CySec FSRA
Cyber Security Fundamentals and Security Risk Assessment (TÜV Rheinland)
Combine a focused Fundamentals review with applied Security Risk Assessment training, following a practical IACS case study from scope and asset identification to risk treatment and documented security requirements.
General information
Build on your cybersecurity knowledge and learn to assess industrial security risks through one coordinated week of training. The combined FSRA programme brings together a Fundamentals review, practical IEC 62443 Security Risk Assessment training and a two-part examination.
The course helps you connect threats and vulnerabilities with their potential process consequences. A progressive industrial case study takes you from an asset inventory and high-level assessment to zones, conduits, detailed risk analysis and cybersecurity requirements.
Who should attend
Functional, process and technical safety engineers; control and instrumentation engineers and managers; process engineers; operations personnel and managers; maintenance staff; IT/OT specialists; consultants and advisers. The course is particularly relevant to professionals who already take part in process hazard and risk analysis and are moving into industrial security risk assessment or cybersecurity requirements specification.
The accelerated format suits participants who can prepare through self-study or already have a working knowledge of cybersecurity fundamentals. It combines Fundamentals review and specialist SRA training in one week.
What you will learn
- Define tolerable risk criteria and understand the role of security risk assessment in an industrial facility.
- Select qualitative, semi-quantitative or quantitative techniques appropriate to the assessment.
- Identify assets, threats, vulnerabilities and consequences, using process hazard information where relevant.
- Develop high-level and detailed assessments, allocate zones and conduits, and establish Security Level Targets (SL-T).
- Calibrate and apply security risk methods, including attack trees, to support risk reduction decisions.
- Connect SL-T and assessment findings with the Cybersecurity Requirements Specification (CRS), suitable countermeasures and documented residual-risk decisions.
Preparation and course approach
The combined programme relies on existing knowledge or self-study of the Fundamentals material. TVC provides reference material to help you prepare. Complete this preparation before the course: day one is a recap and does not replace the full standalone Fundamentals training. If you need more time to develop networking and security knowledge, choose the standalone Fundamentals course first.
Detailed content
- Day oneCybersecurity Fundamentals review
- Day twoSecurity context and high-level risk assessment
- Day threeZones, conduits and assessment outputs
- Day fourDetailed assessment and cybersecurity requirements
- Day fiveExaminations
Day one — Cybersecurity Fundamentals review
Review the technical and management foundations needed for the assessment work.
- Computer networks and network security; cryptography and cybersecurity countermeasures.
- Industrial communications and protocols; the IEC 62443 framework.
- Establishing an IACS security programme and Cybersecurity Management System (CSMS), including the principles of IEC 62443-2-1.
- Risk analysis, addressing risks through the CSMS, and monitoring and improvement.
Day two — Security context and high-level risk assessment
Security context and high-level risk assessment
Establish the case study and carry out the first stages of assessment.
- The TÜV Rheinland cybersecurity programme; industrial cybersecurity requirements, the interface with IEC 61511 and the regulatory context of the Network and Information Systems framework.
- Security management and common management systems; relevant security and safety standards; the IEC 62443 security lifecycle and risk assessment standards.
- Competence and responsibilities; tolerable risk and the principles of risk acceptance, including ALARP where applicable.
- Asset inventories and their relationship to assessment. Practical session one: prepare the case-study asset inventory.
- Qualitative, semi-quantitative and quantitative assessment methods; selecting and calibrating risk criteria.
- Use of previous Process Hazard Analysis (PHA) as an input to the high-level assessment; identification of threat scenarios, vulnerabilities and high-level risks; preliminary SL-T.
- Practical session two: complete the high-level security risk assessment.
Day three — Zones, conduits and assessment outputs
Zones, conduits and assessment outputs
Use the high-level findings to prioritise risks and develop a defensible security architecture.
- Expected high-level assessment outputs; evaluation of likelihood and consequence; prioritisation of risks for detailed assessment.
- IEC 62443 zone-and-conduit requirements, trust boundaries and entry points.
- Allocation of IACS assets to zones; network segmentation, system architecture and the benefits of defined boundaries.
- Practical session three: allocate the case-study zones and conduits and document the reasoning.
