CompTIA SecOT+ (SOT-001) Is Coming: Six Domains, Who It’s For and Whether to Take It at Launch

Last reviewed: November 12, 2026. This exam has not been launched yet. Everything below comes from CompTIA’s SecOT+ page, its beta announcement and its published exam objectives (the document hosted by CompTIA, version 2.1). Where CompTIA has not published a detail, we say so instead of filling the gap. Our own calculations and opinions are labeled as ours.

TL;DR: SecOT+ is CompTIA’s first certification built only for operational technology (OT) security, the systems that run factories, utilities and other physical processes. The exam code is SOT-001, with up to 95 questions (multiple choice and performance-based) in 90 minutes and a passing score of 750 on a 100 to 900 scale, per the CompTIA objectives. It launches in December 2026, but CompTIA’s own page gives two dates (December 1 and “on or around December 8”). CompTIA recommends 3+ years of hands-on OT experience and 2+ years implementing OT cybersecurity, so this is a specialist exam, not a beginner’s. The objectives contain 31 objectives, and 10 of them are “given a scenario” objectives, which our weighting estimate puts at roughly a third of the exam. Price, delivery rules and renewal credits had not been published when we checked. If you already work in OT security, taking it at launch is reasonable. If you are an IT security person curious about OT, the objectives show a lot of plant-floor material you will need to learn first.

Quick Facts

Item	Details (per CompTIA unless marked)
Exam	CompTIA SecOT+ V1, exam code SOT-001
Launch	December 2026. The page lists both December 1 and “on or around December 8”
Questions	Up to 95, multiple choice and performance-based
Time	90 minutes
Passing score	750 on a 100 to 900 scale
Recommended experience	3+ years of hands-on OT work and 2+ years implementing OT cybersecurity solutions
Prerequisites	None listed beyond the recommended experience
Languages	English (per the certification page)
Domains and objectives	6 domains, 31 objectives
Price	Not on CompTIA’s page. One training provider reports about USD 439 in the US store, which we could not confirm
Renewal	Credits and fees not published when we checked. CompTIA estimates retirement about 3 years after launch
Accreditation	Listed as “TBD” in the objectives
Target roles named by CompTIA	OT security engineer or specialist, ICS/SCADA security engineer, OT security architect, critical infrastructure engineer, site or plant OT lead

Domain	Weight	Objectives	“Given a scenario” objectives
1.0 OT Systems and Safety Foundations	14%	5	1
2.0 OT Risk Management	17%	5	0
3.0 OT Threat Intelligence	14%	4	1
4.0 OT Cybersecurity Architecture, Design, and Engineering	18%	6	4
5.0 OT Security Operations	22%	5	2
6.0 OT Incident Management	15%	6	2

The objective and scenario counts are ours, counted from the objective titles in CompTIA’s document.

Key Takeaways

• It is a specialist exam. CompTIA’s recommended experience (3+ years OT, 2+ years OT security) is far above its entry-level exams.
• Operations and architecture carry the most weight. Domains 5 and 4 together are 40% of the exam.
• A third of the weight sits on scenario objectives (our estimate). Weighting each domain by its share of “given a scenario” objectives gives roughly 32%, and Domain 4 is where it concentrates.
• Safety is the first objective. The exam opens with applying safety techniques to the job environment, which sets the tone for the rest.
• The objectives name real incidents. Objective 3.2 lists specific historical events, so your study should include them.
• CompTIA publishes a lab hardware and software list. It shows what a practice environment looks like, which most summaries skip.
• Several details are not public yet. Price, renewal credits and accreditation status were not published when we checked.
• Do not plan around a single launch date. CompTIA’s page shows December 1 in one place and “on or around December 8” in another.

What Is SecOT+ and Why Does It Exist?

It is CompTIA’s answer to the risk that appears when IT and OT systems connect. CompTIA calls it its first certification focused exclusively on OT security. OT covers the equipment and software that monitor and control physical processes, such as pumps, valves, assembly lines and power distribution. When those systems connect to corporate networks and the internet, an attack can have physical consequences, not only data loss.

The objectives say the exam certifies that you can:

1. Explain the physical impact of OT cybersecurity threats.
2. Assess OT security posture as part of a risk management program.
3. Distinguish the design, operational and security aspects of OT and IT environments.
4. Work within applicable OT regulations, policies and governance, risk and compliance principles.
5. Identify, analyze and respond to OT security events and incidents.
6. Apply OT incident management principles.

