ISA/IEC 62443 Certification Guide: Exam, Prerequisites and Career Value

Plenty of OT job adverts ask for "62443 certification", but the ISA/IEC 62443 Cybersecurity Certificate Program is a course-and-exam certificate path, not a single exam you can book on its own, and that changes how you plan, budget and present it. This guide explains what the International Society of Automation (ISA) publishes about the programme: the four certificates and their courses, the two hour multiple-choice exams, the six month eligibility window, retest and extension fees, the Expert designation, and ISA's statement that the certificates do not need renewing. It is written for control engineers, OT security practitioners, integrators and the managers who fund their training. It covers the people certificates only; product and process certification under ISASecure is a separate scheme, mentioned for context. All programme facts were checked on isa.org on 26 October 2026; ISA says prices are subject to change, so confirm on the course page before you book. For the standard itself, see the IEC 62443 Guide.

Key takeaways

• Four certificates, one fixed starting point. Certificate 1 (Fundamentals Specialist, course IC32) must come first; Certificates 2 (Risk Assessment), 3 (Design) and 4 (Maintenance) can then be taken in any order.
• Course first, then exam. Each certificate requires completing its ISA course and passing its exam. ISA sends the exam invitation within three business days of course completion, and you then have six months to test and retest.
• The exams are short and closed-book. ISA states that all its certificate exams are two hours, closed-book and multiple-choice: 90 questions for IC32 and IC33, 100 for IC34 and IC37, delivered through Meazure Learning at a test centre or online.
• All four earn the Expert title. Holders of all four certificates are automatically recognised as ISA/IEC 62443 Cybersecurity Experts. The IC48 Fast Track course bundles the content and exams for Certificates 2 to 4 after IC32.
• No renewal, so keep your own currency. ISA states you are not required to renew the certificates and that they will not expire, which keeps cost down but means you must show employers how your knowledge has kept pace with the standard's newer parts.

Who the certification is for

The 62443 series is written around shared responsibility between four groups that ISA names: asset owners, integrators, automation product suppliers and service suppliers. The certificate programme suits people in any of those groups who need to apply the standard rather than just recognise it.

• Asset owner staff: control and automation engineers, OT security leads and site engineering managers who must run a security programme for industrial automation and control systems (IACS) under Part 2-1 and commission risk assessments under Part 3-2. See the OT Security Guide for the wider programme.
• Integrators and service providers: engineers who design zones and conduits, write security requirements into projects and maintain systems in operation, and who are increasingly asked by clients for evidence of 62443 competence (Part 2-4 sets requirements for IACS service providers).
• Product suppliers: product security and development staff who need the vocabulary of Parts 4-1 and 4-2. The people certificates help them work with the standard, but product conformity is shown through ISASecure, not through individual certificates.
• IT security professionals moving into OT: people who know enterprise security but not control systems. Certificate 1 gives a common language with engineers; pairing it with a practitioner OT certification such as the one in the GICSP Certification Guide covers more hands-on ground.
• Weaker fit: people with no exposure to industrial environments who want a general security credential. The programme is narrow by design and its value is highest where 62443 is already used in contracts, tenders or site policy.

Exam format and domains

The four certificates

The sequence follows the lifecycle in the standard: understand the series, assess risk (Part 3-2), design to target security levels (Part 3-3), then operate and maintain (Part 2-1 and the patch management report, Part 2-3). ISA does not publish a domain-by-domain weighting for each exam, so use the course outline as the syllabus.

What ISA states about every certificate exam

Two hours for 90 to 100 questions leaves a little over a minute per question. The exams test whether you can apply the standard's terms and requirements to a scenario, so recognising the difference between, for example, a zone and a conduit, or a target and an achieved security level, matters more than memorising clause numbers.

Prerequisites and experience

ISA's programme page sets one hard prerequisite: Certificate 1 must be earned before the others. It does not set a minimum years-of-experience requirement for the certificates, and the course pages read for this guide did not list recommended prerequisites. In practice the courses assume you can follow a control system architecture, so the following background helps.

• Control system basics: what PLCs, DCS, SCADA servers, HMIs, engineering workstations and safety instrumented systems do, and how they talk across a plant network. The NIST SP 800-82 OT Security Guide is a free primer.
• Networking: segmentation, firewalls, routing and the industrial protocols you will meet on site. This carries most weight in IC34.
• Risk methods: any experience of HAZOP, LOPA or process safety reviews makes the IC33 risk assessment approach easier to follow, because the course ties cyber risk to consequence.
• Access to the standards: the courses teach from the standards, but owning the parts you use at work (for example 2-1, 3-2 and 3-3 for asset owners) makes revision faster. ISA sells the ANSI/ISA versions; the IEC publishes the international versions.

The identity side of the standard deserves early attention. Foundational requirement FR 1 in Part 3-3, identification and authentication control, applies to human users, software processes and devices alike, which is where shared engineering accounts, vendor remote access and hard-coded device credentials usually fail an assessment. See the OT and ICS Identity and Access Guide and the Identity for OT Environments Guide.

Preparation plan

Choosing a route

An eight to twelve week plan per certificate

1. Before the course: take the free first module, read Part 1-1 terminology, and sketch your own site or a reference plant as a zone and conduit diagram. This gives every later concept somewhere to land.
2. During the course: keep a glossary of 62443 terms in your own words (security level, foundational requirement, system requirement, requirement enhancement, CRS). Most wrong answers on scenario questions come from confusing these.
3. First two weeks after the course: map the course content to a real or reference system. For IC33, produce a short risk assessment; for IC34, write target security levels for each zone; for IC37, write a patch and monitoring routine for one zone.
4. Book the exam early in the six month window. The invitation arrives within three business days. Booking within four to six weeks keeps the course fresh and leaves time for a retest inside the window if needed.
5. Final week: review the glossary and your diagrams rather than rereading slides, and practise pacing at roughly 80 seconds per question.
6. If you fail: use the domain percentage report to target revision, request a retest through [email protected], and retest inside the eligibility window to avoid the extension fee.

Cost, renewal and continuing education

Each exam is unlocked by completing its course, so budget the course as the main cost and confirm with ISA what the course price includes. Prices for IC33, IC34, IC37 and IC48 were not shown on the pages read for this guide, and ISA advertises time-limited discounts on select cyber training, so check each course page. Application fees are non-refundable and ISA does not accept purchase orders, which matters for corporate buyers. If you cannot pass by the end of the second extension, you must retake the course.

Renewal: ISA's certificate FAQ states that you do not need to renew your certificate and that your certificates will not expire, and the programme page repeats that renewal is not required. The FAQ also notes that some expiry dates shown in the credential portal and on digital badges are inconsistent and that ISA is fixing this; if your badge shows an expiry date, keep the FAQ statement on file. Older blog posts that describe a three-year renewal cycle should be treated as out of date.

Continuing education: with no formal renewal, currency is your responsibility. The series keeps moving: ISA lists ANSI/ISA-62443-2-1-2024 for asset owner programmes and ISA-TR62443-2-2-2025 on the IACS security protection scheme. Record the editions you trained on, read new parts as they are published, and if you hold an ISC2, ISACA or GIAC credential, log 62443 study and project work as continuing education there.

Where it fits on the career path

The certificates are most valuable where employers, clients or regulators already work in 62443 terms: asset owners writing it into supplier contracts, integrators bidding for projects that require it, and product suppliers working towards ISASecure. They are less useful on their own for general security roles.

Hiring managers should read the four certificates as evidence of structured knowledge of the standard, gained through a course and a closed-book exam, not as proof of hands-on competence on a live plant. Pair the credential with interview questions on a zone and conduit design or a risk assessment the candidate has actually done. For the full role picture, see the OT Security Engineer Career Guide and the Cybersecurity Certifications Guide.

Practitioner checklist

• Confirm that 62443 is used in your contracts, tenders or site policy before investing beyond Certificate 1.
• Take the free first module of the self-paced course to check level and style before buying.
• Choose between separate courses and the IC48 Fast Track after passing IC32, based on how much study time you can protect.
• Book each exam within weeks of the course, not months, and keep a retest inside the six month window.
• Build a personal glossary and a zone and conduit diagram of a real or reference system as your main revision aids.
• Check current course prices, member rates and any discount codes on isa.org on the day you buy.
• Keep ISA's no-renewal statement and your BadgeCert records together, in case a portal shows a misleading expiry date.
• Record which editions of each part you trained on and plan reading for newer parts such as 2-1 (2024).
• Apply FR 1 and FR 2 thinking to every human, service and device account in your zones, not just to operator logins.

Standards and references

• ISA: ISA/IEC 62443 Cybersecurity Certificate Program
• ISA: Certificate Programs FAQs
• ISA: ISA/IEC 62443 Series of Standards
• ISA: IC32 Using the ISA/IEC 62443 Standards to Secure Your Control Systems
• ISA: IC33 Assessing the Cybersecurity of New or Existing IACS Systems
• ISA: IC34 IACS Cybersecurity Design and Implementation
• ISA: IC37 IACS Cybersecurity Operations and Maintenance
• ISA: IC48 ISA/IEC 62443 Cybersecurity Fast Track

Related NHI Mgmt Group resources: IEC 62443 Guide · GICSP Certification Guide · OT Security Engineer Career Guide · Cybersecurity Certifications Guide · OT and ICS Identity and Access Guide