Apply now
Master'sInsurance, Risk & Actuarial Data Applications open

Master’s in OT/IoT Cyber-Risk for Transport and Infrastructure Engineering

Online master's programme of 1,900 hours in OT/IoT Cyber Risk Engineering for Transport and Infrastructure, structured in 12 modules covering OT and IoT systems, the threat landscape, the regulatory framework, control system security, cyber risk assessment, cyber insurance, accumulation modelling, detection and response, cyber claims, vehicle and fleet security, and governance and resilience, with an assigned technical tutor.

Duration1900 h
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Analyse the OT and IoT architecture of transport and infrastructure.

02

Identify threats and attack vectors in control systems.

03

Apply the IEC 62443 series and the NIS2 Directive.

04

Quantify cyber risk with models such as FAIR.

05

Design and underwrite cyber insurance covers.

06

Model the accumulation of cyber risk across portfolios.

07

Organise response and resilience against cyber incidents.

Profile

Who it's for

  • OT cybersecurity specialists in transport and critical infrastructure.
  • Cyber risk underwriters looking to understand industrial and transport exposures.
  • Quantitative cyber risk analysts.
  • Infrastructure security managers at ports, railways, airports and motorways.
  • Digital forensic experts handling incidents in control systems.
  • NIS2 compliance consultants.
  • Engineering or science graduates aiming to join transport operators.
Standards & tools

What you'll work with

  • Directive (EU) 2022/2555 (NIS2)
  • IEC 62443 series (security of industrial automation and control systems)
  • Regulation (EU) 2024/2847 (Cyber Resilience Act)
  • Law 8/2011 (Spanish critical infrastructure protection)
  • Royal Decree 311/2022 (Spanish National Security Framework)
  • ISO/IEC 27001:2022 (information security management)
  • NIST SP 800-82 (guide to OT security)
  • UN Regulation No. 155 (vehicle cybersecurity)
  • Nozomi Networks Guardian
  • Wireshark
  • MITRE ATT&CK for ICS Navigator
  • Claroty
  • RiskLens (FAIR)
Syllabus

12 modules · 1900 h

  1. 1.1Differences between IT and OT
  2. 1.2SCADA and PLC systems
  3. 1.3Railway signalling and traffic control
  4. 1.4Port and airport systems
  5. 1.5Toll and motorway management systems
  6. 1.6Connected vehicles and fleet IoT
  7. 1.7Industrial protocols: Modbus, DNP3, OPC UA
  8. 1.8The Purdue model
  9. 1.9OT asset life cycle
  10. 1.10Case study: OT inventory of a traffic control centre
  1. 2.1Threat actors and motivations
  2. 2.2Ransomware against transport operators
  3. 2.3Attacks on industrial control systems
  4. 2.4Historical incidents in infrastructure
  5. 2.5Supply chain attacks
  6. 2.6Insider threats
  7. 2.7GNSS interference
  8. 2.8MITRE ATT&CK for ICS
  9. 2.9Threat intelligence
  10. 2.10Practical exercise: mapping an incident with ATT&CK for ICS
  1. 3.1The NIS2 Directive
  2. 3.2Spanish Critical Infrastructure Protection Law
  3. 3.3Spanish National Security Framework (ENS)
  4. 3.4Cyber Resilience Act
  5. 3.5Sector regulations for rail and aviation
  6. 3.6UN Regulations 155 and 156 for vehicles
  7. 3.7DORA and the insurance sector
  8. 3.8Incident reporting
  9. 3.9Directors' liability
  10. 3.10Workshop: NIS2 compliance matrix for an operator
  1. 4.1IEC 62443 series
  2. 4.2Zones and conduits
  3. 4.3Target security levels
  4. 4.4OT network segmentation
  5. 4.5Secure remote access
  6. 4.6Patch management in OT
  7. 4.7Passive network monitoring
  8. 4.8IoT device security
  9. 4.9System hardening
  10. 4.10Lab: segmenting an OT network into zones and conduits
  1. 5.1Risk analysis methodologies
  2. 5.2Risk assessment according to IEC 62443-3-2
  3. 5.3Physical impact scenarios
  4. 5.4Consequences for people's safety
  5. 5.5Quantification with the FAIR model
  6. 5.6Probabilities and incident data
  7. 5.7Interdependency analysis
  8. 5.8Third-party and supplier risk
  9. 5.9Risk reporting to senior management
  10. 5.10Practical exercise: FAIR quantification of a ransomware scenario
  1. 6.1The cyber insurance market
  2. 6.2First-party and third-party covers
  3. 6.3Business interruption from cyberattacks
  4. 6.4Physical damage from cyberattacks
  5. 6.5War and state-act exclusions
  6. 6.6Silent cyber in traditional policies
  7. 6.7Underwriting questionnaires
  8. 6.8Minimum required controls
  9. 6.9Incident response assistance
  10. 6.10Case study: underwriting a bus operator
  1. 7.1Systemic cyber risk
  2. 7.2Accumulation scenarios
  3. 7.3Cloud provider failure
  4. 7.4Mass vulnerabilities
  5. 7.5Cyber catastrophe models
  6. 7.6Supervisory stress scenarios
  7. 7.7Portfolio aggregation management
  8. 7.8Cyber reinsurance
  9. 7.9Limits and sub-limits
  10. 7.10Lab: accumulation scenario from a common vulnerability
  1. 8.1OT security operations centres
  2. 8.2Anomaly detection in industrial networks
  3. 8.3Incident response plan
  4. 8.4Containment in OT environments
  5. 8.5Forensic analysis of control systems
  6. 8.6Recovery and restoration
  7. 8.7Communication with authorities and CSIRTs
  8. 8.8Crisis exercises
  9. 8.9Lessons learned
  10. 8.10Practical exercise: cyber incident drill at a port
  1. 9.1Claim notification
  2. 9.2Forensic experts and response
  3. 9.3Quantifying business interruption
  4. 9.4Restoration costs
  5. 9.5Extortion and payments
  6. 9.6Third-party claims
  7. 9.7Penalties and fines
  8. 9.8Recoveries from suppliers
  9. 9.9Coverage disputes
  10. 9.10Case study: settling a ransomware claim
  1. 10.1Vehicle electronic architecture
  2. 10.2CAN bus attacks
  3. 10.3Telematics unit security
  4. 10.4Secure over-the-air updates
  5. 10.5EV charging security
  6. 10.6Protection of connected fleets
  7. 10.7V2X security
  8. 10.8Vulnerability management across the fleet
  9. 10.9Insurance for connected fleets
  10. 10.10Workshop: TARA of a fleet management platform
  1. 11.1OT cybersecurity governance
  2. 11.2Roles of the CISO and OT security lead
  3. 11.3Culture and awareness
  4. 11.4Supplier management
  5. 11.5Business continuity
  6. 11.6Operational resilience
  7. 11.7Cybersecurity indicators
  8. 11.8Audits and certifications
  9. 11.9Security investment and ROI
  10. 11.10Practical exercise: OT cyber risk dashboard
  1. 12.1Selection of the infrastructure or fleet
  2. 12.2Inventory and architecture
  3. 12.3Threat analysis
  4. 12.4Quantitative risk assessment
  5. 12.5Technical controls plan
  6. 12.6Insurance transfer strategy
  7. 12.7Response and resilience plan
  8. 12.8Conclusions
  9. 12.9Master's Thesis report
  10. 12.10Master's Thesis: defence before a panel
Methodology, software & labs

