Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
CompTIA SecOT+ is CompTIA's first certification built only for operational technology security, and as of October 2026 it has not launched yet. It is on pre-order, with exam scheduling set to open on or around December 8, 2026. This guide covers the SOT-001 exam, the six draft domains and their weights, what CompTIA has and has not published so far, and who the credential is aimed at.
CompTIA SecOT+ is CompTIA's certification for securing operational technology (OT), the control systems that run manufacturing plants and critical infrastructure. It is scheduled to launch in December 2026 under exam code SOT-001.
The exam covers what changes when the system you protect can hurt people or halt a production line. It opens with plant safety (lockout/tagout, job safety analysis, PPE) and then moves through OT risk management, threat intelligence built on attacks like Stuxnet and Industroyer, secure architecture with zones and conduits, day-to-day security operations, and incident response for cyber-physical events. When CompTIA announced the project in May 2025, it cited Lightcast data showing US employers tried to fill more than 180,000 operational technology positions during 2024.
Right now it is not available to sit. CompTIA is taking pre-orders, the beta exam window closed on August 7, 2026, and the question count, exam length and passing score are still marked TBD in the draft objectives. There is no prerequisite certification, but CompTIA recommends three or more years of hands-on OT work plus two years implementing OT security. It is issued by CompTIA under exam code SOT-001.
Plant safety, OT devices, control theory and industrial protocols. 14% of the exam.
Governance, risk assessment and change management in OT. 17% of the exam.
ICS threat frameworks, historical OT attacks and threat feeds. 14% of the exam.
Segmentation, zones and conduits, hardware and host controls. 18% of the exam.
Asset inventory, monitoring and vulnerability management. The heaviest domain at 22%.
Incident response when a process cannot simply be shut off. 15% of the exam.
Four things that set SecOT+ apart from CompTIA's IT-focused security exams ahead of its December 2026 launch.
CompTIA describes SecOT+ as its first certification focused exclusively on OT security. The exam assumes you already work around PLCs, HMIs, SCADA and distributed control systems, and it tests how security decisions change when availability and physical safety outrank confidentiality.
Objective 1.1 asks you to apply lockout/tagout, job safety analysis, PPE and hazard identification on the job. IT security exams do not start there. In a plant, a careless scan or an untested patch can stop a process, so CompTIA puts safety on the exam next to the security controls.
Objective 3.2 names the events you are expected to know: Stuxnet, TRISIS, BlackEnergy, Industroyer and FrostyGoop for direct impact, and Colonial Pipeline, Maersk and the 2024 CrowdStrike outage for indirect impact. Our piece on wiper malware and destructive attacks shows why that history changes incident response.
SecOT+ has not launched, so it is not on the DoD 8140 qualification matrix and will not satisfy a cyber-coded position requirement today. CompTIA's draft objectives also list exam accreditation as TBD. Watch for both after launch. The current matrix is published at the DoD Cyber Exchange.
For now its value is in what it tests. CompTIA set out to give floor technicians and industrial engineers on the OT side, and security engineers and network architects on the IT side, one common skills toolkit, and SecOT+ is that syllabus in exam form.
What CompTIA has published about the certification and the SOT-001 exam as of October 2026, and what it has not published yet.
SecOT+ is not the only option for OT security staff. ISA, the organization behind the ISA/IEC 62443 standards, runs its own certificate program, and CompTIA's IT security exams cover ground SecOT+ only touches. Three next moves make sense, depending on whether you want more depth on the standard, the SOC or architecture.
ISA offers four certificates, each earned by completing an ISA course and passing its exam. Fundamentals Specialist comes first, then Risk Assessment, Design and Maintenance Specialist in any order. Hold all four and ISA recognizes you as an ISA/IEC 62443 Cybersecurity Expert. ISA does not require renewal.
SecOT+ spends 37 percent of the exam on OT security operations and incident management. CySA+ (CS0-004) goes further on the IT side of that work, with detection, vulnerability management and incident response, and it is approved for 10 DoD 8140 work roles.
