Auditing Operational Technology / SCADA / ICS (Intermediate)

Operational Technology (OT), including Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS), forms the backbone of critical infrastructure and industrial operations across sectors such as energy, utilities, manufacturing, transportation, and oil and gas. As these systems become increasingly interconnected with IT environments and exposed to cyber and operational risks, organizations face heightened challenges in ensuring their reliability, security, and compliance.

To support effective assurance over these environments, BOOST has developed the Auditing Operational Technology / SCADA / ICS (Intermediate) course for audit, risk, and assurance professionals who already possess a foundational understanding of auditing or IT concepts and are required to assess OT environments. This intermediate-level program focuses on bridging the gap between traditional audit approaches and the unique characteristics, risks, and constraints of OT systems.

The course emphasizes how OT differs from IT in terms of architecture, priorities, risk tolerance, and control design. Participants explore how to plan and conduct effective OT audits without disrupting operations, while addressing cybersecurity risks, safety considerations, regulatory expectations, and governance requirements.

Through structured explanations, practical frameworks, and industry-relevant scenarios, participants strengthen their ability to evaluate OT control environments, engage effectively with technical stakeholders, and provide meaningful assurance over critical industrial systems.

• Understand the fundamentals of OT, SCADA, and ICS environments
• Distinguish between IT and OT risk, control, and audit considerations
• Identify key operational, safety, and cybersecurity risks in OT systems
• Apply audit planning approaches tailored to OT environments
• Evaluate governance, controls, and monitoring mechanisms for OT
• Assess cybersecurity and resilience controls in industrial systems
• Communicate audit findings effectively to technical and non-technical stakeholders
• Support risk-based assurance over critical infrastructure and operations