CompTIA names the audience as control engineers and OT cybersecurity engineers.

Is the Exam Date Actually Settled?

Not exactly, so plan around “December 2026” instead of one day. CompTIA’s SecOT+ page is titled “Launching December 2026.” The body text says it is scheduled to launch on or around December 8, 2026, while the exam details list a launch date of December 1, 2026. Pre-orders were open when we checked.

CompTIA also ran a beta exam (the announcement lists the beta code as SO1-001, while the final exam is SOT-001) that closed August 7, 2026. Beta candidates who qualified, took and passed earn the certification at no charge, and results are held until the full exam launches. If you were in the beta, check your CompTIA account after launch.

One more version note: the objectives documents CompTIA has hosted have carried different version numbers and a “Draft” label on at least one copy. The domain weights matched in the copies we compared, but always download the current objectives from CompTIA’s page before you build a study plan.

How the Exam Is Structured, in Plain Numbers

CompTIA’s objectives list up to 95 questions, 90 minutes, and a passing score of 750 on a 100 to 900 scale. We did not find a published retake policy, and the delivery options (test center, remote) were not stated on the certification page. Here is what those numbers mean in practice.

Pacing. 90 minutes across 95 questions is about 57 seconds per question if you see the maximum. Performance-based items usually take longer than multiple choice, so every minute you save on easy items is a minute for scenario items. CompTIA does not publish how many performance-based questions to expect.

Questions by domain (our arithmetic). If you see all 95 questions and the weights are applied exactly, the split would look like this. Real exams vary, and CompTIA’s weights are approximate.

Domain	Weight	Questions out of 95 (approx.)
1.0 OT Systems and Safety Foundations	14%	13
2.0 OT Risk Management	17%	16
3.0 OT Threat Intelligence	14%	13
4.0 OT Cybersecurity Architecture, Design, and Engineering	18%	17
5.0 OT Security Operations	22%	21
6.0 OT Incident Management	15%	14

What the verbs tell you. The 31 objective titles start with different verbs, and the verb signals depth:

Objective wording	Count	Where they cluster
“Explain”	14	Domains 1, 2 and 3 mostly
“Given a scenario”	10	Domain 4 (4 of 6), Domain 5 (2 of 5), Domain 6 (2 of 6), Domains 1 and 3 (1 each)
“Summarize”	4	Mixed
“Compare and contrast”	2	1.5 and 6.6
“Describe”	1	6.1

If you weight each domain by the share of its objectives that are scenario-based, about 32% of the exam sits on scenario objectives. This is our estimate, not a CompTIA statement, but it shows why reading definitions will not be enough for Domains 4 to 6.

The Six Domains, Objective by Objective

The sections below follow CompTIA’s objectives. The topic lists are our paraphrase of CompTIA’s document, so check the original wording before you rely on a detail. We use a different format for each domain on purpose, because the domains ask different things of you.

Domain 1: OT Systems and Safety Foundations (14%)

Know the plant before you secure it.

1.1 Apply safety techniques (scenario). The topics cover safety considerations (loss of life, property damage, injury), industrial ratings, common hazards (electrical, pressure, heights, temperature, fire, chemical, water), lockout and tagout, job safety analysis, personal protective equipment and safety briefings. This is unusual for a cybersecurity exam and it is the first thing CompTIA tests.

1.2 Unique elements of OT. IT/OT convergence, the different roles of IT and OT staff, device types and industrial control systems. The device list includes sensors, actuators, controllers, PLCs, HMIs, VFDs, relays, IEDs, RTUs, engineering and operator workstations, historians and transient devices. Control system types include DCS, localized control networks, safety instrumented systems (SIS), SCADA and MES. Standalone systems and critical infrastructure sectors are also listed.

1.3 Control theory. Control logic styles (ladder logic, function block diagrams, structured text and sequential function charts) and ideas such as process variables, setpoints, I/O, watchdogs, timers and tags.