For people who end up designing security across both IT and OT, SecurityX (CAS-005) is CompTIA's expert-level security exam. CompTIA recommends 10 years of IT experience with 5 in security, and it is approved for 17 DoD 8140 work roles.
CompTIA does not set a certification path for SecOT+. The path it implies is experience first: years on a plant floor or in a control room, then the OT security exam, then more depth on the standard or on the IT side.
OT time and security basics
The OT security credential
The standard or the IT side
Two questions to answer before you commit: can you sit it, and should you pursue SecOT+ specifically. Here's a straight answer to both.
But nobody can sit it before December 2026.
CompTIA lists recommended experience for SecOT+, not a required certification. Timing is the real limit. The exam has not launched, so today you can only pre-order a voucher, and CompTIA says scheduling opens on or around December 8, 2026.
The draft objectives assume real plant time.
CompTIA's target audience is control engineers and OT cybersecurity engineers with at least three years of hands-on OT work and two years implementing security in OT. If you have never worked with a PLC, a historian or an industrial protocol like Modbus or DNP3, expect the first domain alone to be a steep climb.
SecOT+ maps to the people who keep plants and critical infrastructure running and now have to secure them. These six roles come from the audiences CompTIA names in its SecOT+ announcement, beta call and draft objectives.
Designs and runs the security controls on a plant or utility network: segmentation, OT-aware monitoring, secure remote access for vendors. CompTIA names this role first in its call for SecOT+ beta candidates, and almost every domain on the exam lands on this desk.
Builds and maintains the PLCs, HMIs, RTUs and SCADA platforms that run the process. Domain 1 covers this ground from control logic to industrial protocols, and the rest of the exam adds the security work that increasingly falls to the same engineer.
Works on the production floor where OT and IT now meet. CompTIA's May 2025 announcement named industrial engineers and floor technicians as people SecOT+ should give a common security toolkit, alongside their IT counterparts.
Watches OT networks for threats, works ICS advisories and threat feeds, and triages alerts without disrupting production. Threat intelligence and security operations together make up 36 percent of SOT-001 and map directly to this job.
Designs zones and conduits, the industrial DMZ, data diodes and the remote access paths vendors use. The architecture, design and engineering domain carries 18 percent of the exam and is the core of this role.
Owns the OT security program at a plant or critical infrastructure site: the risk register, maturity assessments, incident response plans and the working relationship with operations. The risk and incident management domains cover the program side of the job.
Three credentials that come up in the same OT security conversation. Short version: Security+ covers IT security basics, the ISA/IEC 62443 certificates teach one standard in depth, and SecOT+ covers the OT security job from plant safety to incident response.
| CompTIA SecOT+ | CompTIA Security+ | ISA/IEC 62443 Fundamentals Specialist | |
|---|---|---|---|
| Issuer | CompTIA | CompTIA | ISA |
| Focus | OT security, from plant safety to incident response | Broad, vendor-neutral core security | The ISA/IEC 62443 standards for control systems |
| Status (Oct 2026) | Pre-order, launches December 2026 | SY0-701 now, SY0-801 from Nov 17, 2026 | Available now |
| How You Earn It | One exam, multiple choice and PBQ (length TBD) | One exam, up to 90 questions in 90 minutes | ISA course (IC32) plus its exam |
| Prerequisites | None (3+ yrs OT recommended) | None (Network+ and 2 yrs IT recommended) | None for Certificate 1 |
| Exam Cost | $439 pre-order voucher | ~$439 voucher | Set by ISA (course required) |
| Renewal | Not yet published | 50 CEUs over 3 years | No renewal required |
| Next Level | CySA+, SecurityX or ISA/IEC 62443 | CySA+, PenTest+ or SecurityX | Certificates 2 to 4, then Expert |
| Best For | Plant, utility and ICS staff securing OT | Career entry and DoD baseline recognition | Teams that design or assess systems to ISA/IEC 62443 |
SecOT+ and the ISA/IEC 62443 certificates overlap more than they compete. The ISA program goes deep on one standard and runs through ISA's own courses, while SecOT+ tests the wider OT security job in a single exam. Security+ is approved for multiple DoD 8140 work roles, which SecOT+ is not today.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our CompTIA SecOT+ boot camp is four days of live, instructor-led training, in person or live online, on official CompTIA courseware. It covers all six SOT-001 domains with hands-on OT lab scenarios and exam prep labs, and includes your exam voucher, practice questions, live review sessions and 180 days of one-on-one support after class. If you need a second attempt, the retake exam and a full course retake are included. Reserve a seat now and we will confirm your date as soon as CompTIA opens exam scheduling.
