Operational technology (OT) security has long lacked a vendor-neutral, mid-level certification that tests both plant-floor knowledge and security practice, and CompTIA SecOT+ is CompTIA's attempt to fill that gap. SecOT+ (exam SOT-001, version 1) covers OT systems and safety, risk management, threat intelligence, secure architecture, security operations and incident management in manufacturing and critical infrastructure. This guide sets out what CompTIA has published so far: status and launch timing, exam format, the six domains with weightings and sub-objectives, recommended experience and what is not yet published. It adds a preparation plan, decision guidance against GICSP and ISA/IEC 62443 certificates, and where SecOT+ fits on an OT security career path. It is written for OT engineers moving into security, IT security staff moving into OT, and managers planning team development. Status as checked on comptia.org on 27 October 2026: pre-order open, launch scheduled for December 2026. Details of a new exam can change before launch, so check current fees and the exam page before you buy.
Key takeaways
- It is not yet live. CompTIA lists SecOT+ for pre-order. The exam details show 1 December 2026 and the overview says launch is "on or around December 8, 2026".
- The format is standard CompTIA. Up to 95 questions, multiple choice and performance-based, in 90 minutes, with a passing score of 750 on a 100 to 900 scale, per the exam objectives document.
- Security operations is the largest domain. Weightings are 22% operations, 18% architecture, 17% risk, 15% incident management and 14% each for systems and safety and for threat intelligence.
- It expects OT experience. CompTIA recommends 3 or more years hands-on in OT and 2 or more years implementing OT cybersecurity.
- Price and renewal are not yet published. SecOT+ does not yet appear on CompTIA's continuing education fee table; check before relying on any figure.
Who the certification is for
CompTIA describes the audience as experienced professionals who need expertise in OT risk assessment, compliance, threat intelligence, architecture and incident response, and says the certification validates skills for securing and managing OT in manufacturing and critical infrastructure, bridging IT and OT.
- Good fit: control systems and automation engineers who have taken on security responsibilities; IT security analysts and engineers assigned to plants, utilities or building systems; OT security consultants who want a vendor-neutral baseline.
- Good fit for employers: organisations that already use CompTIA certifications for IT staff and want a matching OT step.
- Weaker fit: people new to both OT and security, given the recommended experience; and engineers whose employers or customers specify ISA/IEC 62443 certificates or GICSP by name.
| Option | Body | Choose it when |
|---|---|---|
| SecOT+ | CompTIA | You want a vendor-neutral, mid-level OT security credential that sits alongside other CompTIA certifications, and you accept a new exam with a short track record |
| GICSP | GIAC | You want an established industrial security credential; see the GICSP Certification Guide |
| ISA/IEC 62443 certificates | ISA | Your work is standards-led (asset owner programmes, integrators, product suppliers); see the ISA/IEC 62443 Certification Guide |
For the wider landscape, see the Cybersecurity Certifications Guide.
Exam format and domains
Format
| Item | SecOT+ SOT-001 V1 (CompTIA, checked 27 October 2026) |
|---|---|
| Status | Pre-order; launch listed as 1 December 2026 in exam details and "on or around December 8, 2026" in the overview |
| Questions | Maximum of 95 |
| Question types | Multiple choice and performance-based |
| Length | 90 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Language | English |
| Estimated retirement | About 3 years after launch |
| Price | Not shown on the exam page; check current fees |
Domains, weightings and sub-objectives
| Domain | Weight | Sub-objectives (CompTIA, summarised) |
|---|---|---|
| 1.0 OT Systems and Safety Foundations | 14% | 1.1 safety techniques; 1.2 unique elements of OT; 1.3 control theory; 1.4 OT communication media and protocols; 1.5 legacy and modern infrastructure |
| 2.0 OT Risk Management | 17% | 2.1 governance, risk and compliance; 2.2 programme management; 2.3 risk assessment; 2.4 risk monitoring and disposition; 2.5 change management |
| 3.0 OT Threat Intelligence | 14% | 3.1 threat intelligence foundations; 3.2 historical cyber events affecting OT; 3.3 OT threat landscapes; 3.4 analysing OT threat intelligence |
| 4.0 OT Cybersecurity Architecture, Design, and Engineering | 18% | 4.1 secure architecture principles; 4.2 physical security; 4.3 hardware controls; 4.4 host and application security; 4.5 network controls and design; 4.6 identification, authentication and authorisation |
| 5.0 OT Security Operations | 22% | 5.1 asset management; 5.2 analysing data for security operations; 5.3 vulnerability remediation; 5.4 vulnerability management techniques; 5.5 portable device security |
| 6.0 OT Incident Management | 15% | 6.1 frameworks; 6.2 overarching considerations; 6.3 preparation; 6.4 response and handling; 6.5 analysing collected data; 6.6 containment, eradication and recovery |
Read the weightings against the recommended experience. Domains 2, 3 and 6 (risk, threat intelligence and incident management) together carry 46% and are process-heavy, while domains 1, 4 and 5 test hands-on knowledge of plant systems, controls and day-to-day operations. A candidate strong in only one of those halves will struggle to reach the 750 pass mark, so plan study time across both rather than polishing an existing strength.
Named protocols and frameworks
| Area | Named in the exam objectives | Related NHI Mgmt Group guide |
|---|---|---|
| Serial protocols | Modbus RTU, Profibus, Data Highway Plus, DNP3 | OT Network Security Monitoring Guide |
| Ethernet protocols | EtherCAT, Modbus TCP, CIP/EtherNet/IP, OPC DA, OPC UA, BACnet/KNX, Profinet | OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide |
| Wireless | VHF, AIS, VSAT, M-Bus, 802.15.4, 802.11 | |
| Threat and response frameworks | MITRE ATT&CK for ICS, Diamond Model, intelligence life cycle, ICS Cyber Kill Chain, PICERL, ICS4ICS | MITRE ATT&CK for ICS Guide |
| Risk frameworks | ISA/IEC and NIST frameworks referenced in 2.3 | IEC 62443-3-2 OT Risk Assessment Guide, NIST SP 800-82 OT Security Guide |
| System types (acronyms list) | DCS, SCADA, SIS, MES, PLC, RTU, IED, HMI |
Where identity fits: sub-objective 4.6 is dedicated to identification, authentication and authorisation, and the acronym list includes PAM and NAC. In OT the hard cases are shared operator accounts, vendor remote access, and machine-to-machine credentials in engineering workstations, historians and protocol gateways. See the OT and ICS Identity and Access Guide.
Prerequisites and experience
CompTIA lists no mandatory prerequisite but recommends at least three years of hands-on work in OT environments and two years implementing OT cybersecurity solutions or technologies. In practice that means (our reading of the objectives):
- Plant knowledge: how PLCs, HMIs, historians, safety instrumented systems and DCS components interact, and basic control theory.
- Safety culture: safe work practices on site, which domain 1 tests directly.
- Security practice: asset inventory, vulnerability management, log and SIEM analysis and incident response, applied where patching and scanning can affect production.
- Protocols: recognising the protocols listed above and their security weaknesses.
IT security staff will usually need to build the OT and safety side; OT engineers will usually need to build risk, threat intelligence and incident process.
Preparation plan
- Wait for launch details (now): pre-order if you want, but confirm price, delivery and any changes to the objectives on the exam page at launch.
- Download the objectives (week 1): rate yourself against all 31 sub-objectives, weighted by domain. Operations (22%) and architecture (18%) carry 40% between them.
- Close the half you lack (weeks 2 to 6): IT staff: control theory, safety, protocols, legacy constraints. OT staff: risk assessment methods, threat intelligence frameworks, ATT&CK for ICS, incident handling.
- Lab safely (weeks 3 to 7): use a simulated or training PLC and protocol simulators, never a live production network. Capture Modbus TCP, DNP3 and EtherNet/IP traffic and identify what an unauthorised write would look like.
- Study historical incidents (alongside): sub-objective 3.2 covers historical events affecting OT; see the ICS Malware History Guide.
- Practise performance-based tasks (weeks 7 to 8): expect scenario tasks such as placing controls in an architecture or triaging an OT alert.
- Timed practice and sit (weeks 9 to 10): 95 questions in 90 minutes is under a minute each, with performance-based items taking longer.
Small vs large organisations: smaller manufacturers and utilities often have one person bridging IT and OT, for whom SecOT+ maps neatly to the job. Large asset owners may prefer a mix: SecOT+ for broad baseline across plant and IT teams, and ISA/IEC 62443 certificates for those running the formal programme.
Measuring readiness and value
- Coverage: all 31 sub-objectives rated amber or green, weighted towards domains 5 and 4.
- Practice scores: consistently above the 750 scaled pass mark in timed practice, once official or quality practice material exists.
- Lab output: captures and notes for each protocol listed.
- After passing: OT asset inventory completeness and the share of OT assets with a defined vulnerability handling route in your organisation.
Cost, renewal and continuing education
| Item | Status (CompTIA, checked 27 October 2026) |
|---|---|
| Exam voucher price | Not shown on the exam page during pre-order; check current fees |
| Pre-order terms | Governed by CompTIA's addendum for pre-order products |
| Continuing education | SecOT+ is not yet listed on CompTIA's CE renewal fee table |
| CompTIA CE cycle (general) | Three years; CE fees for other security certifications such as Security+, CySA+ and SecurityX are $150 per three-year cycle |
Do not assume SecOT+ will follow the same CE rules as Security+ until CompTIA confirms it. Recheck after launch.
Common failure patterns
- Treating it as Security+ with OT words: domain 1 tests safety, control theory and protocols that IT staff rarely meet.
- Treating it as an engineering exam: risk management, threat intelligence and incident process together carry 46%.
- Practising on production: scanning or probing live controllers can stop a process; use simulators.
- Studying from pre-launch rumours: rely on CompTIA's objectives document and recheck at launch.
- Ignoring portable devices and vendor access: sub-objective 5.5 covers portable device security, a common route into OT.
Where it fits on the career path
| Stage | Credentials | Notes |
|---|---|---|
| IT security foundation | Security+, Network+ | Useful for OT engineers new to security |
| OT security practitioner | SecOT+, GICSP | Mid-level, vendor-neutral OT security |
| Standards and programme | ISA/IEC 62443 certificates | Programme, integrator and product roles |
| Senior or architect | CISSP, SecurityX | Broader security leadership and architecture |
- See the CompTIA Security+ Guide, the CompTIA Network+ Certification Guide and the CompTIA SecurityX Guide.
- For the work itself: the NIST SP 800-82 OT Security Guide and the IEC 62443-2-1 Asset Owner Security Programme Guide.
As a new exam, SecOT+ has no published pass rate or employer recognition data yet, and we do not quote estimates.
Practitioner checklist
- Check the exam page for launch date, price and any change to the objectives.
- Download the SOT-001 objectives and rate yourself against all 31 sub-objectives.
- Spend the most time on security operations and architecture, which carry 40%.
- Build the half you lack: OT and safety for IT staff, risk and incident process for OT staff.
- Learn each listed protocol and its weaknesses using simulators, not production.
- Review historical OT incidents and ATT&CK for ICS.
- Practise performance-based tasks under time pressure.
- Confirm CE requirements once CompTIA publishes them.
Standards and references
- CompTIA: SecOT+ Certification
- CompTIA: SecOT+ SOT-001 Exam Objectives
- CompTIA: Addendum for Pre-Order Products
- CompTIA: Continuing Education Renewal Fees
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · GICSP Certification Guide · ISA/IEC 62443 Certification Guide · OT and ICS Identity and Access Guide · MITRE ATT&CK for ICS Guide