Skip to main content
Lumiar
Home/ Services/ Capability, training, and exercises
SERVICE

Capability, training, and exercises

We help organizations build lasting OT security capability through organization, method, training, exercises, and targeted instruction.

Capability building

Lasting capability comes from organization, method, and training together. We start with what the organization needs to be able to handle, and build roles, work processes, exercises, and training around it.

Competence that holds up in practice

The training content is developed through work with industry, standardization, teaching, and ongoing professional discussion with specialists in Norway and internationally.

Building OT security teams

We help organizations establish and develop their own OT security teams: roles, work processes, service model, and competence plans. The aim is that you can stand on your own feet when the engagement is over.

Exercises for emergency management and top management

A cyberattack on an industrial plant quickly becomes an emergency. We design exercises for the emergency organization and management, as part of an annual cycle of short tabletop exercises and larger exercises. Experienced leaders from our network can take part as observers and sparring partners. Findings from the exercises are followed up in the emergency response plans.

Talk to us about exercises

Courses and competence

Introduction to OT security
For managers and IT people who need to understand what makes OT different, what needs protecting, and what regulations such as NIS2, CRA, and CER mean for you.
AUDIENCEManagement and IT
DURATION1 day
FORMATOpen or in-house
Register interest
OT and IEC 62443 in practice
Zones, conduits, security levels, and requirement setting under IEC 62443-3-2 and 3-3, with exercises and examples drawn from the real world. The course also covers the newest parts: 2-1 (2024), 2-2 (2025), and 1-6 on IIoT and cloud services.
AUDIENCEAutomation and security
DURATION2 days
FORMATOpen or in-house
Register interest
In-house training program
Adapted to your facility, systems, and roles. From half a day for management to extended deep-dive programs.
AUDIENCEBy agreement
DURATIONAs needed
FORMATAt your site
Register interest

Examples of what participants learn to assess

RISIKOVURDERING · IEC 62443-3-2
Risikovurdering etter IEC 62443-3-2, med prosessikkerhet

Cyberrisikovurderingen bruker konsekvensene og barrierene fra prosessikkerhetsanalysen som grunnlag.

ProsessikkerhetPHA, HAZOP og LOPAKonsekvenser og barriererInitierende hendelser og barrierer som kan påvirkesdigitaltIEC 62443-3-2:2020 · hovedløpZCR 1Identifiser SuCZCR 2Innledenderisikovurderingverste fallZCR 3Del inn i sonerog conduitsZCR 4Sammenlign medakseptabelrisikoZCR 5DetaljertrisikovurderingSL-T (5.6),restrisiko(5.10)ZCR 6Dokumenterkrav,antakelser ogbegrensningerZCR 7Godkjenning hosanleggseierNy vurdering ved endringer (Offshore Norge 104, krav 2-6). Sløyfen er ikke en del av IEC 62443-3-2.
ProsessikkerhetPHA, HAZOP og LOPAKonsekvenser og barriererInitierende hendelser og barrierer somkan påvirkes digitaltProsessikkerhetsløpet gir grunnlag til ZCR 2og ZCR 5.IEC 62443-3-2:2020 · hovedløpZCR 1Identifiser SuCZCR 2Innledende risikovurderingverste fallZCR 3Del inn i soner og conduitsZCR 4Sammenlign med akseptabel risikoZCR 5Detaljert risikovurderingSL-T (5.6), restrisiko (5.10)ZCR 6Dokumenter krav, antakelser ogbegrensningerZCR 7Godkjenning hos anleggseierNy vurdering ved endringer (Offshore Norge104, krav 2-6). Sløyfen er ikke en del avIEC 62443-3-2.

Basert på IEC 62443-3-2:2020, IEC 61511-1 (8.2.4) og ISA-TR84.00.09-2023. Sektorrammeverk: prosessindustri (ISA-TR84.00.09-2023), jernbane (CLC/TS 50701, IEC 63452 under arbeid).

Lumiar-synteseLumiar
RISK ASSESSMENT · IEC 62443-3-2

Risk assessment under IEC 62443-3-2, with process safety

The cyber risk assessment uses the consequences and safeguards from the process safety analysis as its basis.

Process safetyPHA, HAZOP, and LOPAConsequences and safeguardsInitiating events and safeguards that can be affecteddigitallyIEC 62443-3-2:2020 · main flowZCR 1Identify theSuCZCR 2Initial riskassessmentworst caseZCR 3Partition intozones andconduitsZCR 4Compare withtolerable riskZCR 5Detailed riskassessmentSL-T (5.6),residual risk(5.10)ZCR 6Documentrequirements,assumptions,and constraintsZCR 7Asset ownerapprovalNew assessment on changes (Offshore Norge 104, requirement 2-6). The loop is not part of IEC 62443-3-2.
Process safetyPHA, HAZOP, and LOPAConsequences and safeguardsInitiating events and safeguards thatcan be affected digitallyThe process safety flow feeds ZCR 2 and ZCR5.IEC 62443-3-2:2020 · main flowZCR 1Identify the SuCZCR 2Initial risk assessmentworst caseZCR 3Partition into zones and conduitsZCR 4Compare with tolerable riskZCR 5Detailed risk assessmentSL-T (5.6), residual risk (5.10)ZCR 6Document requirements, assumptions, andconstraintsZCR 7Asset owner approvalNew assessment on changes (Offshore Norge104, requirement 2-6). The loop is not partof IEC 62443-3-2.

Based on IEC 62443-3-2:2020, IEC 61511-1 (8.2.4), and ISA-TR84.00.09-2023. Sector frameworks: process industry (ISA-TR84.00.09-2023), railways (CLC/TS 50701, IEC 63452 in progress).

Lumiar synthesisLumiar
BARRIERER · ISA-TR84.00.09
Angrepsveier og uavhengige barrierer

Å telle beskyttelseslag er ikke nok hvis ett cyberangrep kan slå ut flere av dem samtidig.

1Kan et cyberangrep skape eller muliggjøre den initierende hendelsen?2Kan det samme angrepet slå ut barrieren?kanangripesBPCS ellerPLSkanangripesAlarm ogoperatørkanangripesForriglingkanangripesSISikke hackbar idette scenarioetMekaniskavlastningInitierendehendelseKonsekvensfarlig prosessutvikling →CyberangrepsveiFelles årsak: samme angrepsvei når alle fireEn mekanisk barriere er bare uavhengig innenfordet den er dimensjonert for. Et angrep kan skapeen belastning den ikke er laget for.
1 Kan et cyberangrep skape eller muliggjøreden initierende hendelsen? 2 Kan det sammeangrepet slå ut barrieren?CyberangrepsveiInitierende hendelseFelles årsak: samme angrepsvei nåralle firekan angripesBPCS eller PLSkan angripesAlarm og operatørkan angripesForriglingkan angripesSISikke hackbar i dette scenarioetMekanisk avlastningEn mekanisk barriere er bare uavhengiginnenfor det den er dimensjonert for. Etangrep kan skape en belastning den ikke erlaget for.Konsekvens

Basert på ISA-TR84.00.09-2023, vedlegg D og avsnitt 6.6.2.

Lumiar-synteseLumiar
SAFEGUARDS · ISA-TR84.00.09

Attack paths and independent safeguards

Counting protection layers is not enough if a single cyberattack can defeat several of them at once.

1Can a cyberattack create or enable the initiating event?2Can the same attack defeat the safeguard?can beattackedBPCS or PLCcan beattackedAlarm andoperatorcan beattackedInterlockcan beattackedSISnon-hackable inthis scenarioMechanicalreliefInitiating eventConsequencehazardous development →Cyber attack pathCommon cause: the same attack path reaches all fourA mechanical safeguard is only independent withinwhat it is designed for. An attack can create aload it isn’t built for.
1 Can a cyberattack create or enable theinitiating event? 2 Can the same attackdefeat the safeguard?Cyber attack pathInitiating eventCommon cause: the same attack pathreaches all fourcan be attackedBPCS or PLCcan be attackedAlarm and operatorcan be attackedInterlockcan be attackedSISnon-hackable in this scenarioMechanical reliefA mechanical safeguard is only independentwithin what it is designed for. An attackcan create a load it isn’t built for.Consequence

Based on ISA-TR84.00.09-2023, annex D and section 6.6.2.

Lumiar synthesisLumiar
SÅRBARHETER · OFFSHORE NORGE 104, CSBR 7
Nå, Neste, Aldri

Sårbarheter prioriteres etter risikoen de gir i det faktiske anlegget.

SårbarheterVurdering av OT-risiko i sammenhengMetode fra veiledningenNåHøy risiko: kan utnyttes eller angripesaktivt.Tiltak eller utbedring med en gang.NesteBør håndteres, men haster ikke.Planlegges, testes og tas i etendringsvindu.AldriLav risiko: kan ikke utnyttes, eller er utenbetydning i anlegget.Ingen patch. Beslutningen føres irisikoregisteret.Ikke patch i dagens risikobilde.Vurderes på nytt ved utløpsdato.Krav og veiledningKompenserende tiltak medjevnlig kontroll (krav 7-4)Risikoeier akseptererrisikoen (krav 7-5)Fast intervall for nyvurdering og utløpsdato(krav 7-5)Patcher testes og godkjennesfør produksjon (veiledning)
SårbarheterVurdering av OT-risiko i sammenhengMetode fra veiledningenNåHøy risiko: kan utnyttes eller angripesaktivt.Tiltak eller utbedring med en gang.NesteBør håndteres, men haster ikke.Planlegges, testes og tas i etendringsvindu.AldriLav risiko: kan ikke utnyttes, eller eruten betydning i anlegget.Ingen patch. Beslutningen føres irisikoregisteret. Ikke patch i dagensrisikobilde. Vurderes på nytt vedutløpsdato.Krav og veiledningKompenserende tiltak med jevnlig kontroll(krav 7-4)Risikoeier aksepterer risikoen (krav 7-5)Fast intervall for ny vurdering ogutløpsdato (krav 7-5)Patcher testes og godkjennes før produksjon(veiledning)

Grunnlag: Offshore Norge 104 rev. 7, CSBR 7. Nå/Neste/Aldri er en metode som veiledningen foreslår. Kravene i sidefeltet er krav 7-4 og 7-5.