How you'll learn

100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: you progress at your own pace within the intake, so you can combine it with your job.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Nozomi Networks Guardian, Wireshark, MITRE ATT&CK for ICS Navigator, Claroty and RiskLens (FAIR), in free, academic or evaluation versions. Testing is studied through real procedures: cyber risk quantification for transport infrastructure, OT network segmentation according to IEC 62443, and underwriting and settlement of cyber insurance claims. Assessment is continuous by module, plus the final Master's Thesis.

Standards covered: Directive (EU) 2022/2555 (NIS2), IEC 62443 series, Regulation (EU) 2024/2847 (Cyber Resilience Act), Law 8/2011, Royal Decree 311/2022 (ENS), ISO/IEC 27001:2022, NIST SP 800-82 and UN Regulation No. 155.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of NIS2, the IEC 62443 series and the Cyber Resilience Act applied to real cases, not as a theoretical annex.
Industry software:Nozomi Networks Guardian, Wireshark, MITRE ATT&CK for ICS Navigator, Claroty and RiskLens (FAIR), in free, academic or evaluation versions.
Master's Thesis with defence:A cyber risk project for an infrastructure or fleet, with quantitative risk assessment, controls plan and insurance transfer strategy, defended before a panel.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

OT inventory and threats
Build the OT inventory of a transport asset and map its threats with ATT&CK for ICS.
Zones and conduits
Segment the OT network into zones and conduits according to IEC 62443.
FAIR quantification
Quantify a ransomware scenario with FAIR and assess portfolio accumulation.
Insurance and response
Define the insurance transfer strategy and an incident response and resilience plan.
Master's Thesis
Complete cyber risk project for an infrastructure or fleet, defended before a panel.
Career opportunities

Where this takes you

OT cybersecurity specialistCyber risk underwriterQuantitative cyber risk analystInfrastructure security managerDigital forensic expertNIS2 compliance consultant
Admissions & scholarships

Requirements

  • A university degree in engineering, science or architecture, or equivalent demonstrable professional experience.
  • An internet connection and a computer capable of running the programme's software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Nozomi Networks Guardian, Wireshark, MITRE ATT&CK for ICS Navigator, Claroty and RiskLens (FAIR), using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.

A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the programme's software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Insurance, Risk & Actuarial Data
Master's8,850 $

Master’s in Telematics and Actuarial Pricing of Connected Mobility Engineering

Online master's programme of 1,900 hours in telematics and actuarial pricing engineering for connected mobility, structured in 12 modules covering connected vehicle data, insurance price theory,…

1900 hOnlineInsurance, Risk & Actuarial Data
Master's8,850 $

Master’s in Actuarial Models with Telematics Data Engineering

Online master's programme of 1,900 hours in actuarial modelling engineering with telematics data, structured in 12 modules covering actuarial statistics, telematics data, frequency and severity models,…

1900 hOnlineInsurance, Risk & Actuarial Data
Master's8,850 $

Master’s in Fraud, Anomalies and Advanced Detection in Mobility Insurance Engineering

Online master's programme of 1,900 hours in Fraud, Anomaly and Advanced Detection Engineering in Mobility Insurance. 12 modules covering fraud typologies, detection data, anomaly statistics, supervised…

1900 hOnlineInsurance, Risk & Actuarial Data
Master’s in OT/IoT Cyber-Risk for Transport and Infrastructure EngineeringEnrol
Related programmes

More in Insurance, Risk & Actuarial Data

Master’s in Credit, Leasing and Residual Value in Mobility EngineeringView programme →Master’s in Claims Management and Claims Analytics Engineering (SIU/Anti-Fraud)View programme →Master’s in Insurance for Off-Highway, Mining and Construction EngineeringView programme →Master’s in Catastrophes, Climate & Environment EngineeringView programme →Master’s in Reinsurance, ART and Catastrophe Bonds Engineering (CAT Bonds)View programme →Master’s in Compliance and Technical Auditing EngineeringView programme →

All Insurance, Risk & Actuarial Data programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.