Postgraduate Diploma in Incident Response and Industrial Forensics
Online 800 h Postgraduate Diploma in Incident Response and Industrial Forensics. 8 modules covering NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and Wireshark. Assigned tutor and open enrolment.
Postgraduate Diploma in Incident Response and Industrial Forensics — studying from Canada
Canada has a notable robotics and automation sector, with research leadership at institutions such as McGill University, the University of Toronto and the University of Waterloo. Industrial automation firms and integrators serve manufacturing, automotive and resource industries across Ontario, Québec and Alberta. The Canadian Space Agency's robotic systems contribute to space robotics expertise. Engineers work on control systems, industrial robots, mechatronics and automation integration.
Fees for Canada: C$1,700 (Canadian dollar), with instalments and employer sponsorship available.
Relevant bodies in Canada
Typical roles
Questions from Canada
Is this programme recognised by professional bodies in Canada for robotics and control engineering?
SEIUM's qualifications are private, not official state degrees, and are not accredited by any national body in Canada. Professional engineering titles are regulated provincially, for example by Professional Engineers Ontario, and engineering graduates in Canada typically pursue licensure through these bodies. Recognition of a private qualification is decided by employers or the relevant body.
Where could this qualification help in Canada's robotics and automation job market?
Canadian employers in manufacturing, logistics, aerospace, mining and automation integration may hire for robotics and control skills. Whether they value a private qualification is their decision, and many also weigh portfolios, experience and recognised credentials. The final project can demonstrate applied ability, though it does not guarantee any job.
How can I study this while working full time in Canada?
The programme is entirely online and taught in English, so you can study from home across Canadian time zones, and no student visa is needed. Choose from 300-hour specialist courses, 800-hour postgraduate diplomas or 1,900-hour master's programmes. Fees are payable in instalments, employer sponsorship is possible, and you receive an assigned technical tutor.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Plan safe recovery and process validation.
Extract lessons learned and improve the management system.
Who it's for
- OT incident response analyst looking to specialise in Incident Response and Industrial Forensics.
- Industrial digital forensic expert looking to specialise in Incident Response and Industrial Forensics.
- Industrial SOC analyst looking to specialise in Incident Response and Industrial Forensics.
- Plant continuity manager looking to specialise in Incident Response and Industrial Forensics.
- OT cybersecurity consultant looking to specialise in Incident Response and Industrial Forensics.
- Crisis management coordinator looking to specialise in Incident Response and Industrial Forensics.
- Graduates in engineering or science seeking to enter the energy sector.
What you'll work with
- NIST SP 800-61 Rev. 3
- ISO/IEC 27035-1:2023
- ISO/IEC 27037:2012
- IEC 62443-2-1
- NIST SP 800-82 Rev. 3
- Directiva (UE) 2022/2555 NIS2
- ISO/IEC 27043:2015
- NIST SP 800-86
8 modules · 800 h
1.1OT incident taxonomy1.2Reference cases in energy and industry1.3MITRE ATT&CK for ICS framework1.4Two-stage industrial kill chain1.5Impact on safety, the environment and production1.6Threat actors and motivations1.7Differences from IT response1.8NIS2 notification obligations1.9Coordination with INCIBE-CERT and sectoral CSIRTs1.10Practical case: reconstructing a public incident with ATT&CK for ICS
2.1NIST SP 800-61 response lifecycle2.2OT-specific response plan2.3Team roles and escalation2.4Integration with plant emergency plans2.5Playbooks by incident type2.6Response kits and tools2.7Backups of logic and configuration2.8Internal and external communication2.9Tabletop exercises and drills2.10Workshop: ransomware playbook for a supervisory network
3.1Detection sources in the plant3.2Industrial IDS alerts3.3Process anomaly indicators3.4Triage and severity classification3.5Distinguishing a technical fault from an attack3.6Initial containment without stopping the process3.7Safe shutdown decision3.8Recording actions from the outset3.9Chain of custody from the start3.10Practice: alert triage in a simulated industrial SOC
4.1Principles of ISO/IEC 270374.2Volatility and order of acquisition4.3Memory acquisition on engineering workstations4.4Disk images of SCADA servers4.5Capture of industrial network traffic4.6Extraction of PLC logic and firmware4.7HMI and historian logs4.8Risks of altering devices in operation4.9Documentation and integrity hashes4.10Laboratory: acquiring evidence from an engineering workstation
5.1Analysis of Modbus, S7comm and DNP3 traffic5.2Comparison of PLC logic with baseline5.3Timeline of events5.4Analysis of Windows artefacts on HMI5.5ICS-oriented malware analysis5.6Correlation of process and security logs5.7Open-source forensic tools5.8Attribution and its limits5.9Forensic report and technical language5.10Practice: analysis of a capture containing malicious PLC writes
6.1Zone-based containment strategies6.2Restoration of verified logic and configuration6.3Rebuilding compromised workstations6.4Functional safety validation after an incident6.5Staged process restart6.6Enhanced post-incident monitoring6.7Vendor management during recovery6.8Costs and impact of the incident6.9Insurance and contractual aspects6.10Practical case: recovery plan for a water treatment plant
7.1Structured post-incident review7.2Root cause analysis7.3Updating CSMS controls7.4Response indicators: MTTD and MTTR7.5Sharing threat intelligence7.6Legal aspects and data protection7.7Ethics of the forensic analyst7.8Preparing executive reports7.9Planning new exercises7.10Workshop: lessons-learned report after a drill
8.1Incident scenario and scope8.2Response plan tailored to the plant8.3Main playbooks8.4Evidence acquisition procedure8.5Forensic analysis of the scenario8.6Recovery and validation plan8.7Technical and executive report8.8Critical evaluation of the response8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which allows it to be combined with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Volatility, Autopsy, Velociraptor, Zeek, in free, academic or evaluation versions. Practicals are based on real procedures: simulated response to ransomware on an OT network, forensic acquisition from an engineering workstation, and analysis of captured industrial traffic that has been altered. Assessment is continuous by module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient command of Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The work is done with Wireshark, Volatility, Autopsy, Velociraptor and Zeek. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the advanced programme. Check the recognition policy when you enrol.
Related programmes
Postgraduate Diploma in Operational Dashboards and Real-Time Analytics
800-hour online Postgraduate Diploma in Operational Dashboards and Real-Time Analytics. 8 modules covering ISO 22400-2, ISA-101.01 and Grafana. Assigned tutor and open enrolment.
Postgraduate Diploma in LiDAR/Vision SLAM and Precision Localisation
Online 800 h Postgraduate Diploma in LiDAR/Vision SLAM and Precision Localisation. 8 modules with ISO 3691-4:2023, IEC 60825-1:2014 and ROS 2. Assigned tutor and open enrolment.
Diploma in Vision-Guided Integration for Welding
Online postgraduate diploma of 800 hours in vision-guided integration for welding: 8 modules covering machine vision in robotic welding, vision system calibration, joint detection and localisation,…
More in Robotics, Automation & Control
All Robotics, Automation & Control programmes → · How to apply · Fees & financing · Scholarships