Substation Cybersecurity Course
Online 300-hour course in substation cybersecurity. 6 modules covering IEC 62443, IEC 62351 and Wireshark. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Identify the threats affecting electrical substations.
Interpret the sector's cybersecurity standards and regulation.
Design secure architectures based on zones and conduits.
Apply security measures to substation protocols.
Implement detection and monitoring systems.
Assess risks according to the IEC 62443 series.
Develop incident response and recovery plans.
Who it's for
- Industrial cybersecurity specialist looking to specialise in Cybersecurity in substations.
- Substation engineer looking to specialise in Cybersecurity in substations.
- Security operations centre analyst looking to specialise in Cybersecurity in substations.
- OT security auditor looking to specialise in Cybersecurity in substations.
- Security architect looking to specialise in Cybersecurity in substations.
- Critical infrastructure security manager looking to specialise in Cybersecurity in substations.
- Engineering or science graduates looking to enter electricity transmission.
What you'll work with
- IEC 62443
- IEC 62351
- Directive (EU) 2022/2555 (NIS2)
- Delegated Regulation (EU) 2024/1366 (Network Code on Cybersecurity)
- ISO/IEC 27019:2024
- NERC CIP
- Law 8/2011, on the protection of critical infrastructure
- Regulation (EU) 2024/2847 on Cyber Resilience
6 modules · 300 h
1.1Overview of threats to the electricity sector1.2Ukraine incidents of 2015 and 20161.3Industroyer and its analysis1.4Supply chain attacks1.5Substation attack surface1.6Differences between IT and OT1.7Adversaries and motivations1.8MITRE ATT&CK for ICS framework1.9Lessons from real incidents1.10Case study: academic analysis of the Ukrainian incident
2.1IEC 62443 and its parts2.2IEC 62351 for protocols2.3NERC CIP as a reference2.4NIS2 Directive2.5European network code on cybersecurity2.6Critical infrastructure protection law2.7Esquema Nacional de Seguridad (National Security Scheme)2.8Cyber Resilience Act2.9ISO/IEC 270192.10Workshop: requirements map for an operator
3.1Zones and conduits3.2Network segmentation3.3Industrial firewalls3.4Data diodes3.5Secure remote access3.6Identity and role management3.7GOOSE message authentication3.8Security of IEC 104 and DNP3 protocols3.9IED hardening3.10Practice: zone and conduit design
4.1Asset inventory4.2Passive network monitoring4.3Anomaly detection4.4Industrial IDS systems4.5SIEM event correlation4.6IED security logs4.7Vulnerability management4.8Threat intelligence4.9Security operations centre4.10Laboratory: anomaly detection in substation traffic
5.1Risk assessment according to IEC 62443-3-25.2Target security levels5.3Incident response plans5.4Incident notification5.5Recovery and backups5.6Operational continuity5.7Cybersecurity exercises5.8Training and awareness5.9Supplier management5.10Workshop: incident response exercise
6.1Substation inventory and analysis6.2Risk assessment6.3Proposed secure architecture6.4Technical and organisational controls6.5Monitoring plan6.6Response plan6.7Network segmentation design6.8Vulnerability management plan6.9Report and presentation6.10Final review with the tutor
How you'll learn
100 % online training on the SEIUM Institute campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it possible to combine the programme with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Zeek, Nozomi Networks Guardian, Claroty, GRASSMARLIN, in free, academic or evaluation versions. Tests are studied using real procedures for zone and conduit design, anomaly detection in industrial traffic and incident response exercises. Assessment is continuous by module, plus the final integrating project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Identify the threats affecting electrical substations.
Interpret the sector's cybersecurity standards and regulation.
Design secure architectures based on zones and conduits.
Apply security measures to substation protocols.
Implement detection and monitoring systems.
Where this takes you
Requirements
- No prior degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient level of Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme comprises 300 hours in total, spread over 3 to 5 months. That is between 10 and 15 hours per week on average, compatible with a full-time job.
You work with Wireshark, Zeek, Nozomi Networks Guardian, Claroty, GRASSMARLIN. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM Institute diploma upon passing the continuous assessment and the integrating project. This is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised towards the higher-level programme. Check the recognition policy when you enrol.
Related programmes
Course in Protection Coordination in MV/LV Networks
Online 300-hour course in protection coordination in MV/LV networks. 6 modules covering IEC 60909 (short-circuit currents in three-phase systems), IEC 60255-151 (overcurrent protection requirements) and ETAP.…
EMS Course in Hybrid Renewable Plants
Online 300-hour course in EMS for hybrid renewable plants. 6 modules covering Regulation (EU) No 1227/2011 (wholesale energy market integrity and transparency, REMIT), Regulation (EU) 2017/2195…
Course in ISO Standards and Safety in H₂
Online 300-hour course in ISO standards and H₂ safety. 6 modules covering ISO/TR 15916, ISO 22734 and HyRAM+. Assigned tutor and open enrolment.
More in Energy and Networks
All Energy and Networks programmes → · How to apply · Fees & financing · Scholarships