CYBRARY Your progress dashboard — sign in and your reading and scores follow you between machines.
IEC 62443 course
Four units. What the standard means by a zone and a conduit, how a zone’s protection profile states how well it must hold, how a detection becomes evidence for a foundational requirement, and how a breach is worked without making the plant less safe. Each unit ends with a graded assessment; each module links to where the idea is done for real on the range.
0 of 11 modules read · 0 of 4 assessments passed · 0% through
Unit 1 — Zones, conduits and levels
What the standard means by a zone and a conduit, how a plant stacks into levels, and why the boundary between the office and the process is the one that decides everything else.
- What IEC 62443 actually asks for10 min
A family of documents about industrial automation security. What it is, what it is not, and the three words the whole thing turns on.
- Levels, zones and the plant floor range12 min
The Purdue levels bottom to top, and the five zones the Forge plant range is actually cut into.
- Conduits, and what is watched on each10 min
The four declared crossings on the range, what each allows, and the thing each one is watched for.
- Unit 1 assessment — Zones, conduits and levelspass at 75%
Six questions on what a zone is, what a conduit is, and how a plant stacks up.
Unit 2 — Security levels and protection profiles
Saying out loud how well each zone must hold: the target security level, the foundational requirements it is argued from, and the finding that takes a zone out of profile.
- Security levels: how hard must this hold?11 min
SL0 to SL4 in plain words, the difference between target and achieved, and why one plant runs at several levels at once.
- The seven foundational requirements12 min
FR1 to FR7 — what each asks for, and which of them a given zone is actually argued on.
- Writing a zone's protection profile13 min
Target level, the requirements it is argued from, what must hold, and the one finding that takes the zone out of profile.
- Unit 2 assessment — Security levels and protection profilespass at 75%
Six questions on target levels, the seven requirements, and what breaches a profile.
Unit 3 — Detections as evidence
Turning an alert into an argument: which zone raised it, which requirement it speaks to, and what an assessor would accept as proof the requirement holds.
- A detection is evidence for a requirement12 min
How each plant alert is placed in exactly one zone and attached to one foundational requirement, with a reason.
- Reading the checklist, gaps and all10 min
Which requirements currently have graded detections standing behind them, and how to report the ones that do not.
- Where the scenarios come from10 min
Each plant scenario is modeled on published incident reporting and ATT&CK for ICS, not invented.
- Unit 3 assessment — Detections as evidencepass at 75%
Six questions on placing an alert, reading the checklist and reporting gaps.
Unit 4 — Working a breach without breaking the plant
The safe response in a zone that cannot simply be switched off, what to contain at a conduit, when to escalate to operations, and what the closed case has to hold.
- The safe response in a plant12 min
Why the IT reflex — isolate the box — is often the wrong move here, and what the alternatives are.
- Working the queue and closing the case12 min
Filing alerts to a zone and a response, watching the breach timeline resolve, and what the closed case must hold.
- Unit 4 assessment — Working a breach safelypass at 75%
Six questions on the safe response, the queue and the closed case.
The identifiers here — foundational requirement numbers, security levels, ATT&CK for ICS technique ids — are the published ones. The mapping between them and Forge content is ours, offered for planning, and is not an accreditation. The standards pages show the same mapping against live range data.