Master’s in IoT/OT Cybersecurity (IEC 62443)
Online master's programme of 1,900 hours in IoT/OT cybersecurity to IEC 62443 (threat modelling, hardening, key management). 12 modules covering OT and industrial IoT environments, the IEC 62443 series, IACS risk assessment, industrial protocols, secure network architecture, embedded device security, secure product development, OT monitoring, incident response, the European regulatory framework and OT security auditing, with an assigned technical tutor.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Apply the requirements of the IEC 62443 series to industrial control systems.
Assess cybersecurity risks using zones, conduits and security levels.
Design segmented OT network architectures with defence in depth.
Protect embedded IoT devices with secure boot and key management.
Deploy OT-specific threat monitoring and detection.
Manage industrial incidents while minimising the impact on operations.
Verify compliance with NIS2 and the Cyber Resilience Act.
Who it's for
- OT cybersecurity engineers consolidating their knowledge of IEC 62443.
- Industrial SOC analysts who need OT-specific detection skills.
- IACS security architects designing zones, conduits and defence in depth.
- IEC 62443 auditors and assessors.
- IoT product security managers preparing products for certification and the CRA.
- NIS2 compliance consultants working with industrial clients.
- Engineering or science graduates aiming to enter the electrical power sector.
What you'll work with
- IEC 62443-3-3 (system security requirements and security levels)
- IEC 62443-4-2 (technical security requirements for IACS components)
- IEC 62443-3-2 (security risk assessment for system design)
- IEC 62443-4-1 (secure product development lifecycle)
- Directive (EU) 2022/2555 (NIS2) (cybersecurity of essential and important entities)
- Regulation (EU) 2024/2847 (Cyber Resilience Act) (cybersecurity requirements for products with digital elements)
- NIST SP 800-82 Rev. 3 (guide to OT security)
- ETSI EN 303 645 (cybersecurity baseline for consumer IoT)
- Wireshark
- Zeek
- Suricata
- Nozomi Networks Guardian
- Claroty xDome
12 modules
1.1Architecture of industrial control systems1.2Differences between IT and OT security1.3The Purdue model and functional levels1.4PLC, RTU, DCS and SCADA1.5IoT devices and field gateways1.6Critical assets and essential infrastructure1.7Reference incidents: Stuxnet, Triton, Industroyer1.8Threat landscape in OT environments1.9Availability and physical safety requirements1.10Case study: asset inventory of a process plant
2.1Structure of the series and defined roles2.2Terminology and concepts of IEC 62443-1-12.3Asset owner security programme: 2-12.4Patch management in IACS: 2-32.5Requirements for service providers: 2-42.6System requirements and security levels (SL): 3-32.7Secure development lifecycle: 4-12.8Technical requirements for components: 4-22.9ISASecure and IECEE certification schemes2.10Workshop: matrix of foundational requirements FR1-FR7
3.1IEC 62443-3-2 methodology3.2Identification of the system under consideration3.3Partitioning into zones and conduits3.4Initial and detailed risk assessment3.5Determination of target security levels3.6Integration with HAZOP and LOPA analysis3.7Quantification of operational consequences3.8Documentation of cybersecurity requirements3.9Periodic risk review3.10Case study: zoning of a substation
4.1Modbus TCP and the lack of authentication4.2DNP3 and DNP3 Secure Authentication4.3IEC 60870-5-104 in telecontrol4.4OPC UA and its security model4.5PROFINET and EtherNet/IP4.6MQTT, CoAP and lightweight IoT protocols4.7Traffic analysis with Wireshark4.8Replay and spoofing attacks4.9Encryption and signing in field protocols4.10Lab: capture and dissection of Modbus traffic
5.1Defence in depth for IACS5.2Segmentation with industrial firewalls5.3Industrial DMZ and gateway servers5.4Data diodes and unidirectional communication5.5Secure remote access for suppliers5.6Secure industrial wireless networks5.7Secure management of switches and routers5.8Microsegmentation and zero trust in OT5.9NIST SP 800-82 reference architectures5.10Practical exercise: conduit design with firewall rules
6.1Hardware root of trust and TPM6.2Secure elements and key storage6.3Secure boot and firmware signing6.4Authenticated OTA updates6.5ETSI EN 303 645 requirements6.6Device identity management6.7Hardening of embedded Linux6.8Debug interfaces and JTAG protection6.9Firmware analysis and SBOM6.10Lab: secure boot on a microcontroller
