# IEC 62443 Training Paths Explained: ISA Certificates, Roles and Free Practice (2026)

> The ISA/IEC 62443 Cybersecurity Certificate Program explained: the four certificates (IC32, IC33, IC34, IC37), the Expert designation, the IC48 fast track, which parts of the standard matter for asset owners, integrators and product suppliers, and how to practise zones, conduits and security levels free.

Source: https://playciso.com/blog/iec-62443-training-paths-explained · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

ISA/IEC 62443 is the main international series of standards for securing industrial automation and control systems. It is written for three audiences at once (the asset owner who runs the plant, the integrator who builds the system and the supplier who makes the products), which is why training on it can feel confusing. This guide explains how the standard is organised, what each ISA certificate covers, and which path fits your job. ## How is the IEC 62443 series organised? The series has four groups. You do not need all of it; you need the parts for your role. GroupKey partsWhat it coversMain audience 1: General1-1 and relatedTerms, concepts and models, including zones, conduits and security levelsEveryone 2: Policies and procedures2-1 (security program for asset owners), 2-3 (patch management), 2-4 (requirements for service providers)How an organisation runs OT security day to dayAsset owners, service providers 3: System3-2 (risk assessment, zones and conduits), 3-3 (system security requirements and security levels)Breaking a system into zones, assessing risk and setting a target security level per zoneAsset owners, integrators 4: Component4-1 (secure product development lifecycle), 4-2 (technical requirements for components)How products are built and what security capabilities they must haveProduct suppliers Two ideas run through the whole series. **Zones and conduits**: group assets with similar security needs into zones, and control every communication path between zones through a defined conduit. **Security levels** (SL 1 to SL 4): the target level a zone needs (SL-T) is compared with the level its controls actually achieve (SL-A), from protection against casual violation up to protection against sophisticated, well-resourced attackers. Security levels are assessed against seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability. ## What are the ISA/IEC 62443 certificates? ISA runs the ISA/IEC 62443 Cybersecurity Certificate Program. As of October 2026 it works like this: CertificateCoursePrerequisiteWhat you learnFormats 1. Cybersecurity Fundamentals SpecialistIC32NoneThe concepts, lifecycle and structure of the standardSelf-paced (IC32M), classroom, virtual classroom, instructor-guided online 2. Cybersecurity Risk Assessment SpecialistIC33Certificate 1Assessing a new or existing system and writing a cybersecurity requirements specificationSelf-paced, classroom, virtual classroom, instructor-guided online 3. Cybersecurity Design SpecialistIC34Certificate 1Selecting and implementing countermeasures to reach the target security level for each zone and conduitSelf-paced, classroom, virtual classroom 4. Cybersecurity Maintenance SpecialistIC37Certificate 1Operating and maintaining the system: monitoring, incident response, keeping countermeasures effectiveSelf-paced, classroom, virtual classroom Cybersecurity ExpertNoneAll four certificatesAwarded automaticallyn/a Each certificate needs a passed exam. ISA states that the certificates do not require renewal. The first module of each self-paced course is free, so you can try the format before paying (IC32M01, Introduction to Control Systems Security, is the first). ISA does not publish course prices on the program page; check isa.org for the current figure and promotions. A five-day **Fast Track** (IC48, classroom or virtual) replaces IC33, IC34 and IC37 for people who have already passed IC32 and includes one exam per remaining certificate. Separate from personal certificates, the ISASecure scheme certifies products and development processes against parts 4-1 and 4-2. That matters if you work for a supplier; it is not a personal qualification. ## Which IEC 62443 path fits your role? RoleParts to focus onSuggested certificatesFree practice Asset owner (plant, utility, manufacturer)2-1, 3-2, 3-3Fundamentals → Risk Assessment → Maintenance[OT Asset Ranker](/tools/ot-asset-ranker), [Safe-to-Isolate Matrix](/tools/ot-safe-to-isolate-matrix) System integrator / engineering contractor2-4, 