CySec SRA
Security Risk Assessment (TÜV Rheinland)
Apply IEC 62443-3-2 through a structured case study: scope and asset information, high-level assessments, zones and conduits, detailed risk analysis, target security levels and cybersecurity requirements.
General information
Learn to assess cybersecurity risk in an industrial facility using IEC 62443-3-2. This specialist course develops the reasoning, practical methods and documentation needed to move from process and system information to security requirements and risk treatment.
A progressive case study links an asset inventory, high-level risk assessment, zone-and-conduit model and detailed assessment. You will examine how target security levels and the CRS support the selection of countermeasures that address the assessed risks.
Who should attend
Functional, process and technical safety engineers; control and instrumentation engineers and managers; process engineers; operations personnel and managers; maintenance staff; IT/OT specialists; consultants and advisers. The course is particularly relevant to professionals who already take part in process hazard and risk analysis and are moving into industrial security risk assessment or cybersecurity requirements specification.
What you will learn
- Define tolerable risk criteria and understand the role of security risk assessment in an industrial facility.
- Select qualitative, semi-quantitative or quantitative techniques appropriate to the assessment.
- Identify assets, threats, vulnerabilities and consequences, using process hazard information where relevant.
- Develop high-level and detailed assessments, allocate zones and conduits, and establish Security Level Targets (SL-T).
- Calibrate and apply security risk methods, including attack trees, to support risk reduction decisions.
- Connect SL-T and assessment findings with the Cybersecurity Requirements Specification (CRS), suitable countermeasures and documented residual-risk decisions.
Course approach
Tutor-led modules are followed by practical case-study work across three training days. The four exercises develop the asset inventory, high-level assessment, zone allocation and detailed assessment. Discussion connects the methodology with the operational and business objectives of an industrial facility.
Detailed content
- Day oneSecurity context and high-level risk assessment
- Day twoZones, conduits and assessment outputs
- Day threeDetailed assessment and cybersecurity requirements
Day one — Security context and high-level risk assessment
Security context and high-level risk assessment
Establish the case study and carry out the first stages of assessment.
- The TÜV Rheinland cybersecurity programme; industrial cybersecurity requirements, the interface with IEC 61511 and the regulatory context of the Network and Information Systems framework.
- Security management and common management systems; relevant security and safety standards; the IEC 62443 security lifecycle and risk assessment standards.
- Competence and responsibilities; tolerable risk and the principles of risk acceptance, including ALARP where applicable.
- Asset inventories and their relationship to assessment. Practical session one: prepare the case-study asset inventory.
- Qualitative, semi-quantitative and quantitative assessment methods; selecting and calibrating risk criteria.
- Use of previous Process Hazard Analysis (PHA) as an input to the high-level assessment; identification of threat scenarios, vulnerabilities and high-level risks; preliminary SL-T.
- Practical session two: complete the high-level security risk assessment.
Day two — Zones, conduits and assessment outputs
Zones, conduits and assessment outputs
Use the high-level findings to prioritise risks and develop a defensible security architecture.
- Expected high-level assessment outputs; evaluation of likelihood and consequence; prioritisation of risks for detailed assessment.
- IEC 62443 zone-and-conduit requirements, trust boundaries and entry points.
- Allocation of IACS assets to zones; network segmentation, system architecture and the benefits of defined boundaries.
- Practical session three: allocate the case-study zones and conduits and document the reasoning.
Day three — Detailed assessment and cybersecurity requirements
Detailed assessment and cybersecurity requirements
Examine prioritised zones in detail and translate the assessment into requirements and risk treatment.
- IEC 62443 detailed assessment requirements and the industrial control system attack surface.
- Threat assessment, vulnerability assessment and the detailed risk process; use of a security risk matrix to determine risk and SL-T.
- The relationship between SL-T and the foundational requirements; preparation and calibration of attack trees; pruning attack trees to demonstrate a risk-based approach to countermeasures.
- Practical session four: complete the detailed security risk assessment and identify risk reduction measures.
- Risk acceptance; assessment records and IEC 62443 documentation, including the CRS; monitoring and review.
- Case-study conclusions, examination format and preparation, and final questions.
Examination and certification
Duration and examination
Three training days plus a three-hour examination on day four, normally advertised as 3.5 days.
- Examination: 30 multiple-choice questions (one mark each) and 10 open questions (four marks each).
- Pass criterion: a minimum score of 75% is required on each paper.
Eligibility and certification
The CySec Specialist (TÜV Rheinland) certificate in Security Risk Assessment requires successful Fundamentals and SRA examinations and accepted eligibility evidence. A minimum of three years of relevant experience is required, for example in control and instrumentation, process engineering, IT/OT, Functional Safety or cybersecurity. You need an engineering degree or equivalent engineering experience and responsibilities confirmed by your employer or engineering institution.
Send TVC your experience and qualification evidence before booking for eligibility review. For standalone SRA, also provide your TÜV Rheinland Fundamentals certificate or accepted examination evidence. An SRA pass alone does not complete specialist certification.
Booking information
Preparation and booking information
Review Fundamentals before attending; process hazard and risk analysis experience is helpful. Check the event for its timetable, materials, language and delivery arrangements. Prices and booking terms appear only in the TVC webshop.
Plan your training
Choose standalone SRA when you have completed Fundamentals and want focused training in industrial security risk assessment. Contact info@tinovc.com for advice.
Upcoming dates
No sessions are currently scheduled. Ask TVC about future dates or a company-specific session.
Ask a question