The short answer
There are now four common routes to an OT or ICS security certification, and two of them are new:
| Certification | From | Level | Status (October 2026) |
|---|---|---|---|
| GICSP (Global Industrial Cyber Security Professional) | GIAC | Practitioner, broad | Established; usually paired with the SANS ICS410 course |
| GRID (Response and Industrial Defense) | GIAC | Practitioner, defense and response | Established |
| SecOT+ (exam SOT-001) | CompTIA | Vendor-neutral, early-career to mid | Launching December 2026 |
| OT Security Practitioner (exam 810-115) | Cisco | Entry practitioner, Cisco-flavored | Learning path from November 2026; exam opens February 2027 |
| ISA/IEC 62443 Cybersecurity certificates | ISA | Standard-specific, from fundamentals to expert | Established |
If you come from IT and want one vendor-neutral credential, SecOT+ is designed for you. If your plant runs Cisco industrial switches and Cyber Vision, the Cisco exam lines up with the tools you'll use. If you want the certification hiring managers already search for, it is GICSP. If you design or assess systems against the standard, take the ISA 62443 certificates.
Dates and formats change; check each body's own page before you book.
GIAC GICSP
GICSP is GIAC's broad industrial certification, aimed at IT security, engineering and operations people who need a shared language. GIAC lists its areas as ICS components and constraints, attack surfaces, defense architectures, incident response in control system environments, and governance. It has been around long enough that job ads ask for it by name, which makes it the safe choice for a CV. The matching SANS course is ICS410; the course is not required to sit the exam, but most candidates take it.
CompTIA SecOT+ (SOT-001)
SecOT+ is CompTIA's new vendor-neutral OT security certification. CompTIA's draft objectives list six domains: OT systems and safety foundations, OT risk management, OT threat intelligence, OT cybersecurity architecture, design and engineering, OT security operations, and OT incident management. Security operations carries the most weight. It is aimed at people with some security or OT experience, in the way Security+ is for IT.
Cisco OT Security Practitioner (810-115)
Cisco's exam covers OT and ICS architectures, foundational security controls, setting up a secure industrial network, asset visibility and threat detection, segmentation, OT monitoring and incident response, working with safety and operations, and the main frameworks (ISA/IEC 62443 and NIST SP 800-82). Expect the Cisco products to appear; the architecture and framework topics are vendor-neutral and are the same material the other exams test.
ISA/IEC 62443 certificates
ISA runs a certificate program built on the 62443 series, from a fundamentals specialist up through risk assessment, design and maintenance specialists to expert. These suit integrators, assessors and anyone who has to argue about security levels for a living.
What they all test
Line the four up and the overlap is large. Every one of them expects you to:
- Explain the Purdue model and where the industrial DMZ sits (free chapter).
- Partition a system into zones and conduits and give each a target security level (guide).
- Know what NIST SP 800-82 and ISA/IEC 62443 are for (guide).
- Explain why OT puts safety and availability first (guide).
- Restrict traffic between zones and write it down (free chapter).
- Build and keep an asset inventory (OT asset inventory guide, free appendix).
- Plan secure remote access and incident response with operations.
The OT security study map takes each exam's topics in turn and points to the free guide or Book 1 chapter that covers it, and says plainly where we don't.
Not sponsored by, endorsed by or affiliated with Cisco Systems, Inc., CompTIA, Inc., GIAC or ISA. Cisco is a trademark of Cisco Systems, Inc. CompTIA and SecOT+ are trademarks of CompTIA, Inc. GIAC, GICSP and GRID are trademarks of their owner. Certification names are used only to describe the exams. This page contains no exam questions and nothing from any live exam.
