Online Training Special: Get an iPad Mini, Surface Go, or $300 Off through 5/1!

Industrial Control System Courses

Protecting ICS infrastructure presents a set of unique challenges. Often hardware is old and staffing structures can make implementing security policies difficult.

SANS ICS Training provides:

  • Real world training - A panel of experts with an intimate understanding of ICS cyber security and SCADA principles create course content.
  • Training for engineers - Specialised training is designed to help engineers understand security.
  • Training for security professionals - Training helps security staff understand SCADA security and embedded systems, their functions and their limitations.
  • Courses led by experts - Training classes are taught by respected experts in the ICS field.
  • Extensive courseware - ICS students are equipped with a library of textbooks and extra material.

SANS Institute is the world's largest provider of cyber security training and certification. In the last 25 years we have grown to be a truly global business with over 125,000 alumni around the world.

Click here to jump to our full ICS course list

Why SANS' ICS Training?


SANS' ICS Instructors are world-class cyber security professionals.

Within their technical sphere, SANS Instructors are high-ranking practitioners and proponents.

Our Instructors are masterful teachers who understand how people learn. They have excellent communication skills, demand initiative, inspire confidence, and challenge students.

Rather than just lecturing, SANS Instructors lead lab based exercises and simulations. Depending on the course, students gain experience of network capture forensics, spoofing Modbus-TCP control signals, and finding passwords in EEPROM dumps.

Read what previous students taking ICS training had to say about their course on our Testimonials page.


SANS supply a comprehensive selection of courseware. Based on the course selected this can include:

  • Text books - SANS is dedicated to ensuring its training - and resources - are focussed on tackling the most modern and prevalent threats.
  • CYBATIWorks Mini-Kit - A Raspberry Pi based training environment that lets students experiment with ICS systems they'll encounter outside the classroom. Using virtualisation, it simulates control systems such as PLCs, PACs, MTU/RTU, DCS and Physical Security.
  • Software tools kits - As students move through a SANS ICS training course, they work with many tools. We make sure students receive a copy of each one.
  • Virtual environments - Many labs rely on virtualisation. Students receive a copy of the VM environment so they can recreate the exercise.
  • Posters and paper resources - To help students learn, retain and deploy new skills, courses are accompanied by a wide selection of hand-outs, cheat sheets and posters.

Training Delivery

Training Events - Study in a classroom style environment in a SANS Training venue with a dedicated SANS Instructor.

Online - We offer an innovative electronic learning programme that lets students access SANS Training from a laptop or tablet.

Private Training - For organisations with over 25 employees who need ICS security training, we can arrange for a SANS Instructor to deliver our training internally, inside a HQ or training centre.

For any questions about training see our FAQs page.

ICS Courses


Many SANS Training courses are aligned with accreditations issued by GIAC (Global Information Assurance Certification).

GIAC accreditations are recognised globally and certify that the holder's cyber security skills are extemporary. As such, holding a GIAC accreditation can aid career advancement and promotion.

GIAC's GICSP (Global Industrial Cyber Security Practitioner) certification was created with the support of the global community and is held in high regard by major organisations and governments.

SANS ICS Courses

ICS410 was created to ensure those involved in supporting and defending ICS infrastructure have the skills, knowledge and experience to keep their environments safe. It is a foundational course designed to give engineers and IT teams a standardised approach to securing ICS.

The course focuses on imparting an understanding of ICS components. This encompasses their purpose, deployment, constraints and significant drivers. The course is very hands-on with lab exercises that focus on attack surfaces, tools and methodologies.

ICS515 focuses on active defence and responding to incidents. It is built around giving students the ability to spot breaches in their ICS network.

Industrial Control Systems Curriculum
Course Certification
Level 1 ICS410: ICS/SCADA Security Essentials GICSP
Level 2 ICS456: Essentials for NERC Critical Infrastructure Protection GCIP
ICS515: ICS Active Defense and Incident Response GRID
Specialty Courses HST: Critical Infrastructure and Control System Cybersecurity
HST: Assessing and Exploiting Control Systems

Training Events Offering Industrial Control Systems Courses
Event Dates Register
SANS Stockholm May 2019 May 13 - May 18, 2019  
SANS ICS Europe 2019 Jun 24 - Jun 29, 2019  
SANS Prague August 2019 Aug 12 - Aug 17, 2019  
SANS Oslo September 2019 Sep 09 - Sep 14, 2019  
SANS Dubai September 2019 Sep 14 - Sep 19, 2019  
SANS Paris September 2019 Sep 16 - Sep 21, 2019  
SANS London September 2019 Sep 23 - Sep 28, 2019  
SANS Doha October 2019 Oct 12 - Oct 17, 2019  
SANS Paris November 2019 Nov 04 - Nov 09, 2019  
SANS Gulf Region 2019 Nov 16 - Nov 28, 2019  
Online Training: SANS OnDemand
Event Dates Register
ICS410: ICS/SCADA Security EssentialsAnytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice