Over 45 Cyber Security Courses at SANS 2018 in Orlando! Save up to $200 thru 2/28.

Industrial Control System Courses

Protecting ICS infrastructure presents a set of unique challenges. Often hardware is old and staffing structures can make implementing security policies difficult.

SANS ICS Training provides:

  • Real world training - A panel of experts with an intimate understanding of ICS cyber security and SCADA principles create course content.
  • Training for engineers - Specialised training is designed to help engineers understand security.
  • Training for security professionals - Training helps security staff understand SCADA security and embedded systems, their functions and their limitations.
  • Courses led by experts - Training classes are taught by respected experts in the ICS field.
  • Extensive courseware - ICS students are equipped with a library of textbooks and extra material.

SANS Institute is the world's largest provider of cyber security training and certification. In the last 25 years we have grown to be a truly global business with over 125,000 alumni around the world.

Click here to jump to our full ICS course list

Why SANS' ICS Training?


SANS' ICS Instructors are world-class cyber security professionals.

Within their technical sphere, SANS Instructors are high-ranking practitioners and proponents.

Our Instructors are masterful teachers who understand how people learn. They have excellent communication skills, demand initiative, inspire confidence, and challenge students.

Rather than just lecturing, SANS Instructors lead lab based exercises and simulations. Depending on the course, students gain experience of network capture forensics, spoofing Modbus-TCP control signals, and finding passwords in EEPROM dumps.

Read what previous students taking ICS training had to say about their course on our Testimonials page.


SANS supply a comprehensive selection of courseware. Based on the course selected this can include:

  • Text books - SANS is dedicated to ensuring its training - and resources - are focussed on tackling the most modern and prevalent threats.
  • CYBATIWorks Mini-Kit - A Raspberry Pi based training environment that lets students experiment with ICS systems they'll encounter outside the classroom. Using virtualisation, it simulates control systems such as PLCs, PACs, MTU/RTU, DCS and Physical Security.
  • Software tools kits - As students move through a SANS ICS training course, they work with many tools. We make sure students receive a copy of each one.
  • Virtual environments - Many labs rely on virtualisation. Students receive a copy of the VM environment so they can recreate the exercise.
  • Posters and paper resources - To help students learn, retain and deploy new skills, courses are accompanied by a wide selection of hand-outs, cheat sheets and posters.

Training Delivery

Training Events - Study in a classroom style environment in a SANS Training venue with a dedicated SANS Instructor.

Online - We offer an innovative electronic learning programme that lets students access SANS Training from a laptop or tablet.

Private Training - For organisations with over 25 employees who need ICS security training, we can arrange for a SANS Instructor to deliver our training internally, inside a HQ or training centre.

For any questions about training see our FAQs page.

ICS Courses


Many SANS Training courses are aligned with accreditations issued by GIAC (Global Information Assurance Certification).

GIAC accreditations are recognised globally and certify that the holder's cyber security skills are extemporary. As such, holding a GIAC accreditation can aid career advancement and promotion.

GIAC's GICSP (Global Industrial Cyber Security Practitioner) certification was created with the support of the global community and is held in high regard by major organisations and governments.

SANS ICS Courses

ICS410 was created to ensure those involved in supporting and defending ICS infrastructure have the skills, knowledge and experience to keep their environments safe. It is a foundational course designed to give engineers and IT teams a standardised approach to securing ICS.

The course focuses on imparting an understanding of ICS components. This encompasses their purpose, deployment, constraints and significant drivers. The course is very hands-on with lab exercises that focus on attack surfaces, tools and methodologies.

ICS515 focuses on active defence and responding to incidents. It is built around giving students the ability to spot breaches in their ICS network.

Industrial Control Systems Curriculum
Course Certification
Level 1 ICS410: ICS/SCADA Security Essentials GICSP
Level 2 ICS456: Essentials for NERC Critical Infrastructure Protection GCIP
ICS515: ICS Active Defense and Incident Response GRID
Specialty Courses HST: Critical Infrastructure and Control System Cybersecurity
HST: Assessing and Exploiting Control Systems

Training Events Offering Industrial Control Systems Courses
Event Dates Register
SANS Munich March 2018 Mar 19 - Mar 24, 2018  
SANS Abu Dhabi 2018 Apr 07 - Apr 12, 2018  
SANS Doha 2018 Apr 28 - May 03, 2018  
SANS ICS Europe Summit and Training 2018 Jun 18 - Jun 23, 2018  
SANS London July 2018 Jul 02 - Jul 07, 2018  
Online Training: SANS OnDemand
Event Dates Register
ICS410: ICS/SCADA Security EssentialsAnytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice