ICS310: ICS Cybersecurity Foundations

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

• CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
• Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
• 64-bit processor with 64-bit operating system
• At least eight (8) GB of RAM
• At least seventy (70) GB of free hard drive space
• At least one USB port

Mandatory Host Configuration And Software Requirements

• Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
• Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
• VT or other 64-bit virtualization settings enabled in your BIOS to run 64-bit VMs
• Access to an account with administrative permissions and the ability to disable all security software on their laptop such as Antivirus and/or firewalls if needed for the class
• Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are responsible for configuring it to work with the course materials and/or VMs.
• Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
• On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
• Download and install 7-Zip (for Windows Hosts). This tool is also included in your downloaded course materials.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact customer service.

ICS310 training is recommended for a diverse range of individuals, including:

• New to ICS students
• Future ICS curriculum students
• OT security professionals from regulated industries and critical infrastructure
• OT security professionals from non-regulated industries
• Vendor / Integrator professionals

Critical Infrastructure / Key Resource industries – electric, water, nuclear, telecom, oil, natural gas, manufacturing, chemical, rail, transportation, etc… specifically, the Operational Technology environments within these organizations. In addition, the DoD interests in operational environments that utilize or support cyber to physical assets.

• Printed and electronic courseware
• Electronic Download Package containing ICS cybersecurity related posters, whitepapers, use cases, and cheat sheets
• A virtual machine of the RELICS Platform, an open-sourced, Linux-based distribution designed for performing Research, Education, Labs for ICS.
• Exercise workbook with detailed step-by-step instructions

There are no prerequisites. This course will help provide foundational knowledge for other SANS ICS Security curriculum courseware.

Note: When you purchase any SANS ICS Security course, you will receive complimentary access to ICS310: ICS Cybersecurity Foundations at no additional cost. While not a prerequisite for other ICS courses, ICS310 is a great way to reinforce key concepts or fill gaps in your ICS/OT security knowledge, whether you complete it in full or focus on what is most relevant to you. With your purchase, you will receive a non-transferable access code via your SANS account email within 14 business days.

The ICS310 course is a part of the “Industrial Control Systems Security” Learning Path, which gives cybersecurity professionals the skills needed to safeguard critical infrastructure for the sake of operations, national security, and the safety of human life.

Depending on your current or desired future role, one of these courses is a great next step in your cybersecurity journey:

• ICS410: ICS/SCADA Security Essentials
• ICS418: ICS Security Essentials for Leaders

Industrial Control Systems (ICS) are the backbone of non-critical sector organizations as well as critical infrastructure, managing the physical processes behind essential services like electricity, water, transportation, and manufacturing. Systems like SCADA (Supervisory Control and Data Acquisition), DCS (Distributed Control Systems), and PLCs (Programmable Logic Controllers) are used to automate and control these environments.

ICS Security focuses on protecting these systems from cyber threats, physical attacks, and exploitation. Defenders rely on strategies like network segmentation, strict access controls, continuous monitoring, vulnerability management, and incident response to keep operations safe and reliable.

As cybercriminals and state-sponsored actors increasingly target ICS environments, robust security has become vital. A successful attack on ICS does not just disrupt business—it can endanger public safety by affecting utilities, transportation, or supply chains. Strong ICS security helps protect infrastructure, minimize downtime, and safeguard the communities that rely on these critical services.

ICS310: ICS Cybersecurity Foundations can open valuable career opportunities for professionals working in or entering the industrial control systems (ICS) and operational technology (OT) space. As cyber threats increasingly target critical infrastructure, organizations need skilled defenders who understand both the technical and operational sides of ICS environments. This course equips you with essential knowledge, practical skills, and a security-first mindset that will help you stand out in the field.

Benefits of this course include:

• Build a strong foundation in ICS/OT security concepts and terminology
• Learn how real-world cyber threats impact industrial environments
• Gain practical strategies to protect critical infrastructure
• Prepare for more advanced ICS cybersecurity training and certifications
• Enhance your value to employers in industries like energy, water, transportation, and manufacturing
• Support career growth in cybersecurity roles focused on protecting physical operations and national security