1.4 Communication mediums and protocols. This is where many IT candidates will feel the gap. The objectives group protocols by medium:

Medium	Protocols and standards named
Serial	RS-232, RS-485, Modbus RTU, Profibus, Data Highway Plus, DNP3
Ethernet	EtherCAT, Modbus TCP, CIP/EtherNet/IP, OPC DA, OPC UA, BACnet/KNX, Profinet
Wireless	VHF, AIS, VSAT, M-Bus, 802.15.4, 802.11

1.5 Infrastructure considerations (compare and contrast). Legacy and unsupported systems (embedded, custom or proprietary operating systems, real-time operating systems, unsupported hardware, protocols, physical ports and applications) against modern ones (virtualization including virtual PLCs and containers, software-defined networking, middleware, machine learning and generative AI, cloud and edge services, privatized backbones and autonomous systems). The inclusion of AI and cloud shows CompTIA expects candidates to handle modernized plants, not only old equipment.

Domain 2: OT Risk Management (17%)

Familiar to risk and compliance people, with an OT twist.

Think of this domain as five questions:

1. Why do we manage risk at all? (2.1) Risk appetite, balancing security with operations, governance structures, business continuity and disaster recovery. The drivers include national security, regulatory compliance, business impact (financial, reputational, quality, operational), business safety (loss of life, environmental harm), reliability and legal requirements.
2. How is the program run? (2.2) Risk levels and registers, maturity assessments, benchmarks and roadmaps, the RACI model, stakeholder management, procurement and contract elements (MSAs, SLAs, MOUs, SOWs), metrics, training, criticality and documentation (policies, processes, standards, SOPs).
3. How do we assess it? (2.3) Frameworks from NIST and ISA/IEC, likelihood and impact, asset and network scoping, attack vectors and threat actors, and methods including scenario-based, supply chain, third-party, failure mode and criticality, qualitative versus quantitative, architecture review, penetration testing and adversarial emulation. It also covers risk registers, treatment, control catalogs, inherited risk and maturity indicators.
4. What happens after assessment? (2.4) Residual risk, internal and external audits, reporting, escalation, and the four dispositions: accept, transfer, avoid or mitigate.
5. How do we change things safely? (2.5) Identify the change, decide whether it applies, test it (including rollback), tell stakeholders such as department heads and asset owners, and get approval.

Notice that no objective in this domain is a “given a scenario” objective in its title, but the content still lends itself to scenario questions about prioritizing risk and approving changes.

Domain 3: OT Threat Intelligence (14%)

Same ideas as IT threat intelligence, applied to industrial targets.

3.1 Foundations. Intelligence types (human, signals, measurement and signature, open source, imagery), the intelligence lifecycle, the Diamond Model of Intrusion Analysis, MITRE ATT&CK for ICS and the ICS Cyber Kill Chain.

3.2 Historical events. This is the part many summaries skip. The objectives name specific incidents, split by how directly they hit OT:

Impact	Events named in the objectives
Direct impact on OT	Stuxnet, TRISIS, BlackEnergy 2 and 3, FrostyGoop, Industroyer
Indirect impact	Colonial Pipeline, SolarWinds, Maersk, AcidRain, the 2024 CrowdStrike incident, Collins Aerospace and RTX

Our reading: the exam asks about relevance (what each event teaches about OT defense), not trivia, so study the pattern of each incident (how access was gained, what was affected) instead of memorizing dates.

3.3 Threat landscape. Threat actors include unintentional and intentional insiders, hacktivists, nation-states and APTs, espionage actors and cybercriminals including extortion groups. Threat vectors listed include remote access (third-party and internal), removable media, social engineering (phishing, vishing), account compromise, firmware supply chain, lateral movement, IT-to-OT pivoting, unauthorized devices, misconfigurations, vulnerability exploitation, on-path attacks, QR code vulnerabilities and cell-based attacks such as SIM swapping and rogue base stations.

3.4 Analyze intelligence (scenario). Sources and feeds (private services, OEMs, volunteers, bug bounties, social media, ISACs and government agencies), threat intelligence platforms, YARA and STIX, indicators of compromise (hashes, IP addresses, malicious domains, usernames, registry changes, abnormal processes, unusual logs and sessions) and tactics, techniques and procedures.

Domain 4: OT Cybersecurity Architecture, Design, and Engineering (18%)

The heaviest scenario domain. Four of six objectives are scenario-based.

4.1 Architectural principles. Least privilege and functionality, operational resilience (endurance, redundancy, high availability, recoverability), compartmentalization, performance, criticality, auditability, observability, determinism, interoperability, simplicity and defense in depth. Determinism is worth noting because it is a plant concern more than an IT one.

4.2 Physical security. Access control (badges, readers, biometrics, turnstiles, access control vestibules), room and cabinet security (cable security, IDFs and MDFs), surveillance (walkdowns, video, motion detection, spectrum analyzers), fences and bollards.

4.3 Hardware controls (scenario). Port lockers and blockers, PLC operating modes, backup strategy, firmware updates, tamper detection, drive encryption, secure boot, root of trust and TPM, hardware access control, port, protocol and service management, and secure removable media.

4.4 Host and application practices (scenario). Host-based firewalls, HIDS, EPP, EDR and EPM, patches and updates, RBAC, ABAC and mandatory access control, code signing and verification, OS benchmark configuration, integrity verification, disabling debug interfaces and read/write protection settings.

4.5 Network controls and designs (scenario). The longest list in the domain: ACLs and explicit firewall policy, allow and block lists, port and protocol management, network access control (MAC-based, certificate-based, token-based), physical and logical segmentation (subnets, VLANs), encryption placement, proxies, data diodes and unidirectional gateways, OT-aware IDS and IPS, wireless management, internal network monitoring (traffic, flow and log collection, aggregation and baselining), DNS security, out-of-band management, and zones and conduits including the industrial DMZ.

4.6 Identity, authentication and authorization (scenario). Account types (service, shared, individual, privileged, local), changing default passwords, directory services and Group Policy, PKI with device and user certificates, RADIUS and TACACS+, SSO, MFA and PAM, and secure remote access through jump boxes and bastion hosts.

Domain 5: OT Security Operations (22%)

The largest domain and where day-to-day work lives.

Objective	What you are expected to handle
5.1 Asset management	Build and maintain an inventory using passive, active and manual discovery. Track attributes such as network address, identifiers, model and version, physical location, ports, owner, function, vendor, end-of-life status and device type. Map software to assets in a CMDB
5.2 Analyze data (scenario)	Read control system data (process logs, change logs, function codes), network and boundary data (IDS, packet captures, syslog, firewalls, switches, routers), and host and security data (access logs, EDR, EPP, OS and identity logs). Tune SIEM, SOAR, IDS, firewall and EDR rules
5.3 Vulnerability remediation	Choose among patching, mitigating controls, compensating controls and version management. Weigh availability, applicability, viability and dependencies. Coordinate timelines, implementation windows, spares, backups and planned downtime. Test, validate and confirm a rollback plan
5.4 Vulnerability management (scenario)	Find vulnerabilities passively, actively and by derivation. Use SBOMs, vendor notices and the NVD. Triage by applicability and prioritization factors (exposure, relevance, exploitability, severity, impact). Verify remediation
5.5 Portable device security	Removable media controls (scanning kiosks, dedicated devices, authorization, destruction, tracking, tamper validation, sanitization, write blockers, data loss detection). Mobile and third-party devices (laptops, engineering and calibration equipment, phones, tablets, wearables). Posture checks and external connections

Our reading: objectives 5.3 and 5.4 are where OT differs most from IT patching. The exam wants you to choose among options when the “obvious” patch is not possible during production.

Domain 6: OT Incident Management (15%)

From framework to recovery, with safety at stake. Here is the lifecycle in order.

1. Frameworks (6.1). PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) and the Incident Command System including ICS4ICS.
2. Considerations (6.2). Cyber and physical response, emergency services, emergency shutdown, crisis management, roles of operations, engineering and maintenance, IT/OT coordination, mutual aid (internal teams, peers, ISACs, IR retainers) and internal and external notification including regulators.
3. Preparation (6.3, scenario). Incident response plans and playbooks, purple-team exercises, tabletop exercises, simulations and runbooks, plus using knowledge of high-value assets and the attack surface.
4. Response and handling (6.4). Flyaway kits (PPE and tools), decision matrices for declaring an incident, shutting down and paying (including sanctions screening for ransom), triage and scoping, chain of custody, response resources (third parties, vendors, insurers), primary impacts (manipulation or loss of view, control and safety), advanced data collection (process historians, sequence of events, operator logs, host memory, workstations, servers, device disks, registries and access logs) and root cause analysis.
5. Data sets (6.5, scenario). System documentation (baseline and design deviations), network data (flow data, firewall logs, ICS protocol traffic, packet captures, IDS alerts, deception technologies, ISP logs, syslogs) and host disk data (OS, application, security, sudo and systemd logs).
6. Containment, eradication and recovery (6.6, compare and contrast). Isolating and quarantining systems, disconnecting IT from OT, blocking traffic and suspending accounts; removing compromised components and resetting credentials; restoring devices, bare-metal rebuilds, process validation, hot swaps and redesign; then lessons learned (hot wash, postmortem) and mandatory reporting to regulators, insurers, emergency services and contract partners.