7.1The IEC 62443-4-1 process step by step7.2Threat modelling with STRIDE7.3Component security requirements7.4Code review and static analysis7.5Fuzz testing of industrial protocols7.6Vulnerability management and CVD7.7Defence-in-depth documentation7.8Cyber resilience under the CRA Regulation7.9Preparing for a certification audit7.10Practical exercise: threat model of an IoT gateway
8.1Passive asset inventory8.2OT-specific IDS systems8.3Baseline anomaly detection8.4Integration with SIEM and the industrial SOC8.5The MITRE ATT&CK for ICS matrix8.6Threat intelligence in industrial environments8.7Log management on field devices8.8Indicators of compromise in controllers8.9Detection effectiveness metrics8.10Lab: detection rules with Zeek and Suricata
9.1Response plans adapted to OT9.2Coordination between operations and cybersecurity9.3Containment without stopping the process9.4Forensic analysis of PLCs and HMIs9.5Recovery and configuration backups9.6Reporting to authorities and INCIBE-CERT9.7Crisis simulation exercises9.8Lessons learned and continuous improvement9.9Business continuity in the plant9.10Case study: ransomware on a manufacturing network
10.1The NIS2 Directive and essential entities10.2The Cyber Resilience Act (CRA)10.3Spanish Critical Infrastructure Protection Law10.4Spanish National Security Framework (ENS) in OT10.5Machinery Regulation and cybersecurity10.6The RED Directive and radio requirements10.7ISO/IEC 27001 applied to industrial environments10.8Supervision and penalty regime10.9Supply chain and suppliers10.10Workshop: gap analysis against NIS2
11.1Planning audits in the plant11.2IEC 62443-3-3 conformity assessment11.3Safe penetration testing in OT11.4Use of test benches and digital twins11.5PLC configuration review11.6Validation of network segmentation11.7Technical and executive reports11.8Prioritised remediation plans11.9Measuring cybersecurity maturity11.10Practical exercise: audit of a SCADA test bench
12.1Selection of the target industrial system12.2Risk analysis and zoning12.3Definition of target security levels12.4Design of the protection architecture12.5Implementation of technical controls12.6Validation through testing12.7Monitoring and response plan12.8Final conformity assessment12.9Master's Thesis report12.10Master's Thesis: defence before a panel
How you'll learn
Training is 100% online on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within the intake, so the programme fits around your job.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Zeek, Suricata, Nozomi Networks Guardian and Claroty xDome, in free, academic or evaluation versions. Real procedures are studied: risk assessment by zones and conduits, penetration testing on SCADA test benches and industrial traffic monitoring. Assessment is continuous by module, plus the final Master's Thesis.
Standards covered: IEC 62443-3-3, IEC 62443-4-2, IEC 62443-3-2, IEC 62443-4-1, Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2024/2847 (Cyber Resilience Act), NIST SP 800-82 Rev. 3, ETSI EN 303 645.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- University degree in engineering, science or architecture, or equivalent demonstrable professional experience.
- Internet connection and a computer able to run the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with Wireshark, Zeek, Suricata, Nozomi Networks Guardian and Claroty xDome, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.
A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the software and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Master’s in Embedded Linux and BSP
Online master's programme of 1,900 hours in embedded Linux and BSP development (Yocto, device tree, drivers, secure boot). 12 modules covering embedded Linux architecture, bootloaders, the…
Master’s in Embedded Linux and BSP Engineering
Online master's programme of 1,900 hours in embedded Linux and BSP engineering. 12 modules covering embedded Linux architecture, boot loaders and U-Boot, kernel configuration and Devicetree,…
Master’s in Security, Safety and Compliance Engineering
Online master's programme of 1,900 hours in safety, security and compliance engineering, structured in 12 modules covering CE marking, electrical safety, EMC, functional safety, product cybersecurity,…
More in Electronics, Embedded Systems & Telecom
All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships