CompTIA SecOT+ SOT-001 (V1) Exam Objectives
This page translates the CompTIA SecOT+ SOT-001 (V1) exam objectives into clear, practical language for OT security teams. You’ll see what each domain covers, realistic task themes, and a focused study plan that turns the blueprint into repeatable labs, PBQs, and job-ready skills across safety, risk, architecture, operations, and incident management in OT environments.
Last updated: January 7, 2026. Always verify against the official CompTIA blueprint before your exam.
TL;DR: SecOT+ validates your ability to understand the physical impact of OT cyber threats, assess posture as part of risk management, differentiate IT vs. OT design/operations/security, operate with GRC awareness, and identify/analyze/respond to OT incidents using OT-appropriate incident management principles. Domains: 1) OT Systems & Safety Foundations, 2) OT Risk Management, 3) OT Threat Intelligence, 4) OT Cybersecurity Architecture/Design/Engineering, 5) OT Security Operations, 6) OT Incident Management.
Table of Contents
- What Is Covered on CompTIA SecOT+ SOT-001?
- Objective-By-Objective Breakdown (with examples)
- Who Is SecOT+ For?
- Study Plan: How to Master the SOT-001 Objectives
- Free Checklist & Next Steps
- Frequently Asked Questions
What Is Covered on CompTIA SecOT+ SOT-001?
CompTIA SecOT+ confirms you can: understand safety-critical realities of OT; apply risk management and governance in industrial contexts; analyze threat intel relevant to ICS/SCADA and safety instrumented systems; design secure, resilient OT architectures; run day-to-day OT security operations; and execute OT-appropriate incident management (including ICS4ICS and PICERL).
Note
The wording below is learner-friendly. Map your prep directly to the official SOT-001 objectives before test day.
Objective-By-Objective Breakdown (with examples)
1) OT Systems and Safety Foundations
- Safety techniques: lockout/tagout, job safety analysis (JSA), PPE, safety briefings/outbriefs; hazards (electrical, pressure, heights, temperature, fire, chemical, water) and industrial ratings.
- OT components & roles: sensors, actuators, controllers, PLCs, HMIs, VFDs, relays, IEDs, RTUs, engineering/operator workstations, historians, transient devices; ICS types (DCS, SCADA, MES, SIS, localized networks), stand-alone systems, and critical-infrastructure sectors.
- Control theory: ladder logic, FBD, structured text, SFCs; process variables, set points, I/O, watchdogs, timers, tags.
- OT comms & protocols: serial (RS-232/485; Modbus RTU, Profibus, DNP3, DH+), Ethernet (EtherCAT, Modbus TCP, CIP/EtherNet/IP, OPC DA/UA, BACnet/KNX, Profinet), wireless (VHF, AIS, VSAT, M-Bus, 802.15.4, 802.11).
- Infrastructure considerations: legacy OS/hardware/protocols/ports/apps (including embedded, proprietary, RTOS) vs. modern stacks (virtualization, hypervisors, virtual PLCs, containers, SDN, middleware, AI/ML/GenAI, cloud: public/private/hybrid/edge, privatized backbones, autonomous systems).
2) OT Risk Management
- GRC in OT: risk appetite, safety and business continuity/disaster recovery, national-security/regulatory drivers, legal requirements, and business impacts (financial, reputational, quality, operational).
- Program management: risk levels & registry, maturity assessments, benchmarks, roadmaps, RACI, stakeholder mgmt, MSAs/SLAs/MOUs/SOWs, metrics, training/awareness, criticality analysis, documentation (policies, processes, standards, SOPs).
- Risk assessment: NIST and ISA/IEC frameworks, likelihood and impact, scoping (assets, networks), threat-surface identification (vectors, exposure, threat actors), supply-chain and third-party risk, qualitative vs. quantitative, architecture reviews, pen tests, adversarial emulation; treatment/controls, acceptance criteria, maturity indicators, controls calendar; ongoing monitoring, audits, reporting/escalations, and disposition (accept/transfer/avoid/mitigate).
3) OT Threat Intelligence
- Foundations: threat-intelligence types (HUMINT, SIGINT, MASINT, OSINT, IMINT), lifecycle, Diamond Model, ICS-specific ATT&CK and ICS Cyber Kill Chain.
