Cisco announced a new entry-level certification for industrial cybersecurity on October 20, 2026: Cisco OT Security Practitioner. Candidates will earn it by passing exam 810-115 OTSEC, scheduled to launch on February 3, 2027. Official Cisco U. training is due on November 5, 2026, followed by a Cisco Networking Academy pathway in January 2027.
This matters to OT technicians, network engineers, SOC analysts, and IT professionals who must protect industrial systems without mechanically applying office-IT practices. Cisco positions the credential as a practical validation with no mandatory prerequisite. The exam will be available in English, and the resulting certification will remain valid for three years.
Confirmed dates and exam details
The official Cisco OT Security Practitioner page (opens in a new tab) and Cisco’s October 20 announcement (opens in a new tab) separate the launch into four stages:
| Milestone | Announced date | What it means |
|---|---|---|
| Exam topics published | October 20, 2026 | The 810-115 OTSEC scope can guide preparation now. |
| Cisco U. learning path | November 5, 2026 | First announced official training option. |
| Networking Academy path | January 2027 | Academic courses become available progressively. |
| Exam launch | February 3, 2027 | First announced testing date for 810-115 OTSEC. |
The exam lasts 60 minutes and costs US$150, or the accepted equivalent in Cisco Learning Credits. Cisco currently lists English as the only language and requires no prerequisite. Results are reported as pass or fail and should be available online within 48 hours. The certification is valid for three years and can be renewed with Continuing Education credits or by retaking an eligible exam.
These details describe a future general launch. Cisco does not label 810-115 as a beta exam. Publishing the blueprint early therefore does not mean candidates can book or sit the exam before February.
Why OT needs its own credential
Operational technology security is not conventional IT security transplanted into a factory. An interruption that is manageable on a business laptop can be dangerous on a production line, power network, or water system. Availability and human or process safety can take priority over applying a fix quickly.
Programmable logic controllers, sensors, SCADA systems, and industrial network devices may also operate for years under tightly controlled maintenance cycles. An active scan, configuration change, or unplanned restart can disrupt the physical process. Cisco consequently expects candidates to understand OT and industrial control system architectures together with their operating constraints.
The Practitioner level addresses a gap between three audiences: industrial technicians who need cybersecurity skills, IT professionals moving into plants or critical infrastructure, and students coming from automation, robotics, or networking. It is neither an advanced audit certification nor a credential reserved for experienced architects.
Skills covered by 810-115 OTSEC
Cisco describes eight broad outcomes: understanding OT and ICS architectures; applying foundational controls; configuring secure industrial network infrastructure; supporting asset visibility and threat detection; implementing basic segmentation; assisting with monitoring and incident response; aligning security work with operational and safety requirements; and supporting recognized OT security frameworks.
The common theme is application. Each topic should be connected to an observable decision during preparation:
- build an asset inventory without disrupting production;
- separate industrial zones by function and trust level;
- distinguish expected traffic from anomalous behaviour;
- preserve essential communications during an incident;
- give a SOC the industrial context needed to assess an alert;
- document a control with reference to IEC 62443, NIST guidance, and the NIST Cybersecurity Framework.
The official pages specifically mention industrial network segmentation, ICS traffic monitoring, and incident response on the plant floor. They also reference Cisco Cyber Vision, but present the certification as validation of cross-functional skills for industrial environments—not merely as a product exam.
Who is this path for?
Cisco lists OT technicians, industrial networking professionals, entry-level OT/ICS security practitioners, automation engineers, SOC analysts covering hybrid IT/OT environments, systems integrators, field engineers, and junior OT security consultants. It also points to Security+, CCNA, and CCNA Cybersecurity holders seeking an OT specialisation.
For a network professional, the main learning curve may be the shift in priorities: observe before acting, include process safety in the decision, and respect production constraints. For an automation professional, the larger gap may be cybersecurity fundamentals, segmentation, monitoring, and incident analysis.
If you are completely new to certification planning, the published OnLevelUp overview of the AWS AI certification path offers a useful method for separating foundational and role-based credentials. It is not OTSEC preparation, however; industrial operations and hands-on networking remain specific to this Cisco exam.
Build a plan before the exam opens
1. Start with objectives, not tools
Review the official 810-115 topics now and turn every objective into practical evidence. A segmentation note, for example, should include a small zone diagram, required flows, control points, and a rollback plan. An inventory note should distinguish passive discovery, sources of truth, and human verification.
Avoid memorising an acronym list in isolation. For every technology, answer four questions: which asset does it protect, which risk does it reduce, which operating constraint limits its use, and how can its operation be checked without endangering the process?
2. Build a safe lab
A useful personal lab does not require a physical industrial controller. You can document a simulated architecture containing an enterprise zone, an industrial DMZ, a supervision zone, and a production cell. Use virtual devices or learning packet captures whose usage rights are clear.
The goal is not to reproduce an entire plant. It is to practise the decisions the role requires: where to place a control, which communications to allow, how to collect evidence, and when to escalate. Never connect a training environment to a real industrial system without explicit authorisation and an approved change procedure.
3. Practise continuity scenarios
Create scenarios in which the fastest technical response is not the safest response. A vulnerable device may not be restartable immediately. Suspicious traffic may be essential to the process. A scan may create an outage. For every case, identify who must be consulted, what evidence must be collected, the containment option, and the criterion for returning to normal operation.
This makes the IT/OT distinction concrete. It also prepares you for the targeted roles, where the quality of a decision depends as much on coordination as on the chosen tool.
How to use the official training
The Cisco U. path announced for November 5 is expected to combine guided learning with practice. Cisco Networking Academy then plans approximately 75 hours of recommended content: Industrial Networking Essentials, one Energy or Manufacturing specialisation, and Industrial Cybersecurity Essentials. Cisco says these courses include interactive content, labs, assessments, and Packet Tracer simulations and remain free to Cisco Academies.
Before paying for a subscription or course, confirm actual availability in your region and exactly what the access includes. “Available in Cisco U.” does not necessarily make every component free. Networking Academy access can also depend on the institution offering the programme.
Use training to close gaps exposed by your exercises rather than treating completion as a promise of exam success. Keep a lab journal containing the objective, hypothesis, change, observation, operational risk, and decision. That record reveals whether you can explain a control or only recognise its name.
What the certification does not prove
No prerequisite does not mean the exam validates complete industrial expertise. Cisco places this at Practitioner level and focuses on foundational, applied skills. It does not replace authorisation to work on a site, safety procedures, or experience with a real industrial architecture.
It should not be described as an IEC 62443 certification either. Cisco states that its content aligns with IEC 62443, NIST guidance, and the NIST CSF. That alignment does not automatically make a holder an accredited auditor for those frameworks.
Finally, a badge alone does not demonstrate that someone can handle a production incident. Pair the certification with lab reports, anonymised diagrams, segmentation exercises, and an ability to explain trade-offs among confidentiality, availability, and safety.
Decide based on your starting point
If you already work as an OT technician or automation engineer, begin with networking and security fundamentals, then map them to your site constraints. If you come from IT or a SOC, focus on ICS architecture, passive discovery, maintenance windows, and the primacy of safety. If you are a student, use the announced 75-hour path to assemble evidence of practice progressively.
With the exam scheduled for February 3, 2027, there is no reason to book based on a headline alone. Start with the available objectives, reassess your skills after the Cisco U. path launches, and confirm price, language, and delivery rules when registration opens. That turns this new credential into a skills project rather than a race for the first badge.
