OT Security Certifications (2026): GICSP, ISA/IEC 62443 and CompTIA SecOT+ Compared

Last updated October 27, 2026. Details below come from GIAC, SANS, ISA and CompTIA’s own pages, checked on that date. Fees change often, so we link to each price page instead of listing them.

Operational technology (OT) runs plants, pipelines, power grids and water systems. Securing it takes a different mix of skills than office IT: safety procedures, PLCs and SCADA, industrial protocols such as Modbus and DNP3, and equipment that ISA notes has often been in place for decades. Three credentials come up most for this work: GIAC’s GICSP, ISA’s ISA/IEC 62443 certificates, and CompTIA’s new SecOT+.

The short version:

• You want the established, vendor-neutral OT practitioner certification: GICSP. It is on ISC2’s list of credentials that count toward CISSP experience and in the DoD 8140 matrix.
• Your employer, client or supplier contract follows the ISA/IEC 62443 standards: the ISA/IEC 62443 certificate track, starting with the Cybersecurity Fundamentals Specialist.
• You already hold CompTIA certifications and want an OT credential from the same vendor: SecOT+. It is not available yet. CompTIA is taking pre-orders and says it launches in December 2026.
• You already work in an ICS security operations center or response team: look at GIAC GRID after, or alongside, GICSP.

OT security certifications compared

Sources: GIAC pages for GICSP and GRID, GIAC renewal, the ISA/IEC 62443 Cybersecurity Certificate Program page and CompTIA’s SecOT+ page, all checked October 27, 2026. GIAC passing scores apply to specific exam versions, and GIAC tells candidates to confirm theirs in their GIAC account.

GIAC GICSP: the vendor-neutral OT practitioner certification

GIAC says GICSP “validates a practitioner’s capability to achieve security throughout the industrial control systems lifecycle, bridging expertise in IT, engineering, and cyber security” (GIAC). It is aimed at a mixed audience: ICS IT and OT support staff, ICS security analysts, security engineers, industry managers and vendors.

GIAC lists 10 exam objectives. They follow the Purdue reference architecture (PERA) from the field devices up:

• ICS overview, components and architecture: high-level ICS processes and roles, how ICS differs from IT, and the assets at Purdue levels 0 through 3, with levels and zones used to build a securable architecture.
• PERA level 0 and 1, and level 2 and 3 technology: what the devices at each level do and how they are targeted and attacked.
• Protocols, communications and wireless: TCP/IP and ICS-specific protocols, basic cryptography for protecting them, and the wireless technologies used in an ICS.
• Defense: hardening and patching the Windows and Unix-style systems found in ICS environments, intelligence gathering and threat modeling.
• Program and response: building an ICS security program and enforceable policies, and using risk to inform disaster recovery and incident response.

The exam is 82 questions in 3 hours with a 71% passing score for versions released on or after November 19, 2018, and it includes CyberLive questions in live lab environments. Exams are proctored remotely through ProctorU or on site at Pearson VUE, and you have 120 days from activation to sit your attempt. The affiliated course is SANS ICS410: ICS/SCADA Security Essentials, a six-day class that SANS says has 15 hands-on labs, a capstone capture-the-flag exercise and a hardware PLC that students take home. SANS asks for a basic understanding of networking, system administration, TCP/IP, network design, vulnerability assessment and risk before you attend, and points people new to the field to ICS310 first.

GICSP also carries weight outside OT teams. It is on ISC2’s list of credentials that can count for one year of the five-year CISSP experience requirement, and the DoD 8140 Qualification Matrix V2.1 lists it at the Advanced level for work role 531, Cyber Defense Incident Responder (DoD 8140 Document Library).

ISA/IEC 62443 certificates: training on the standard itself

ISA, the International Society of Automation, develops and maintains the ISA/IEC 62443 standards for industrial automation and control systems. ISA describes them as “the only globally recognized consensus-based standards created specifically for industrial automation and control systems” (ISA). Its certificate program follows the control system lifecycle, and each certificate requires an ISA course plus an exam:

Certificates 2, 3 and 4 can be taken in any order. ISA also runs a five-day Fast Track course, IC48, that covers the material of IC33, IC34 and IC37 and includes one exam for each of those certificates; you need Certificate 1 before you enroll. Courses come in self-paced modular, classroom and virtual classroom formats, and ISA lets you take the first module of each self-paced course free. ISA says you are not required to renew the certificates.

One point to be clear on: ISA calls these certificates, not certifications. They prove you completed ISA’s training and passed its exams on the standard. If a job posting asks for “62443 experience,” this is the credential that maps most directly to it.

CompTIA SecOT+: what CompTIA has published so far

SecOT+ is CompTIA’s OT security certification. As of October 27, 2026, its official page says the exam is available for pre-order and “scheduled to launch on or around December 8, 2026.” The exam details list on the same page gives a launch date of December 1, 2026, so check the page again before you plan a test date. You cannot sit the exam yet.

What CompTIA has published:

• Exam code: SOT-001 (version V1), in English.
• Recommended experience: 3+ years of hands-on work in OT environments and 2+ years implementing OT cybersecurity solutions. CompTIA describes it as a certification for experienced professionals.
• Retirement: estimated three years after launch.
• Six objective areas: OT Systems and Safety Foundations, OT Risk Management, OT Threat Intelligence, OT Cybersecurity Architecture, Design, and Engineering, OT Security Operations, and OT Incident Management.

The objectives start with safety: lockout/tagout, job safety analysis, PPE and hazard identification. From there they cover PLCs, HMIs and SCADA systems, control logic and set points, protocols such as Modbus, DNP3, BACnet and Profinet, historical OT attacks such as Stuxnet and Industroyer, and incident response using the PICERL model and ICS4ICS.

What CompTIA has not published yet: the number of questions, the time limit, the passing score and any DoD 8140 listing. We will add those when CompTIA does. Our earlier news coverage of the SecOT+ announcement is here and here.

GIAC GRID: for ICS detection and response teams

GRID is GIAC’s second ICS certification. GIAC says it validates “Active Defense strategies made for protecting Industrial Control System (ICS) networks and systems,” including network security monitoring, digital forensics and incident response in ICS environments (GIAC). Its objectives cover visibility and asset awareness, monitoring ICS protocols, detection, threat hunting, threat intelligence and ICS incident response. The exam is 75 questions in 2 hours with a 74% passing score. The affiliated course is SANS ICS515: ICS Visibility, Detection, and Response, and SANS recommends ICS410 before it. DoD 8140 Matrix V2.1 lists GRID at the Intermediate level for work role 531. See our incident response certifications guide for how GRID compares with GCIH and GCFA.

Which OT security certification to take first

• Coming from IT with no OT background: get the networking and security basics in place first. Network+ and Security+ cover the TCP/IP and security concepts that SANS asks ICS410 students to bring. Then GICSP, or ISA Certificate 1 if your plant follows 62443.
• Coming from controls engineering or plant operations: ISA Certificate 1 builds the security vocabulary on top of what you know about control systems. GICSP is the broader next step.
• Working for a supplier or integrator: ISA/IEC 62443 certificates. ISA says asset owners, system integrators and suppliers all rely on the 62443 standards.
• Working in a DoD or defense contractor role: GICSP or GRID, because both appear in the DoD 8140 matrix. See our DoD 8140 certifications guide for the full role lists.
• Already CompTIA-certified and not in a hurry: wait for SecOT+ to launch and for CompTIA to publish the exam format.

For how OT fits into a wider career plan, see our cybersecurity certification path. For the attacker techniques these exams expect you to know, our coverage of MITRE EMB3D for OT and ICS devices is a useful companion.

Who pays for OT security certifications

An employer training budget is the usual first ask. Before paying yourself, ask whether your site or your customers follow ISA/IEC 62443 or need DoD 8140 qualification, since that decides which credential your employer will value.

• GIAC: exam attempts can be bought on their own or bundled with a SANS course. Current fees are on GIAC’s pricing page.
• ISA: each certificate comes with its course, and the first self-paced module of each course is free on the ISA program page.
• CompTIA: SecOT+ pre-orders are on the SecOT+ page, subject to CompTIA’s pre-order terms.

OT security certification questions

Sources

• GIAC, Global Industrial Cyber Security Professional (GICSP): giac.org
• GIAC, Response and Industrial Defense (GRID): giac.org
• GIAC, Renewing your certification: giac.org
• GIAC, Pricing: giac.org
• SANS, ICS410: ICS/SCADA Security Essentials: sans.org
• SANS, ICS515: ICS Visibility, Detection, and Response: sans.org
• ISA, ISA/IEC 62443 Cybersecurity Certificate Program: isa.org
• CompTIA, SecOT+ (V1, SOT-001): comptia.org
• ISC2, CISSP experience requirements: isc2.org
• DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1): cyberworkforce.mil

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.