Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

An Overview of the SANS Five ICS Cybersecurity Critical Controls and focus on Control Number 1 - ICS-Specific Incident Response Plan

Download File
An Overview of the SANS Five ICS Cybersecurity Critical Controls and focus on Control Number 1 - ICS-Specific Incident Response Plan (PDF, 5.94MB)Last updated: 06 Sep, 2024
Presented by:
Bruce Large
Bruce Large
  • SANS APAC DFIR Summit and Japan September 2024
SANS APAC DFIR Summit and Japan September 2024

Presenters

Bruce Large
Bruce Large

Bruce Large

Associate Instructor

Bruce has 20 years experience working with IT and OT in network, telecommunications and system engineering roles. Bruce has worked in Electricity Generation and Transmission, Railway, Aviation, Emergency Services and Consulting industries. 

Read more about Bruce Large

Related Resources

Building the Security Organisation for an AI-Driven Future

Summit PresentationCybersecurity Leadership
  • 24 Sep 2026
  • SANS Cyber Leaders Summit London 2026

From Defence to Continuity: Redefining Organisational Fitness in the Age of AI Threats

Summit PresentationCybersecurity Leadership
  • 22 Sep 2026
  • Manfred Boudreaux-Dehmer
  • SANS Cyber Leaders Summit Brussels 2026

How Security Culture Professionals Stay Relevant in the Age of AI

Summit PresentationSecurity Awareness
  • 27 Aug 2026
  • Cheryl Wong, Daisy Wong
  • SANS Security Awareness Summit 2026

You Can’t Spot What Looks Real: Rethinking Security Awareness in the Age of AI, Deepfakes, and Autonomous Attackers

Summit PresentationSecurity Awareness
  • 27 Aug 2026
  • Dr. Jessica Barker
  • SANS Security Awareness Summit 2026

Breaking BOTS II: Trusting Agentic AI in the Cloud SOC

Summit PresentationCloud Security
  • 18 Aug 2026
  • Leo Meyerovich
  • SANS Cloud Security Exchange Summit 2026

AI Security at Warp Speed: Securing Autonomous Systems When Impulse Power Won’t Cut It

Summit PresentationCloud Security
  • 18 Aug 2026
  • Hakeem Oseni
  • SANS Cloud Security Exchange Summit 2026

Related Courses

View All Courses
  • Slide 1 of 17

    SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

    AI-FOCUSED
    Advanced
    SEC595Cyber Defense, Artificial Intelligence
    SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
    • GIAC Machine Learning Engineer (GMLE)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 30 Hands-On Labs

    • GIAC Machine Learning Engineer (GMLE)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 30 Hands-On Labs
    View course detailsRegister
  • Slide 2 of 17

    FOR589: Cybercrime Investigations

    Intermediate
    FOR589Digital Forensics and Incident Response
    FOR589: Cybercrime Intelligence
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs
    View course detailsRegister
  • Slide 3 of 17

    FOR585: Smartphone Forensic Analysis In-Depth

    MAJOR UPDATES
    AI SKILLS
    Essentials
    FOR585Digital Forensics and Incident Response, Artificial Intelligence
    FOR585: Smartphone Forensic Analysis In-Depth
    • GIAC Advanced Smartphone Forensics (GASF)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 22 Hands-On Labs

    • GIAC Advanced Smartphone Forensics (GASF)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 22 Hands-On Labs
    View course detailsRegister
  • Slide 4 of 17

    FOR478: Cyber Threat Intelligence Foundations

    AI SKILLS
    Essentials
    FOR478Digital Forensics and Incident Response, Artificial Intelligence
    FOR498: Digital Acquisition and Rapid Triage
    • 2 Days (Instructor-Led)
    • 12 CPEs / 12 Hours (Self-Paced)
    • Labs: 8 Hands-On Labs

    • 2 Days (Instructor-Led)
    • 12 CPEs / 12 Hours (Self-Paced)
    • Labs: 8 Hands-On Labs
    View course detailsRegister
  • Slide 5 of 17

    FOR608: Enterprise-Class Incident Response & Threat Hunting

    UPDATED
    Intermediate
    FOR608Digital Forensics and Incident Response
    FOR608: Enterprise-Class Incident Response & Threat Hunting
    • GIAC Enterprise Incident Responder (GEIR)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    • GIAC Enterprise Incident Responder (GEIR)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs
    View course detailsRegister
  • Slide 6 of 17

    FOR518: Mac and iOS Forensic Analysis and Incident Response

    UPDATED
    Intermediate
    FOR518Digital Forensics and Incident Response
    FOR518: Mac and iOS Forensic Analysis and Incident Response
    • GIAC iOS and macOS Examiner (GIME)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 23 Hands-On Labs

    • GIAC iOS and macOS Examiner (GIME)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 23 Hands-On Labs
    View course detailsRegister
  • Slide 7 of 17

    FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

    MAJOR UPDATES
    AI SKILLS
    Intermediate
    FOR508Digital Forensics and Incident Response, Artificial Intelligence
    FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
    • GIAC Certified Forensic Analyst (GCFA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 35 Hands-On Labs

    • GIAC Certified Forensic Analyst (GCFA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 35 Hands-On Labs
    View course detailsRegister
  • Slide 8 of 17

    FOR610: Reverse-Engineering Malware: Malware Analysis in the Age of AI

    MAJOR UPDATES
    Advanced
    FOR610Digital Forensics and Incident Response
    FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
    • GIAC Reverse Engineering Malware (GREM)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 42 Hands-On Labs

    • GIAC Reverse Engineering Malware (GREM)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 42 Hands-On Labs
    View course detailsRegister
  • Slide 9 of 17

    FOR578: Cyber Threat Intelligence

    MAJOR UPDATES
    Intermediate
    FOR578Digital Forensics and Incident Response
    FOR578: Cyber Threat Intelligence
    • GIAC Cyber Threat Intelligence (GCTI)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    • GIAC Cyber Threat Intelligence (GCTI)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs
    View course detailsRegister
  • Slide 10 of 17

    FOR509: Enterprise Cloud Forensics and Incident Response

    MAJOR UPDATES
    Intermediate
    FOR509Digital Forensics and Incident Response
    FOR509: Enterprise Cloud Forensics and Incident Response
    • GIAC Cloud Forensics Responder (GCFR)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 23 Hands-On Labs

    • GIAC Cloud Forensics Responder (GCFR)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 23 Hands-On Labs
    View course detailsRegister
  • Slide 11 of 17

    FOR528: Ransomware and Cyber Extortion

    Intermediate
    FOR528Digital Forensics and Incident Response
    FOR528: Ransomware and Cyber Extortion
    • 3 Days (Instructor-Led)
    • 24 CPEs / 24 Hours (Self-Paced)
    • Labs: 12 Hands-On Labs

    • 3 Days (Instructor-Led)
    • 24 CPEs / 24 Hours (Self-Paced)
    • Labs: 12 Hands-On Labs
    View course detailsRegister
  • Slide 12 of 17

    FOR577: LINUX Incident Response and Threat Hunting

    MAJOR UPDATES
    AI SKILLS
    Intermediate
    FOR577Digital Forensics and Incident Response, Artificial Intelligence
    FOR577: LINUX Incident Response and Threat Hunting
    • GIAC Linux Incident Responder (GLIR)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 29 Hands-On Labs

    • GIAC Linux Incident Responder (GLIR)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 29 Hands-On Labs
    View course detailsRegister
  • Slide 13 of 17

    FOR710: Reverse-Engineering Malware: Advanced Code Analysis

    Advanced
    FOR710Digital Forensics and Incident Response
    FOR710: Reverse-Engineering Malware: Advanced Code Analysis
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 12 Hands-On Labs

    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 12 Hands-On Labs
    View course detailsRegister
  • Slide 14 of 17

    FOR498: Digital Acquisition and Rapid Triage

    Essentials
    FOR498Digital Forensics and Incident Response
    FOR498: Digital Acquisition and Rapid Triage
    • GIAC Battlefield Forensics and Acquisition (GBFA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    • GIAC Battlefield Forensics and Acquisition (GBFA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs
    View course detailsRegister
  • Slide 15 of 17

    FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

    NEW
    AI-FOCUSED
    Intermediate
    FOR563Digital Forensics and Incident Response, Artificial Intelligence
    FOR509: Enterprise Cloud Forensics and Incident Response
    • 1 Day (Instructor-Led)
    • 6 CPEs / 6 Hours (Self-Paced)
    • Labs: 4 Hands-On Labs

    • 1 Day (Instructor-Led)
    • 6 CPEs / 6 Hours (Self-Paced)
    • Labs: 4 Hands-On Labs
    View course detailsRegister
  • Slide 16 of 17

    FOR500: Windows Forensic Analysis

    UPDATED
    Essentials
    FOR500Digital Forensics and Incident Response
    FOR500: Windows Forensic Analysis
    • GIAC Certified Forensic Examiner (GCFE)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 22 Hands-On Labs

    • GIAC Certified Forensic Examiner (GCFE)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 22 Hands-On Labs
    View course detailsRegister
  • Slide 17 of 17

    FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

    Advanced
    FOR572Digital Forensics and Incident Response
    FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
    • GIAC Network Forensic Analyst (GNFA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    • GIAC Network Forensic Analyst (GNFA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs
    View course detailsRegister
View All Courses
An Overview of the SANS Five ICS Cybersecurity Critical Controls and focus on Control Number 1 - ICS-Specific Incident Response Plan | SANS Institute