GIAC Response and Industrial Defense Certification (GRID)

ICS/OT Security Certification Overview

Prove you can detect, hunt, and respond to threats in industrial control systems, using active defense, network monitoring, and digital forensics.

Explore ICS515 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GRID Certification?

The GRID certification validates a practitioner's command of Active Defense strategies for protecting Industrial Control System (ICS) networks and systems. GRID holders understand how ICS-specific attacks inform mitigation strategies and are ready to implement network security monitoring, digital forensics and incident response (DFIR), and Active Defense approaches.

By the numbers

2 hrs

Exam duration

Questions

74%

Min. passing score

What GRID Covers

The objectives group into five practical domains matching the course's five skill-building sections.

Threat Intelligence

Covers Threat Intelligence in an ICS Environment: extracting indicators of compromise and TTPs from reporting to guide security teams.

Visibility and Asset Awareness

Covers Visibility and Asset Awareness in an ICS Environment: building asset inventories and network topologies to know what's actually on the network.

Detection, Monitoring, and Threat Hunting

Covers Detection in an ICS Environment, Monitoring in an ICS Environment, and Threat Hunting and Analysis in an ICS Environment: using network security monitoring to catch ICS-specific attacks.

Incident Response

Covers Incident Response in an ICS Environment: acquiring forensic-quality evidence and scoping threats without disrupting safe operations.

Active Defense

Covers Active Defense in an ICS Environment: applying lessons from ICS-specific attacks, including malware analysis and environment manipulation, to mitigation strategies.

Prepare With This Course

ICS515: ICS Visibility, Detection, and Response

Course Details

How ICS515 Prepares You for GRID

ICS515 is built around the exam objectives that make up the GIAC Response and Industrial Defense (GRID) certification:

Section 1, ICS Cyber Threat Intelligence builds skills tested under Threat Intelligence in an ICS Environment.
Section 2, Visibility and Asset Identification builds skills tested under Visibility and Asset Awareness in an ICS Environment.
Section 3, ICS Threat Detection builds skills tested under Detection in an ICS Environment, Monitoring in an ICS Environment, and Threat Hunting and Analysis in an ICS Environment.
Section 4, Incident Response builds skills tested under Incident Response in an ICS Environment.
Section 5, Threat and Environment Manipulation builds skills tested under Active Defense in an ICS Environment.
Section 6, Capstone Day, Under Attack! applies all seven GRID domains in one full day technical challenge against compromised ICS ranges and equipment.

Across all six sections, 22 hands-on labs and the full-day Capstone Day, Under Attack! challenge give you the chance to apply each skill against real ICS ranges and equipment before you sit the exam.

Read the full GRID certification overview here.

ICS515 Author

Robert M. Lee

CEO at Dragos, Inc

SANS Fellow and Dragos CEO Robert M. Lee, author of ICS515 and FOR578 and co-author of ICS310, teaches from landmark industrial cyber investigations, turning real adversary tradecraft into visibility, detection, and response skills in OT.

Who Should Pursue GRID

ICS Incident Response Team Leads and Members

ICS and Operations Technology Security Personnel

IT Security Professionals

Security Operations Center (SOC) Team Leads and Analysts

ICS Red Team and Penetration Testers

Active Defenders

Frequently Asked Questions

The GRID exam is a single proctored exam: 2 hours long, 75 questions, with a 74% minimum passing score.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GRID is built for ICS Incident Response Team Leads and Members, ICS and Operations Technology Security Personnel, IT Security Professionals, Security Operations Center (SOC) Team Leads and Analysts, ICS Red Team and Penetration Testers, and Active Defenders.

ICS515: ICS Visibility, Detection, and Response is the SANS course built to prepare you for GRID. Its six sections map directly to the exam objectives, and 22 hands-on labs plus the full-day Capstone Day, Under Attack! challenge let you apply each skill against real ICS ranges and equipment before you sit the exam.

Ready to earn your GRID certification?

Add the GRID exam attempt when you register for ICS515.

Read the full ICS515 certification overview here.

SEC536: Adversarial AI - Penetration Testing AI Systems