SecOT+ is new, so there are no SecOT+ study guides on our site yet. These articles cover the skills and decisions the exam builds on.
With only a draft objectives document published for SOT-001, this is the study resource that matters most right now. How to read the verbs, use domain weights to plan study time, and check that you have the current version.
Why CySA+ is the usual next step for security operations roles, when SecurityX makes more sense, and how to choose by the job you want in eighteen months.
The Stryker wiper attack showed what happens when the goal is destruction instead of ransom, why critical infrastructure stays high on attackers' target lists, and how defenders prepare for data that cannot be bought back.
Analyzing logs and SIEM data is part of the SecOT+ security operations domain. A practical guide to SIEM basics, the main types of log data, spotting attack patterns and cutting down false positives.
The two tests a certification has to pass to reach the DoD 8140 matrix, ANAB accreditation and a 70 percent work role match, and what it means when a certification is missing from the list.
The SOT-001 draft objectives split the exam into six domains. OT Security Operations is the largest at 22 percent, but no domain falls below 14 percent, so even coverage pays off more than one heavy focus. Click any domain for what it covers.
The ground the rest of the exam stands on: safety techniques such as lockout/tagout, job safety analysis and PPE, IT and OT convergence, device roles (PLCs, HMIs, RTUs, safety instrumented systems, SCADA, DCS, historians), control theory from ladder logic to set points and tags, OT protocols including Modbus, DNP3, Profinet, EtherNet/IP and OPC UA, and legacy versus modern infrastructure such as virtual PLCs and edge devices.
Governance, risk and compliance in a plant setting: balancing security against operations, business continuity and regulatory drivers, cybersecurity program management (risk registers, maturity assessments, RACI, SLAs), risk assessment with NIST and ISA/IEC frameworks, risk treatment, auditing and disposition, and the change management process from identification to approval.
Intelligence types and frameworks, including the Diamond Model, MITRE ATT&CK for industrial control systems and the ICS Cyber Kill Chain, the lessons of incidents such as Stuxnet, TRISIS, Industroyer, FrostyGoop and Colonial Pipeline, OT threat actors and vectors, and putting threat feeds, ISACs, STIX, YARA and indicators of compromise to work.
Secure OT architecture principles such as least functionality, determinism and defense in depth, physical security, hardware controls (port blockers, PLC operating modes, Secure Boot, TPM), host hardening, network controls including segmentation, data diodes, OT-aware IDS and IPS, zones and conduits and the industrial DMZ, plus identity controls from PKI to privileged access and secure remote access.
The largest domain. Asset discovery and inventory (passive, active and manual), analyzing control system, network and host data with SIEM and SOAR, vulnerability management using SBOMs, vendor data and the National Vulnerability Database, remediation planned around downtime windows and rollback plans, and security for removable media, laptops and other portable devices.
Responding when an incident has physical consequences: the PICERL model and the Incident Command System for Industrial Control Systems (ICS4ICS), coordinating cyber and physical response including emergency shutdown, preparing with playbooks and tabletop exercises, triage and chain of custody, analyzing historian, network and host data, and containment, eradication, recovery and mandatory reporting.
Domains and weights come from CompTIA's draft SOT-001 exam objectives (document version 1.3). CompTIA labels the document a draft, so confirm the final objectives on CompTIA's site when the exam launches.
The questions candidates ask most often when researching the CompTIA SecOT+ certification.
