2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

How to Pass the EC-Council ICS/SCADA Cybersecurity Exam in 2026: Format, Cost, Domains and Study Plan

The 75 question ICS/SCADA Cybersecurity exam explained: the eight weighted domains, eligibility, the US$699 voucher and a six week plan.

Guides › Exam guides

Updated 1 Nov 2026 · 5 min read

On this page
  1. What the EC-Council ICS/SCADA Cybersecurity exam is and who it is for
  2. ICS/SCADA Cybersecurity at a glance
  3. What is on the exam
  4. Why people fail it
  5. A study plan that fits the exam
  6. On exam day
  7. Frequently asked questions
  8. Sources

What the EC-Council ICS/SCADA Cybersecurity exam is and who it is for

ICS/SCADA Cybersecurity is EC-Council's certification for defending industrial control systems and the supervisory control and data acquisition systems that run plants, pipelines and utilities. EC-Council describes the course behind it as hands on training in "thinking like a hacker" to defend against attacks on the oil and gas IT corporate and control network. The angle is an IT security person learning why an industrial network is different.

EC-Council aims it at IT professionals responsible for security policy, SCADA personnel and analysts, administrators and engineers who patch and secure ICS, and consultants who assess it. The recommended background is Linux command line basics, some scripting, solid networking, core security concepts and ideally some time with Wireshark, TShark or tcpdump.

Check eligibility before you book. If you have not taken official EC-Council training or bought the official courseware, you need one year of information security work experience and a non refundable US$100 eligibility application, approved before you can buy a voucher.

ICS/SCADA Cybersecurity at a glance

Item Detail
Questions 75, multiple choice
Time allowed 2 hours
Passing score 70%
Exam fee US$699 for the remotely proctored exam voucher on the EC-Council store
Where you sit it ECC Exam Center, with remote proctoring by EC-Council's RPS team
Certification valid for 3 years, renewed with 120 continuing education credits and an annual US$80 fee

EC-Council does not publish a separate exam code for this certification. Its store sells the voucher as "ICS/SCADA Cybersecurity v1", and the exam pages do not list the languages it is offered in.

What is on the exam

EC-Council's exam blueprint splits the exam into eight domains with published weights. Three carry 16% each and two only 6%, so plan by weight.

Introduction to ICS/SCADA network defence (16%). The foundations: how the IT security model differs from the ICS/SCADA model, risk and security policy, the attack surface, protocols including Modbus and BACnet, asset identification, threat modelling and the IT versus ICS comparison.

TCP/IP 101 (14%). Encapsulation, IPv4, TCP and UDP headers, network protocols and the ICS/SCADA protocols that ride on top of them.

Introduction to hacking (16%). Attacker motives and mindset, types of testing, and the hacking methodology from footprinting and scanning through enumeration, vulnerability research and exploitation. It also covers common ICS architectures, modems and wardialing, and penetration testing applied to ICS/SCADA.

Vulnerability management (13%). Scanners, assessment, the malware ecosystem, Conpot for asset identification, Metasploit against Modbus and BACnet, and rating severity with CVSS.

Standards and regulation for cybersecurity (6%). ISO 27001, CFATS, IEC 62443, NIST SP 800-82, defence in depth and industry good practice for ICS. The course outline also lists NERC CIP and ISA99.

Securing the ICS/SCADA network (16%). Physical security, securing the ICS protocols, IPsec modes and rules, firewall scripting, isolating a server, and ICS vulnerability assessment and risk management.

Bridging the air gap (6%). Connecting ICS/SCADA to other networks and monitoring it: next generation firewalls, zone monitoring, log aggregation and retention, SIEM, alerts, and incident investigation and response.

Introduction to IDS and IPS (13%). What intrusion detection can and cannot do, IDS features and topology, types of IPS, intrusion and log analysis, signs of compromise, APTs, the MITRE ATT&CK matrix, event correlation and ICS malware.

