OT Training and Exercises: Requirements and Guidance
Where to find training requirements, exercise methods and OT context before planning a programme.
Before choosing an OT exercise, define what people need to learn and how you will check it. Requirements explain why training matters; exercise guidance helps turn that requirement into practical work.
Identify the requirements that apply
- NIS2: Articles 20 and 21 address management training, cyber hygiene and training, and assessment of security-measure effectiveness. Applicability depends on scope and national implementation. NIS2 Directive
- EU 2024/2690: Annex section 8.2 addresses role-relevant security training and assessment of its effectiveness for the specified digital infrastructure and ICT service entities. It is not a general requirement for every OT operator. Implementing Regulation
- IEC 62443-2-1: An IACS asset-owner security programme reference covering organisational responsibilities and security programme requirements. IEC publication
- ISO/IEC 27001: Consider applicable awareness and training controls within the organisation’s information security management system. ISO standard
- NERC CIP-004: Personnel and training requirements for applicable North American electric-sector entities and systems. Check the applicable standard and implementation dates. NERC CIP standards
These documents have different scopes. They do not all impose the same obligations or require the same exercise format.
Plan and evaluate the practical work
Use these references to design the programme:
- NIST SP 800-53: AT-2 and AT-3 for awareness and role-based training; IR-2 and IR-3 for incident response training and testing.
- NIST SP 800-50 Rev. 1: building and evaluating a cybersecurity learning programme.
- NIST SP 800-84: preparing, conducting and evaluating tests, training and exercises.
- ENISA Cybersecurity Exercise Methodology: exercise planning, conduct and evaluation, supported by templates.
Keep the industrial process in view
NIST SP 800-82 provides OT context, including operational and safety considerations. NIST CSF 2.0 helps frame outcomes and improvement priorities.
Choose an observable task: identify the affected controller, investigate a change or practise a response. Agree the evidence and review criteria, run the exercise, then use the findings to improve the next one.
Labshock can provide a practical environment for this work. Using a lab alone does not establish compliance.
More on education