IC33

What is IC33?

IC33 covers identifying and documenting IACS assets, performing cybersecurity vulnerability and risk assessments, developing zone and conduit models, identifying security level targets, and producing a Cybersecurity Requirements Specification (CRS).

Successful completion of IC33 plus the associated exam awards the ISA/IEC 62443 Cybersecurity Risk Assessment Specialist certificate. IC33 sits between IC32 (fundamentals, prerequisite) and IC34 (design and implementation) in the four-course certificate programme. Per ISA/IEC 62443-2-1, risk assessments must be performed on both new (greenfield) and existing (brownfield) applications, and IC33 covers both scopes.

ISA/IEC 62443 Cybersecurity Certificate Programme

Completion of all four courses (IC32, IC33, IC34, IC37) automatically awards the ISA/IEC 62443 Cybersecurity Expert designation.

How Industrial Cybersecurity Training Providers Deliver IC33

IC33 is one of the highest-volume courses in the industrial cybersecurity training market because risk assessment is the entry point for most ISA/IEC 62443 implementation projects.

Training providers deliver IC33 as both open-enrolment public cohorts and private corporate cohorts for asset owners and system integrators starting major OT cybersecurity programmes. The course requires cohort scheduling that respects ISA's six-month exam eligibility window, identity verification at exam, integration with proctored online testing, verifiable certificates, audit-ready completion records, and the ability to deliver lab exercises (some formats use cyber range environments such as the Virginia Tech facility used by ISA's IC33M format). Multi-tenant capability matters because providers commonly run private cohorts for several client organisations in parallel.