SANS ICS410: ICS/SCADA Security Essentials
RecommendedGIAC names its affiliated SANS course as the best preparation for GICSP. You can buy an attempt without it.
Global Industrial Cyber Security Professional (GICSP) Exam Guide
Validates hands-on knowledge of securing industrial control systems, including architecture, threats and attacks, communications, hardening, governance and recovery.
GICSP tests ICS security across architecture, attacks, protocols, hardening, governance and recovery, including CyberLive tasks. Learn the side of IT and OT you know less well, index everything and practise the labs.
Understand the exam
Syllabus
GIAC publishes no weights, so these areas are groupings of its 10 official objectives.
ICS fundamentals and architecture
- ICS overview & concepts: summarize the function of high-level ICS processes as well as ICS roles and responsibilities, and compare and contrast high-level differences between ICS and IT, including physical security considerations
- ICS components & architecture: categorize assets that comprise Purdue Reference Architecture levels zero through three and describe how they can be implemented in a securable architecture
Example scenario: A historian server in the control network also needs to send data to business reporting. Where would you place it, and what traffic would you allow?
Threats and attacks by level
- Intelligence gathering & threat modeling: determine the threat landscape of an ICS and high-level concepts of threat modeling
- PERA level 0 & 1 technology overview and compromise: describe level 0 and level 1 devices and technologies and summarize how those devices and technologies are targeted and attacked
- PERA level 2 & 3 technology overview and compromise: describe level 2 and level 3 devices and technologies and summarize how those devices and technologies are targeted and attacked
Example scenario: An engineering workstation can push logic to every PLC on the plant floor. What would an attacker gain by compromising it?
Communications and wireless
- Protocols, communications, & compromises: describe the basic structures, protocols, and defense of communications within an ICS and summarize how they can be compromised
- Wireless technologies & compromises: summarize the different wireless communication technologies used in an ICS, how they are targeted, and how they can be defended
Example scenario: A Modbus/TCP capture shows write commands from an address that is not an HMI. What does that tell you about the protocol's built-in security?
Defense, governance and recovery
- Hardening & protecting endpoints: describe how to implement endpoint security software along with hardening and patching, to secure the Windows and Unix style operating systems commonly found in an ICS environment
- ICS program & policy development: summarize the steps and best practices used in building a security program and creating enforceable security policies for an ICS
- Risk based disaster recovery & incident response: describe how risk is measured and how it can be used to inform disaster recovery and incident response
Example scenario: A critical HMI runs an unsupported Windows version and cannot be patched. Which compensating controls would you use?
Format
- Questions
- 82
- Duration
- 3h
- Passing score
- 71%
- Delivery
- Test centre or online
- Languages
- English
Question types
Select your answer from the options shown for each question.
CertUp example
In the Purdue reference architecture, which level holds the PLCs and RTUs that directly control field equipment?
Show answer
Level 1. Level 0 holds the sensors and actuators, and Level 1 holds the basic controllers that read from and command them.
Work in a live virtual machine with real tools to complete a task, then enter the result as your answer; these items come at the end of the exam and usually count for more than multiple choice.
CertUp example
A Modbus/TCP packet capture is open in Wireshark in the lab virtual machine. Find the packet that writes to several registers at once and enter its Modbus function code.
Show answer
16. Function code 16 is Write Multiple Registers; it appears in the Modbus section of the packet details.
Eligibility and booking
Buy a certification attempt from the GIAC certification page or add one to a SANS course. Access usually arrives within 3 business days, and you then have 120 days to sit the exam.
Make a study plan
Work through the ICS410 material or an equivalent study route once, building your index as you read. Then use practice tests to fix your index and your weak objectives.
Most candidates spend 65–115 hours. Plan for the low end if you already work in ICS or OT security; plan for the high end if you know only IT security or only control systems.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.5 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.53 h
- 4Practice with mock examsTake timed practice tests and review every mistake.27 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.5 h
Learn the core concepts
ICS410 is the course the exam is written from. Without it, combine a structured course with an ICS textbook and free CISA training, and practise basic packet and command-line work for CyberLive.
Best official courseSANS ICS410: ICS/SCADA Security Essentials
Best-scoped independent courseGICSP Certification Masterclass: ICS/OT Cybersecurity
Best bookPractical Industrial Cybersecurity: ICS, Industry 4.0, and IIoTFill your weaker side first. If you come from IT, learn PLCs, HMIs and the Purdue model early. If you come from controls engineering, start with networking and Windows and Linux hardening.
Practice with mock exams
GIAC practice tests use the real exam engine and report the objectives you missed. Take one after your first pass through the material and the second when you feel ready, fixing your index in between.
Most realisticGIAC GICSP practice test
SecurityPracticeTest GICSP free setsSecurityPracticeTest GICSP full-length testsAre you ready?
- You pass a timed practice test with time to spare.
- You can find most answers through your index quickly.
- You can complete the course labs without following the workbook step by step.
The practice question bank is small, so a second test can repeat questions from the first.
Prepare for exam day
Schedule from your GIAC account once the attempt is active. GIAC expects candidates within 60 miles of a Pearson VUE centre to test there; ProctorU online testing is the other route.
At a Pearson VUE centre
Testing with ProctorU
- Bring two current, original IDs. The primary ID needs your photo and signature, and both names must match your booking.
- Arrive 15 minutes early. Arriving more than 15 minutes late or missing the appointment costs a $175 reseating fee.
- Reschedule at least 24 hours ahead. Your GIAC account shows times in UTC.
- Read GIAC's remote proctor guide and test your computer, webcam and connection before exam day.
- Keep your printed materials within reach of your desk.
- Reschedule at least 24 hours ahead to avoid the $175 reseating fee.
- Bring printed books, notes and your index. Electronic files, devices and printed practice questions are not allowed.
- You get 15 minutes of break time, in one or two parts.
Advice from exam takers
The course books matter.
Several r/GIAC commenters say GICSP questions follow the ICS410 books closely and advise against self-study without them. One commenter said experienced OT practitioners can pass without the books but should buy an official practice test first.
Prepare for CyberLive.
A 2026 commenter warned that CyberLive tasks run on a virtual machine and catch out candidates who have not practised them. A 2024 passer found the practice test close to the real exam and the CyberLive questions manageable after the course labs.
Expect material outside your specialty.
A power-utility security engineer still met new material outside her area and recommended breaks between practice exams. A 2024 reviewer found about half of ICS410 to be general security basics and half ICS-specific.