Back to certifications
CompTIA certification
CompTIA SecOT+
The upcoming certification for securing operational technology in manufacturing and critical infrastructure.CompTIA SecOT+ validates your skills to secure and manage operational technology (OT) systems in manufacturing and critical infrastructure. This certification is designed for experienced professionals who need expertise in OT risk assessment, compliance, threat intelligence, architecture, and incident response. SecOT+ prepares you for the growing security challenges facing OT environments and helps you protect industrial systems, critical infrastructure, and connected operations. It is an upcoming certification, scheduled to launch in December 2026.
Exam version: V1
Target roleSecurity engineer
Skills you'll
learn
OT safety and systemsDemonstrate safety, control, and architecture skills unique to OT.
Risk and complianceAssess risk, manage compliance programs, and align cybersecurity to business objectives in OT.
Analyze and respond to threats using OT-specific frameworks, historical attack knowledge, and indicators of compromise.
Build, harden, and operate secure OT architectures, including physical, network, hardware, and software security.
Perform asset management, vulnerability assessment, and security monitoring in industrial setups.
Prepare and execute OT-specific incident response, including for physical and cyber-physical events.
Exam
details
Exam versionV1
Exam series codeSOT-001
Launch dateDecember 1, 2026
LanguagesEnglish
Recommended experience3+ years of hands-on work in OT environments and 2+ years implementing OT cybersecurity solutions
RetirementEstimated 3 years after launch
AvailabilityUpcoming certification, launching December 2026
Exam
objectives
1
OT systems and safety foundations
- Apply safety techniques to the job environment: implement lockout/tagout, JSA, PPE, hazard identification, and safety meetings.
- Explain unique elements in OT environments: differentiate IT/OT convergence, device roles (PLCs, HMIs, SCADA systems), and critical infrastructure sectors.
- Describe control theory concepts: demonstrate understanding of control logic, set points, I/Os, timers, process variables, and control languages.
- Explain OT communication mediums and protocols: distinguish among serial, Ethernet, and wireless OT protocols (Modbus, DNP3, BACnet, Profinet, etc.).
- Contrast infrastructure considerations for OT: compare legacy, embedded, and modern infrastructure, including virtualization, cloud, and edge technologies.
2
OT risk management
- Explain the importance of governance, risk, and compliance: connect security and operational objectives, business continuity, and compliance drivers.
- Describe elements of cybersecurity program management: address risk registries, maturity assessments, roadmaps, RACI, SLAs, training, and documentation.
- Outline risk assessment concepts: cover frameworks, methods, risk variables, scoping, controls, and treatment options.
- Explain risk monitoring and disposition: include processes for audits, reporting, escalation, and disposition strategies.
- Summarize the importance of the change management process: review identification, testing, communication, and approval of changes.
3
OT threat intelligence
- Summarize the foundations of threat intelligence: identify intelligence types and security frameworks (Diamond Model, MITRE ATT&CK, Cyber Kill Chain).
- Explain the relevance of historical cyber events impacting OT environments: assess impacts of incidents such as Stuxnet, Industroyer, and other major OT attacks.
- Describe key components of OT threat landscapes: describe threat actors, attack vectors, vulnerabilities, and techniques specific to OT.
- Analyze OT threat intelligence for cyberdefense: leverage OT threat feeds, platforms, IoCs, TTPs, and information sharing channels.
4
OT cybersecurity architecture, design, and engineering
- Explain secure OT architectural principles: apply least privilege, compartmentalization, resilience, auditability, interoperability, and defense in depth.
- Summarize physical security concepts: evaluate access control systems, surveillance, physical barriers, and inspections.
- Determine applicable hardware security controls and settings: select secure boot, TPM, firmware updates, port management, backups, and tamper protection.
- Apply host and application security practices: use endpoint protection, host access controls, OS benchmarks, code signing, and patching.
- Recommend network security controls and designs: propose firewall rules, segmentation, encryption, IDS/IPS, wireless management, and secure access.
- Establish appropriate identification, authentication, and authorization controls: implement account management, MFA, PKI, directory services, and secure remote access.
5
OT security operations
- Summarize the purpose of asset management tasks: maintain asset and software inventories, discovery processes, and configuration management.
- Analyze data in support of security operations: review logs, threat-hunting artifacts, SIEM, SOAR, and security management data.
- Describe the role of vulnerability remediation: prioritize, coordinate, test, and implement vulnerability fixes and patches in OT.
- Apply techniques to facilitate vulnerability management: identify, validate, triage, and verify vulnerabilities using multiple data sources.
- Explain the importance of portable device security in OT environments: address removable media, mobile, and external device security, authorization, and validation.
6
OT incident management
- Describe incident management frameworks: reference the PICERL model and ICS4ICS for OT incident response.
- Summarize overarching incident management considerations: integrate cybersecurity and physical response, escalation, notification, and mutual aid.
- Perform activities to prepare for incidents: develop and update incident response plans, playbooks, and conduct exercises.
- Explain incident response and handling: employ triage, data collection, chain of custody, and root cause analysis.
- Analyze common data sets collected during incident response: examine system/network baselines, logs, and deviations.
- Compare and contrast containment, eradication, and recovery processes: execute isolation, malware removal, system restoration, validation, and mandatory reporting.
Exam information is published by CompTIA and may change. Contact us for the current exam version and available sessions.
Take CompTIA SecOT+ at NEXERA Institute
Training and certification center in Sfax: professional courses, Certiport and VTest exams, and a coworking space.