Postgraduate Diploma in Incident Response and Industrial Forensics
Online 800 h Postgraduate Diploma in Incident Response and Industrial Forensics. 8 modules covering NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and Wireshark. Assigned tutor and open enrolment.
Postgraduate Diploma in Incident Response and Industrial Forensics — studying from the United Kingdom
Robotics and automation are growing across the United Kingdom, from manufacturing and logistics to healthcare and research. Universities including Bristol, Oxford, Imperial College London and Edinburgh host robotics research, while the Robotics and Autonomous Systems hub and the Advanced Robotics Hub support collaboration with industry. Manufacturers, logistics operators and automation integrators employ engineers in control systems, sensing, programming and systems integration. Safety standards for collaborative robots shape deployment across industries.
Fees for the United Kingdom: £910 (Pound sterling), with instalments and employer sponsorship available.
Relevant bodies in the United Kingdom
Typical roles
Questions from the United Kingdom
Which UK bodies recognise robotics and control engineering, and how does SEIUM's training fit?
The Institution of Engineering and Technology and the Institution of Mechanical Engineers are the main UK professional bodies for control and automation engineers. Chartered status is awarded through the Engineering Council via accredited routes. SEIUM's private qualifications are not accredited by any national body, so any recognition by these institutions is their own decision.
Will UK robotics and automation employers value a private online qualification?
UK robotics and automation employers usually weigh practical projects, programming skills and relevant experience heavily. A private qualification can support your CV where it reflects applied control or robotics work, particularly a strong final project. Employers decide how much value to attach to it, so tailor your application to their stated requirements.
Can I balance this with a UK job, and is there support in English?
Yes. The programmes are 100% online, taught in English, and you are assigned a technical tutor for support. Study ranges from 300 to 1,900 hours, so plan your schedule accordingly. Fees are payable in instalments, and employer sponsorship is possible. No student visa is required because you study from within the UK.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Plan safe recovery and process validation.
Extract lessons learned and improve the management system.
Who it's for
- OT incident response analyst looking to specialise in Incident Response and Industrial Forensics.
- Industrial digital forensic expert looking to specialise in Incident Response and Industrial Forensics.
- Industrial SOC analyst looking to specialise in Incident Response and Industrial Forensics.
- Plant continuity manager looking to specialise in Incident Response and Industrial Forensics.
- OT cybersecurity consultant looking to specialise in Incident Response and Industrial Forensics.
- Crisis management coordinator looking to specialise in Incident Response and Industrial Forensics.
- Graduates in engineering or science seeking to enter the energy sector.
What you'll work with
- NIST SP 800-61 Rev. 3
- ISO/IEC 27035-1:2023
- ISO/IEC 27037:2012
- IEC 62443-2-1
- NIST SP 800-82 Rev. 3
- Directiva (UE) 2022/2555 NIS2
- ISO/IEC 27043:2015
- NIST SP 800-86
8 modules · 800 h
1.1OT incident taxonomy1.2Reference cases in energy and industry1.3MITRE ATT&CK for ICS framework1.4Two-stage industrial kill chain1.5Impact on safety, the environment and production1.6Threat actors and motivations1.7Differences from IT response1.8NIS2 notification obligations1.9Coordination with INCIBE-CERT and sectoral CSIRTs1.10Practical case: reconstructing a public incident with ATT&CK for ICS
2.1NIST SP 800-61 response lifecycle2.2OT-specific response plan2.3Team roles and escalation2.4Integration with plant emergency plans2.5Playbooks by incident type2.6Response kits and tools2.7Backups of logic and configuration2.8Internal and external communication2.9Tabletop exercises and drills2.10Workshop: ransomware playbook for a supervisory network
3.1Detection sources in the plant3.2Industrial IDS alerts3.3Process anomaly indicators3.4Triage and severity classification3.5Distinguishing a technical fault from an attack3.6Initial containment without stopping the process3.7Safe shutdown decision3.8Recording actions from the outset3.9Chain of custody from the start3.10Practice: alert triage in a simulated industrial SOC
4.1Principles of ISO/IEC 270374.2Volatility and order of acquisition4.3Memory acquisition on engineering workstations4.4Disk images of SCADA servers4.5Capture of industrial network traffic4.6Extraction of PLC logic and firmware4.7HMI and historian logs4.8Risks of altering devices in operation4.9Documentation and integrity hashes4.10Laboratory: acquiring evidence from an engineering workstation
5.1Analysis of Modbus, S7comm and DNP3 traffic5.2Comparison of PLC logic with baseline5.3Timeline of events5.4Analysis of Windows artefacts on HMI5.5ICS-oriented malware analysis5.6Correlation of process and security logs5.7Open-source forensic tools5.8Attribution and its limits5.9Forensic report and technical language5.10Practice: analysis of a capture containing malicious PLC writes
6.1Zone-based containment strategies6.2Restoration of verified logic and configuration6.3Rebuilding compromised workstations6.4Functional safety validation after an incident6.5Staged process restart6.6Enhanced post-incident monitoring6.7Vendor management during recovery6.8Costs and impact of the incident6.9Insurance and contractual aspects6.10Practical case: recovery plan for a water treatment plant
7.1Structured post-incident review7.2Root cause analysis7.3Updating CSMS controls7.4Response indicators: MTTD and MTTR7.5Sharing threat intelligence7.6Legal aspects and data protection7.7Ethics of the forensic analyst7.8Preparing executive reports7.9Planning new exercises7.10Workshop: lessons-learned report after a drill
8.1Incident scenario and scope8.2Response plan tailored to the plant8.3Main playbooks8.4Evidence acquisition procedure8.5Forensic analysis of the scenario8.6Recovery and validation plan8.7Technical and executive report8.8Critical evaluation of the response8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which allows it to be combined with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Volatility, Autopsy, Velociraptor, Zeek, in free, academic or evaluation versions. Practicals are based on real procedures: simulated response to ransomware on an OT network, forensic acquisition from an engineering workstation, and analysis of captured industrial traffic that has been altered. Assessment is continuous by module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient command of Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The work is done with Wireshark, Volatility, Autopsy, Velociraptor and Zeek. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the advanced programme. Check the recognition policy when you enrol.
Related programmes
Postgraduate Diploma in OPC UA Information Models and Pub-Sub
Online 800 h Postgraduate Diploma in OPC UA Information Models and Pub-Sub. 8 modules covering IEC 62541-1, IEC 62541-3 and UaExpert. Assigned tutor and enrolment open.
Postgraduate Diploma in Layout 4.0 and Intralogistics Flow Simulation
Online 800 h Postgraduate Diploma in Layout 4.0 and Intralogistics Flow Simulation. 8 modules with VDI 3633 Blatt 1, EN 15635:2008 and FlexSim. Assigned tutor and…
Diploma in Ethics and Governance of Collaborative Systems
Online postgraduate diploma of 800 hours in ethics and governance of collaborative systems: 8 modules covering the ethics of collaborative automation, labour and social impact, the…
More in Robotics, Automation & Control
All Robotics, Automation & Control programmes → · How to apply · Fees & financing · Scholarships