The “loss of view, control and safety” language is worth remembering. It describes the primary impacts of an OT incident in terms operators use, which differ from IT’s confidentiality, integrity and availability framing.

What Does CompTIA’s Hardware and Software List Tell You?

It tells you what a practice environment should contain. CompTIA’s objectives include a Hardware and Software List for lab preparation. It is a sample list, not a requirement to buy anything:

Category	Items listed
Hardware	Servers, firewalls, routers, switches, serial and Ethernet cables, unidirectional gateways, network taps, spectrum analyzers, PLC and HMI hardware, sensors
Software	Windows and Linux, FreeRTOS, endpoint protection, OT-aware firewalls and IDS, SIEM, PLC and HMI programming tools, SCADA platforms, historians, hypervisors, PKI tools
Other	Sample packet captures, IoC samples in STIX format, risk management templates

You do not need every item. The list shows the skills CompTIA expects: serial versus Ethernet connections, reading packet captures, working with a historian, writing or reading control logic and handling STIX indicators.

What Does OT Mean for Someone From IT?

If you come from IT security, the mental shifts are real. These are our general observations about OT security, not CompTIA statements:

Area	Typical IT habit	What changes in OT
Priority	Protect data first	Safety and keeping the process running come first
Patching	Patch quickly	Patching may require planned downtime and vendor approval
Scanning	Run active scans	Active scans can disrupt fragile devices, so passive methods matter
Change	Frequent updates	Change control is strict, with rollback plans
Lifespan	Devices refresh every few years	Equipment can run for many years
Incident response	Contain and rebuild	Shutdown decisions affect safety and production

The objectives reflect this: safety is objective 1.1, change management is objective 2.5, remediation in 5.3 weighs “availability” and “viability” and incident response in 6.4 includes shutdown decision matrices.

Which Domains Will Feel New to You? (Our Familiarity Check)

Answer first: for a typical IT security professional, about half the exam by weight is new material. This split is our classification, so adjust it to your own background.

Domain	Weight	Likely familiar to IT security staff?
2.0 Risk Management	17%	Mostly familiar
3.0 Threat Intelligence	14%	Mostly familiar (frameworks differ)
6.0 Incident Management	15%	Partly familiar (OT adds safety and shutdown)
4.0 Architecture and Engineering	18%	Partly familiar (segmentation, IAM) with OT-specific layers
5.0 Security Operations	22%	Partly familiar (logging, vulnerabilities) with OT constraints
1.0 Systems and Safety	14%	New

An OT engineer from the plant side will have the reverse pattern: strong on Domain 1, weaker on threat intelligence, risk frameworks and security operations tooling.

Who Should Take SecOT+?

Take it if you already live in the OT world, or you are moving there on purpose.

You are…	Fit	Why
OT security engineer with 2+ years of hands-on work	Strong	Matches CompTIA’s own target role and experience
Control or automation engineer who handles security tasks	Strong	You know the plant side. The security objectives are the stretch
IT security analyst with a SOC or network background	Possible, with prep	Domains 2, 3 and 6 will feel familiar. Domains 1, 4 and 5 add plant-specific material
Plant or site OT lead	Good	The risk and incident domains reflect lead responsibilities
Early-career IT or security professional	Not yet	The recommended experience is well beyond entry level
Student with no OT exposure	Not yet	Build fundamentals first

CompTIA does not list a formal prerequisite, so you can register without the experience. The recommended experience tells you what level the questions assume.

Should You Take It at Launch or Wait?

Take it at launch if the exam helps you now. Wait if you are only curious.

Reasons to take it early:

• You already meet the recommended experience.
• A current or target employer asks for an OT security credential.
• Your employer is paying and wants the new credential on file.
• You were in the beta and are waiting on results (those results come at launch).