Day four — Detailed assessment and cybersecurity requirements
Detailed assessment and cybersecurity requirements
Examine prioritised zones in detail and translate the assessment into requirements and risk treatment.
- IEC 62443 detailed assessment requirements and the industrial control system attack surface.
- Threat assessment, vulnerability assessment and the detailed risk process; use of a security risk matrix to determine risk and SL-T.
- The relationship between SL-T and the foundational requirements; preparation and calibration of attack trees; pruning attack trees to demonstrate a risk-based approach to countermeasures.
- Practical session four: complete the detailed security risk assessment and identify risk reduction measures.
- Risk acceptance; assessment records and IEC 62443 documentation, including the CRS; monitoring and review.
- Case-study conclusions, examination format and preparation, and final questions.
Day five — Examinations
The combined programme examination has two parts. Part 1 comprises 75 multiple-choice questions covering Security Risk Assessment and Fundamentals. Part 2 comprises 10 questions relating to Security Risk Assessment, assessed through an open-question examination or interview.
Duration and delivery
4.5 days across one working week: a Fundamentals recap on day one, specialist SRA training on days two to four, and both examination parts on day five. Teaching alternates explanations and discussion with the four case-study exercises. The selected event provides its location or online arrangements, language, time zone and detailed examination timetable.
Examination and certification
Examination
- Part 1: 75 multiple-choice questions covering Security Risk Assessment and Fundamentals.
- Part 2: four questions relating to Security Risk Assessment, worth 10 marks each, assessed through an open-question examination or interview.
- Pass criterion: a minimum overall score of 75% (86.25 of 115 marks: 75 for part 1 and 40 for part 2) is required to qualify for the CySec Specialist (TÜV Rheinland) certificate.
Event joining instructions provide the examination timetable and delivery arrangements.
Eligibility and certification
The CySec Specialist (TÜV Rheinland) certificate in Security Risk Assessment requires successful completion of both parts of the combined programme examination and accepted eligibility evidence. A minimum of three years of relevant experience is required, for example in control and instrumentation, process engineering, IT/OT, Functional Safety or cybersecurity. You need an engineering degree or equivalent engineering experience and responsibilities confirmed by your employer or engineering institution.
Send TVC your experience and qualification evidence before booking for eligibility review. Both examination parts and the eligibility requirements must be completed before specialist certification can be awarded.
Successful, eligible participants completing the combined programme and achieving the minimum overall examination score of 75% qualify for the CySec Specialist (TÜV Rheinland) certificate in Security Risk Assessment. Attendance alone does not award the certificate.
Booking information
Booking information
Check the selected event for its materials, delivery arrangements and timetable. Current TVC prices and booking terms are published only in the webshop. Allow time for the required self-study before the training week. Contact TVC for advice on choosing between the combined and standalone routes.
Plan your training
Choose the combined FSRA programme when you are ready for an accelerated Fundamentals and SRA route. Contact info@tinovc.com for advice.
Upcoming dates
23–27 Nov 2026Exam 27 Nov 2026
CySec FSRAClassroomF261104aBrasschaat, BelgiumClassroom · UTC+1
William HornerEnglish
Confirmed
15–19 Mar 2027Exam 19 Mar 2027
CySec FSRAClassroomF270303aBreda, NetherlandsClassroom · CET
William HornerEnglish
Confirmed
12–16 Apr 2027Exam 16 Apr 2027
CySec FSRALive virtualV270402Online · InternationalLive virtual · CEST
William HornerEnglish
Planned
11–15 May 2027Exam 15 May 2027
CySec FSRALive virtualV270502Online · SEA / India / Middle EastLive virtual · UTC+5:30
Lalit Shamkant ShaiwaleEnglish
Confirmed
17–21 May 2027Exam 21 May 2027
CySec FSRALive virtualV270503Online · AmericasLive virtual · UTC-4
Denrich SanandaEnglish
Confirmed
16–20 Aug 2027Exam 20 Aug 2027
CySec FSRALive virtualV270803aOnline · AmericasLive virtual · UTC-4
Denrich SanandaEnglish
Confirmed
25–29 Oct 2027Exam 29 Oct 2027
CySec FSRALive virtualV271004Online · InternationalLive virtual · CET
William HornerEnglish
Planned
Ask a question