CySec Design & Impl.
CySec Specialist (TÜV Rheinland) Design and Implementation
Translate IEC 62443 risk assessment findings into security requirements, practical countermeasures and documented designs, including implementation, verification, validation and acceptance testing.
General information
Turn industrial security risk findings into documented designs and implemented safeguards. This IEC 62443 programme develops the connection between Security Level Targets (SL-T), the Cybersecurity Requirements Specification (CRS), countermeasures and acceptance evidence.
An industrial case study is developed throughout the training. Participants consider how to implement, verify and validate protection measures, and how lifecycle management helps maintain the required security level.
Who should attend
Functional, process and technical safety engineers; control, instrumentation and process engineers and managers; operations and maintenance personnel; consultants and advisers; and professionals already involved in facility cybersecurity. Relevant organisations include asset owners, end users, EPCs, power and automation system integrators and service providers. The programme is also relevant to FS Engineer SIS certificate holders developing industrial cybersecurity responsibilities.
What you will learn
- Connect risk assessment, SL-T and the CRS with security design decisions.
- Understand the IACS cybersecurity lifecycle, management arrangements and assigned responsibilities.
- Select and implement countermeasures addressing IEC 62443 foundational requirements.
- Understand high-level and low-level design, verification, validation and the records supporting conformance.
Detailed content
- Day oneDesign context and requirements
- Days two and threeCountermeasures and implementation
- Day fourDesign verification and acceptance
Day one — Design context and requirements
Review industrial cybersecurity concepts, lifecycle responsibilities, competence and management. Connect SRA outputs, zones and conduits, SL-T and the CRS with the case study. Supporting context includes IEC 61511, ISA TR84.00.09, ISO 27000, NIST guidance, CRA and NIS2.
Days two and three — Countermeasures and implementation
Use SRA and CRS outputs to evaluate likelihood and consequence, prioritise risks for detailed assessment, and review high-level assessment outputs and zone-and-conduit activities. Develop the case study through the seven IEC 62443 foundational requirements:
- Identification and authentication control: identify users and devices and prevent unauthorised access.
- Use control: restrict permitted activities and prevent unauthorised operation.
- System integrity: protect systems and information against unauthorised changes.
- Data confidentiality: protect information against unauthorised disclosure.
- Restricted data flow: control communications across defined system and network boundaries.
- Timely response to events: support detection, reporting and timely corrective action.
- Resource availability: protect essential services and resources against disruption, including denial-of-service attacks.
Day four — Design verification and acceptance
Review high-level and low-level industrial network designs and zone-and-conduit diagrams. Examine implementation of countermeasures, validation and acceptance testing, and the documentation needed to demonstrate conformance.
Examination and certification
Duration, examination and certificate
4.5 days, comprising four training days and a three-hour examination on day five.
- Examination: 50 multiple-choice questions and 10 open questions, one mark each, three hours.
- Pass criterion: 70% overall (42 of 60).
Eligible participants who pass receive the CySec Specialist (TÜV Rheinland) certificate in Design and Implementation, listed on Certipedia.
Eligibility
At least three years of related industrial experience is required, for example in control and instrumentation, process engineering, IT/OT, Functional Safety or cybersecurity. Accepted education includes a technical qualification, diploma, university degree or vocational qualification; equivalent engineering experience and responsibilities may instead be confirmed by an employer or engineering institution.
Booking information
Booking information
The selected event states its materials and venue arrangements. An attendance-only option without the examination or CySec Specialist certificate is also available; contact TVC for details. Current TVC prices and booking terms are published only in the webshop. Submit your eligibility evidence before booking and check the event language and timetable.
Plan your training
Choose Design and Implementation to develop the engineering knowledge needed to translate security requirements into practical IACS designs. Contact info@tinovc.com for advice.
Upcoming dates
22–25 Nov 2027Exam 25 Nov 2027
CySec Design & Impl.Live virtualV271104Online · AmericasLive virtual · UTC-4
Denrich SanandaEnglish
Confirmed
20–23 Dec 2027Exam 23 Dec 2027
CySec Design & Impl.Live virtualV271203Online · AmericasLive virtual · UTC-4
Denrich SanandaEnglish
Confirmed
Ask a question