CompTIA SecOT+ is CompTIA's certification for securing operational technology (OT), the industrial control systems that run manufacturing plants, utilities and other critical infrastructure. It is CompTIA's first certification focused only on OT security. The exam, SOT-001, covers six domains, from OT safety and risk management to security operations and incident response.
Not yet. As of October 2026, SecOT+ is on pre-order only. CompTIA lists a launch date of December 1, 2026, and says candidates can begin scheduling exams on or around December 8, 2026. A beta exam (SO1-001) ran earlier in 2026 and closed on August 7, and CompTIA will release beta results at launch. CompTIA's pre-order terms say launch dates are estimates and can change.
CompTIA's draft objectives say the SOT-001 exam uses multiple-choice and performance-based questions. The number of questions, the time limit and the passing score are all listed as TBD, and CompTIA has not published them yet. Many objectives begin with "Given a scenario," so expect questions that put you inside an OT situation rather than testing recall alone.
The draft SOT-001 objectives list six domains: OT Systems and Safety Foundations (14 percent), OT Risk Management (17 percent), OT Threat Intelligence (14 percent), OT Cybersecurity Architecture, Design, and Engineering (18 percent), OT Security Operations (22 percent), and OT Incident Management (15 percent). Security Operations is the largest, but the weights sit close together, so no domain is safe to skip.
There is no required prerequisite certification. CompTIA recommends at least three years of hands-on work in OT environments and two years implementing OT cybersecurity solutions. Its draft objectives describe the target audience as control engineers and OT cybersecurity engineers, so this is not an entry-level exam.
As of October 2026, CompTIA's US store lists the SecOT+ pre-order exam voucher at $439 USD, or $579 for a voucher with a retake included. Bundles that add CompTIA's CertMaster study products run up to $1,058. Training Camp's SecOT+ boot camp includes the exam voucher and a free retake in the course price.
No. SecOT+ has not launched, so it does not appear on the DoD 8140 qualification matrix, and CompTIA's draft objectives list exam accreditation as TBD. If you need a certification for a DoD cyber-coded position today, Security+, CySA+ and SecurityX are already approved for DoD 8140 work roles. See the current DoD 8140 work role paths.
Security+ is a broad IT security exam and the usual starting point. SecOT+ covers what changes in industrial environments, where availability and safety come first, many devices are legacy or unsupported, and patching has to fit planned downtime. If your work touches a plant network, SCADA or control logic, SecOT+ is the closer fit. If you are new to security, start with Security+.
They measure different things. ISA's ISA/IEC 62443 program has four certificates, each earned by completing an ISA course and passing its exam, and holding all four makes you an ISA/IEC 62443 Cybersecurity Expert. It goes deep on one standard. SecOT+ is a single CompTIA exam that covers the wider OT security job, from plant safety to incident response. If your employer or clients ask for ISA/IEC 62443 by name, the ISA certificates are the direct match.
SecOT+ is aimed at roles such as OT Security Engineer, ICS/SCADA Engineer, Industrial Engineer, OT Security Analyst, OT Security Architect, and plant security lead. CompTIA names these audiences in its SecOT+ announcement, beta call and draft objectives. In its May 2025 announcement, CompTIA cited Lightcast data showing US employers tried to fill more than 180,000 OT positions during 2024.
CompTIA has not published validity or renewal rules for SecOT+ yet, and it does not appear in CompTIA's continuing education CEU table. For CompTIA certifications in the Continuing Education program, the renewal cycle is three years from the date you certify, so check CompTIA's CE pages once SecOT+ launches. Separately, CompTIA estimates the V1 exam will retire about three years after launch.
For people who already secure or run OT systems, it is the first CompTIA exam that tests that work directly, and it gives IT and OT staff one shared syllabus. The trade-offs are real. The exam is not available until December 2026, its full specs are unpublished, it is not on the DoD 8140 matrix, and study resources are still thin. If you need a credential now, Security+ and the ISA/IEC 62443 certificates are available today.
Whether you're weighing SecOT+ against Security+ or the ISA/IEC 62443 certificates, or planning OT security training for a plant team, tell us where you are and we'll help you map out the right path.