Why people fail it

The most common mistake is answering like an IT administrator. The syllabus is built on how an industrial network differs from an office one, and the reflex IT answer (scan everything, patch now, reboot) is often the one that would stop a process. Before picking the most thorough option, ask what it would do to a controller that cannot be taken offline.

The second is protocol vagueness. Modbus and BACnet appear by name in the defence fundamentals and in the Metasploit topics under vulnerability management, and ICS protocols run through TCP/IP 101. Knowing they exist is not enough: you need to know how they behave on the wire and why they are easy to abuse.

The third is misreading the weights. Standards such as IEC 62443 and NIST SP 800-82 feel like the core of OT security, but the standards domain is 6% of the blueprint. Weeks spent memorising frameworks while skimming the hacking methodology and network hardening, 16% each, cost far more marks than they save.

Finally, incidents are part of the syllabus. ICS malware sits in the IDS domain, and EC-Council's own page cites Triton/TRISIS and Stuxnet. Know what each targeted and what it changed.

A study plan that fits the exam

This six week plan follows the blueprint weights and assumes you already have the networking and security basics EC-Council recommends.

  1. Week 1: network defence foundations (16%). The IT and ICS security models side by side, risk, policy, attack surface and asset identification.
  2. Week 2: TCP/IP 101 (14%). Headers, encapsulation and the ICS protocols. Capture some traffic in Wireshark and read Modbus frames until the fields are familiar. Try the free ICS/SCADA practice questions at the end of the week to see where you stand.
  3. Week 3: introduction to hacking (16%). The methodology stage by stage, then how each stage changes against ICS: wardialing, common architectures and why active scanning is risky on a live plant.
  4. Week 4: vulnerability management (13%) and standards (6%). CVSS scoring, scanners, Conpot and Metasploit against Modbus and BACnet. Spend the last two days on what IEC 62443, NIST SP 800-82, ISO 27001 and CFATS each cover.
  5. Week 5: securing the network (16%) and bridging the air gap (6%). IPsec modes, firewall rules, server isolation, zones, SIEM and log retention.
  6. Week 6: IDS and IPS (13%), then review. Detection types, topology, log analysis, MITRE ATT&CK and ICS malware. Then sit timed runs of the 75 question ICS/SCADA practice pack and go back to any domain where you score under 70%.

On exam day

EC-Council delivers the exam through the ECC Exam Center, and its store voucher is for online delivery remotely proctored by its RPS team. You have 2 hours for 75 multiple choice questions, about 96 seconds each, which is enough to read every question properly. Watch for questions where two options are technically sound and only one is safe for a running plant. Flag them, finish the paper, then come back.

Frequently asked questions

Can I retake the ICS/SCADA Cybersecurity exam if I fail?

Yes. Under EC-Council's retake policy you can buy a discounted retake voucher, and there is no waiting period before your second attempt. After that you wait 14 days before each further attempt, with a limit of five attempts in 12 months. EC-Council strongly advises official training for anyone who fails a third time.

Do I need official training to sit the exam?

No. You can take official training, buy the official courseware, or apply directly. The direct route needs one year of information security experience and a non refundable US$100 application fee. Once approved, you have three months to buy a voucher, and the voucher is valid for a year from release.

Is the practice pack enough on its own?

No. The pack is 75 practice questions with explanations: it shows you how questions are framed and exposes your weak domains. It does not replace learning the protocols, the methodology and the standards from the official course or other study material. Use it to test yourself, not to learn the subject from scratch.

How do I keep the certification once I pass?

EC-Council certifications are valid for three years. You renew by earning 120 EC-Council Continuing Education credits in that window and paying the annual continuing education fee, which EC-Council lists as US$80 for ICS/SCADA Cyber Security.

When you are ready to test yourself under exam conditions, get the EC-Council ICS/SCADA Cybersecurity practice questions.

Sources

The official pages the facts in this guide were checked against.