3-2, 3-3Fundamentals → Design → Risk Assessment[Purdue Model Builder](/tools/purdue-builder), [OT Conduit Linter](/tools/ot-conduit-linter) Product supplier4-1, 4-2Fundamentals → Design[SCADA Version Triage](/tools/scada-version-triage-lab) (why firmware lifecycle matters) OT security analyst3-3, 2-1Fundamentals → Maintenance[ICS Traffic Analyzer](/tools/ics-traffic-analyzer), [Alarm-Flood Lab](/tools/alarm-flood-lab) Compliance / GRC2-1, 3-2Fundamentals → Risk Assessment[OT Compliance Mapper](/tools/ot-compliance-mapper) (Pro) ## How long does it take to prepare? ISA does not publish study hours for every format, so plan around the course length: the classroom courses run over several days each, and the Fast Track is five days on top of IC32. Self-paced modules let you spread the same material over weeks. People with OT experience usually find Fundamentals the hardest exam to start because of the vocabulary; after that, the Design and Risk Assessment material builds on the same concepts. ## How do you practise IEC 62443 between courses? Reading the standard does not make you good at applying it. The fastest way to build judgement is to design and test small architectures: - Draw a plant in the Purdue Model Builder, split it into zones and assign a target security level to each. - Write the conduit rules, then run them through the OT Conduit Linter to catch overly broad rules and writes from outside the cell. - Test the design against real attack paths in the SCADA Network Segmentation Map. - Compare SL-T with SL-A for each zone in the IEC 62443 Security Level Calculator (a Pro tool, $5/month or $40/year as of October 2026). - Map your controls to NERC CIP or NIS2 if they apply, with the OT Compliance Mapper (Pro). PlayCISO is not affiliated with ISA and its tools do not prepare you for a specific exam; they help you apply the concepts the exams test. ## Checklist: planning your IEC 62443 training - Identify your role: asset owner, integrator, supplier, analyst or GRC. - Read the free first module of IC32 before committing. - Decide whether you need the credential or only the knowledge. - Plan the order of certificates 2 to 4 by role, or consider the IC48 Fast Track. - Practise zones, conduits and security levels on a real or sample architecture. - Pair the standard with NIST SP 800-82 Rev. 3 if you work with US organisations. ## Frequently asked questions ### What are the ISA/IEC 62443 certificates? As of October 2026, ISA’s ISA/IEC 62443 Cybersecurity Certificate Program has four certificates: Cybersecurity Fundamentals Specialist (course IC32), Risk Assessment Specialist (IC33), Design Specialist (IC34) and Maintenance Specialist (IC37). Fundamentals is required first; the other three can be taken in any order. Earning all four awards the ISA/IEC 62443 Cybersecurity Expert designation automatically. Each certificate needs a passed exam, and the certificates do not require renewal. ### Is there a fast way to get all four ISA/IEC 62443 certificates? ISA offers a five-day Fast Track course (IC48) for people who have completed IC32 and its exam. It covers the content of IC33, IC34 and IC37 and includes one exam attempt for each of certificates 2, 3 and 4. ### Can I learn IEC 62443 for free? Partly. ISA makes the first module of each self-paced course free (for example IC32M01, Introduction to Control Systems Security). CISA’s free ICS courses cover the underlying concepts. The standards themselves are paid documents. Free tools such as PlayCISO’s Purdue Model Builder and OT Conduit Linter let you practise zones, conduits and target security levels. ### Which is better, GICSP or ISA/IEC 62443? They answer different needs. GICSP (GIAC, usually with SANS ICS410) is a vendor-neutral, broad OT security credential that bridges IT, engineering and security. The ISA/IEC 62443 certificates are specific to the standard and suit people who design, assess or maintain systems against it, such as integrators and product suppliers. Many OT engineers end up with both. ### What training is best for NIST SP 800-82 compliance? NIST SP 800-82 Rev. 3 is guidance rather than a certification, so there is no single 800-82 course. Training that covers OT risk management, segmentation and OT incident response maps onto it well: CISA’s free 210W series, SANS ICS410, and the ISA/IEC 62443 Risk Assessment and Design certificates. SP 800-82 Rev. 3 itself references ISA/IEC 62443 throughout. _Certificate names, course codes and formats were checked on isa.org in October 2026._