Lumiar-synteseLumiar
VULNERABILITIES · OFFSHORE NORGE 104, CSBR 7

Now, Next, Never

Vulnerabilities are prioritized by the risk they pose in the actual plant.

VulnerabilitiesOT risk assessed in contextMethod from the guidanceNowHigh risk: exploitable or actively attacked.Mitigate or remediate immediately.NextShould be handled, but isn’t urgent.Planned, tested, and applied in a changewindow.NeverLow risk: not exploitable, or irrelevant inthe plant.No patch. The decision is recorded in therisk register.Don’t patch in the current riskpicture. Reassessed at the expirydate.Requirements and guidanceCompensating measures withregular checks (requirement7-4)The risk owner accepts therisk (requirement 7-5)Fixed review interval andexpiry date (requirement7-5)Patches are tested andapproved before production(guidance)
VulnerabilitiesOT risk assessed in contextMethod from the guidanceNowHigh risk: exploitable or activelyattacked.Mitigate or remediate immediately.NextShould be handled, but isn’t urgent.Planned, tested, and applied in a changewindow.NeverLow risk: not exploitable, orirrelevant in the plant.No patch. The decision is recorded in therisk register. Don’t patch in the currentrisk picture. Reassessed at the expirydate.Requirements and guidanceCompensating measures with regular checks(requirement 7-4)The risk owner accepts the risk(requirement 7-5)Fixed review interval and expiry date(requirement 7-5)Patches are tested and approved beforeproduction (guidance)

Basis: Offshore Norge 104 rev. 7, CSBR 7. Now/Next/Never is a method suggested in the guidance. The requirements in the side panel are requirements 7-4 and 7-5.

Lumiar synthesisLumiar
INDUSTRIELL KI · NAMUR NE 178
Fra anbefaling til endring

Mer autonomi krever strengere kontroll på veien fra anbefaling til endring.

AnbefalingIdentitetRimelighetMappingAksept nåSluttkontrolli CPCEndring
Anbefaling1Identitet2Rimelighet3Mapping4Aksept nå5Sluttkontroll i CPC6Endring

Basert på NAMUR-anbefalingene NE 175, NE 177 og NE 178 (versjon 2025-03-10).

Lumiar-synteseLumiar
INDUSTRIAL AI · NAMUR NE 178

From recommendation to change

More autonomy requires stricter control on the way from recommendation to change.

RecommendationIdentityReasonablenessMappingAcceptance nowFinal check inCPCChange
Recommendation1Identity2Reasonableness3Mapping4Acceptance now5Final check in CPC6Change

Based on the NAMUR recommendations NE 175, NE 177, and NE 178 (version 2025-03-10).

Lumiar synthesisLumiar

Open courses scheduled now

Two open courses are scheduled in collaboration with Tekna. Registration is handled by them. The courses are held in Norwegian.

OPEN COURSE · TEKNA
Operational technology and industrial cybersecurity
How to protect industrial control systems against cyber attacks
A foundational course in OT and industrial cybersecurity based on IEC 62443: characteristics and trends, the difference between IT and OT, risk, data transport, the Purdue model and where it no longer suffices, standards, and best practice.
See dates and register at Tekna →
OPEN COURSE · TEKNA
AI in industry
Foundational use and opportunities
AI is changing the terms for industry: from production optimization and predictive maintenance to new challenges around ethics, security, and reliability.
See dates and register at Tekna →

Teaching and professional forums

We give guest lectures at universities and have helped develop OT security courses at vocational colleges. Teaching is part of our professional community: it keeps us sharp, and it builds the next generation of practitioners.

Do you teach, or are you developing courses in industrial security? Feel free to get in touch.

Conferences and seminars

We organize seminars and contribute talks at conferences, in Norway and internationally. If you are gathering your own specialists or clients around OT security, we are happy to help with the program and content.

What participants say

5.8out of 6 on average
in participant ratings
200+participants
in total
RATED 6 OUT OF 6
“Rarely have two days gone by so fast.”
Course participant (translated from Norwegian)
RATED 6 OF 6
«Engaging from the first hour. No scare tactics, just substance.»
IT security manager
RATED 6 OF 6
«Finally a course that understands the plant has to keep running at the same time.»
Operations manager, onshore facility

Frequently asked questions

Do participants need prior knowledge?
The introduction course requires none. The practice course assumes basic familiarity with automation or networking.
Can the course be held at our site?
Yes. In-house courses are held wherever suits you, and the content is adapted to your facility and systems.
Do participants get a certificate?
Yes, all open courses and in-house programs are documented with a certificate.

Put me on the list

You will be notified when the next date is set.

Date notifications only, nothing else. Privacy policy.

Want training for your people?

Register interest in a course