisco's learning path opens in November 2026 and the exam in February 2027. Its competency areas, paraphrased:
| Cisco topic area | Where to study it here | Not covered here |
|---|---|---|
| OT and ICS architectures | Purdue model chapter, Book 1 Ch. 3, 4 | |
| Foundational security controls | OT security basics | Host hardening and patching |
| Secure industrial network setup | Book 1 Ch. 4, 5, 7 (VLANs, cabling, rings) | Switch hardening commands; use Cisco's own material |
| Asset visibility and threat detection | OT asset inventory, NetBox import appendix, Book 1 Ch. 12 | Threat detection tooling |
| Basic segmentation | 62443 zones and conduits, flow register | |
| OT monitoring and incident response | Book 1 Ch. 9 (log paths), Ch. 13 (drift) | Incident response process |
| Alignment with safety and operations | OT security basics, Book 1 Ch. 1, 3 | |
| OT frameworks | 62443 guide, 800-82 guide |
CompTIA SecOT+ (exam SOT-001)
CompTIA's objectives list six domains. Launch is planned for December 2026.
| SecOT+ domain | Where to study it here | Not covered here |
|---|---|---|
| OT systems and safety foundations | OT security basics, Purdue model chapter | Lockout/tagout and plant safety practice |
| OT risk management | 62443 zones and conduits (security levels) | Risk assessment method in depth |
| OT threat intelligence | Threat actors and intelligence sources | |
| OT cybersecurity architecture, design and engineering | Purdue model chapter, 62443 guide, 800-82 guide, Book 1 Ch. 3, 4, 7, 9, 10 | |
| OT security operations | Flow register, Book 1 Ch. 13, 16 | Security monitoring tools |
| OT incident management | Incident response process |
Architecture, design and engineering is where a network diagram does the most work, and it's what Book 1 is about.
GIAC GICSP (Global Industrial Cyber Security Professional)
GIAC lists five areas for GICSP:
| GICSP area | Where to study it here | Not covered here |
|---|---|---|
| ICS components and constraints | OT security basics, Book 1 Ch. 3 | Controller internals |
| Attack surfaces | Purdue model chapter (paths into the plant) | Attack tools |
| Defense architectures | 62443 guide, 800-82 guide, Book 1 Ch. 3, 9, 10, 16 | |
| Incident response in control systems | Incident response process | |
| Governance and resources | 800-82 guide, 62443 guide | Program governance in depth |
Which certification should I take?
See OT security certifications compared for who each one suits, from the established GICSP to the new SecOT+ and Cisco exams.
The book behind the map
Manufacturing Network Diagrams (Book 1) is the method every architecture row above points at: Purdue levels and zones, the IDMZ, safety zones, SL-T on every box, conduits written as a flow register, rings and failover, remote access paths, NetBox as the asset inventory, and checking that the firewall enforces what you drew. It uses one fictional plant from blank page to an audit-ready drawing set, so you can see each idea on a real-looking drawing rather than in a definition. Exams test whether you know the ideas. Work tests whether you can draw them for your own site.
Not sponsored by, endorsed by or affiliated with Cisco Systems, Inc., CompTIA, Inc., GIAC or ISA. Cisco is a trademark of Cisco Systems, Inc. CompTIA and SecOT+ are trademarks of CompTIA, Inc. GIAC, GICSP and GRID are trademarks of their owner. Certification names are used only to describe the exams. This page contains no exam questions and nothing from any live exam.