- Historical OT events: Stuxnet, TRISIS, Industroyer, BlackEnergy 2/3, FrostyGoop; broader impacts like Colonial Pipeline, SolarWinds, Maersk, AcidRain, 2024 CrowdStrike, Collins Aerospace/RTX—understand lessons for OT.
- Landscape: actors (insiders, hacktivists, APTs/nation-states, espionage, cybercriminals), vectors (remote access incl. third parties, removable media, social engineering, account compromise, firmware supply-chain, lateral movement and IT-to-OT pivot, rogue/unauthorized devices, misconfigurations, vuln exploitation, on-path, QR attacks, cellular SIM-swaps/rogue base stations).
- Operationalizing intel: OT feeds (OEM/Gov/ISACs, private/volunteer/bug bounty/social), TIPs, file types (YARA, STIX), IOCs (hashes, IPs, domains, usernames, emails, registry changes, abnormal processes/logs/sessions), and TTP analysis for defense.
4) OT Cybersecurity Architecture, Design, and Engineering
- Principles: least privilege/functionality, operational resilience (endurance, redundancy, HA, recoverability), compartmentalization/segmentation, performance and criticality in safety-constrained environments.
- (Use these to justify zone-and-conduit designs, safety networks vs. business networks, allow-listing, deterministic comms, and carefully-scoped remote access.)
5) OT Security Operations
- Asset management: discovery/inventory for control-system assets and supporting infrastructure.
- Data analysis for ops: control-system logs (process/change/function codes), boundary/network (IDS, packets, syslog, firewalls, switches/routers, edge devices), host/security (AAA logs, EDR/EPP, OS/app, identity), plus threat-hunting artifacts.
- Tuning & tooling: IDS/firewall rules, NPM, EPP/EDR policies, SIEM and SOAR integrations/automation.
- Vulnerability remediation in OT: patch/update viability and dependencies, alternate controls when patching isn’t possible, and coordination with operational constraints.
- Access/remote: AAA (RADIUS/TACACS+), SSO/MFA/PAM, secure remote access via jump-boxes/bastions aligned to OT safety and uptime.
6) OT Incident Management
- Frameworks: PICERL (Prepare, Identify, Contain, Eradicate, Recover, Lessons learned) and ICS-specific coordination via ICS4ICS.
- Considerations: cybersecurity response aligned with physical/safety response, command structures, and post-incident improvement.
Who Is SecOT+ For?
SecOT+ targets OT/control engineers and OT cybersecurity engineers. The draft recommends at least three years hands-on in OT plus two years implementing cybersecurity technologies and solutions in OT environments.
Study Plan: How to Master the SOT-001 Objectives
- Safety-first lab setup
Document LOTO steps, JSA, PPE, and safety briefings for a small test cell. Add a checklist for electrical/pressure/temperature hazards before any network or firmware work. Capture evidence (photos, sign-offs). - Protocol & infrastructure mapping
Inventory your lab: list PLCs/HMIs/IEDs/RTUs and map protocols (Modbus RTU/TCP, DNP3, EtherNet/IP, OPC UA). Note legacy OS/proprietary stacks vs. modern virtualized/SDN/cloud components and where segmentation is required. - Risk program quickstart
Create a one-page risk register entry using ISA/IEC or NIST terminology. Add likelihood/impact, treatment, and a control from your “controls calendar.” Include a simple maturity indicator. - Intel → detection
Pick one historical OT case (e.g., TRISIS or Industroyer). Write IOCs/TTPs in STIX or YARA, tune one IDS rule, and add a SIEM correlation. Record before/after alert fidelity and a short playbook entry. - Architecture hardening
Apply least-functionality and compartmentalization: zone safety/critical networks away from IT, enforce allow-lists, and constrain remote access through a jump-box. Note resilience measures (redundancy/HA, recovery). - Ops & IR rehearsal
Run a “process anomaly” tabletop: gather process/change/function-code logs plus AAA/EDR/identity evidence; tune SIEM/SOAR actions; walk PICERL, then align roles with ICS4ICS. Attach lessons learned to your SOPs.