Reasons to wait a few weeks or months:

• Price and policies are not public yet. Check CompTIA’s store before you commit.
• Accreditation shows as “TBD.” If a requirement mentions an accreditation or a government framework, check whether SecOT+ qualifies.
• Prep material is thin at launch. New exams usually have fewer practice resources and community notes in the first weeks.
• You still need OT experience. Waiting while you build it costs nothing.

If you are on a CompTIA path, our guides on Network+ vs Security+ and CySA+ CS0-003 vs CS0-004 cover the usual security steps before a specialist exam like this one.

How Does It Compare With Other CompTIA Security Exams?

Exam	Focus	Typical audience
Security+	Core security across IT	Early-career security and IT
CySA+	Security analytics and response in IT	Analysts with some experience
SecOT+	OT and industrial security	Experienced OT and OT security staff

CompTIA recommends 3+ years of OT experience for SecOT+. That puts it closer to a specialization for people already in industrial settings than a stepping stone after Security+. We do not claim SecOT+ is “above” or “below” CySA+, since they cover different environments. If you are still building the base, our A+ 220-1201 vs 220-1202 guide covers the entry step, and our SC-200 vs SC-401 guide covers security operations on the IT side. For the other new CompTIA direction, see our guide to CompTIA AgentOps+ coming in 2027.

How Much Will It Cost?

CompTIA’s SecOT+ page did not show a price when we checked. One training provider reports about USD 439 in the US store, but we could not confirm that on CompTIA’s pages, so treat it as unverified. Prices vary by country, bundle and reseller, and CompTIA often sells retake bundles. Check CompTIA’s store the week you book. We also do not know the renewal fee or the number of continuing education units yet.

A simple way to budget: the exam fee, plus a retake allowance, plus any training you buy, plus lab costs (many items in the hardware list can be replaced by free or low-cost simulators). If your employer pays, ask whether a retake is covered.

How Should You Study for It?

Here is a study order that follows the objectives. It is our suggested approach, not CompTIA’s.

1. Read the full objectives. CompTIA hosts them on its SecOT+ page. Mark each of the 31 objectives as green (I could teach it), yellow (I know the idea) or red (new to me).
2. Start with domain 1, even if you are an IT person. Learn the equipment and protocols (PLC, HMI, RTU, Modbus and the rest) before the security domains. Everything else builds on them.
3. Do domain 5 next. It is 22% of the exam, with asset management, data analysis and vulnerability management in OT.
4. Move to domain 4. Practice reading network diagrams and choosing controls, since four of its six objectives are scenario-based.
5. Cover threat intelligence and incident management together. The ICS threat frameworks feed the incident frameworks, and the named historical events work well as case studies for both.
6. Finish with risk management. It ties governance, change management and assessment together.
7. Practice under time. With 90 minutes for up to 95 questions, time how long scenario items take you.

A rough planning estimate: experienced OT security staff might need 4 to 8 weeks of focused review, while IT security staff new to OT might need 10 to 16 weeks. These are our estimates, since the exam has not launched and no pass-rate data exists.

A 4-Week Plan for Someone With OT Experience (our suggestion)

Week	Focus	Output
1	Self-assess all 31 objectives, then Domains 2 and 3	A red/yellow/green sheet and notes on frameworks (NIST, ISA/IEC, MITRE ATT&CK for ICS)
2	Domains 4 and 5	A zone-and-conduit diagram you can draw from memory and a one-page asset attribute checklist
3	Domain 6 and 1.4 to 1.5	A PICERL one-pager with OT-specific notes and a protocol table
4	Timed practice and weak areas	Two timed sessions and a list of misses by objective number

A 10-Week Plan for Someone From IT Security (our suggestion)

Weeks	Focus
1 to 3	Domain 1: safety, equipment, control logic, protocols
4 to 5	Domain 5: assets, data analysis, vulnerability management under OT constraints
6 to 7	Domain 4: architecture, segmentation, remote access, identity
8	Domain 3 and Domain 6 together
9	Domain 2 and change management
10	Timed practice and weak-spot review

Mistakes to Avoid

1. Treating it like Security+ with industrial words. The weighting and experience expectations are different.
2. Skipping domain 1. The equipment and protocol knowledge underpins the other domains.
3. Assuming IT habits apply. Active scanning, fast patching and quick changes can be unsafe in OT.
4. Trusting old third-party outlines. Use CompTIA’s current objectives and check the version.
5. Memorizing incident names without lessons. Objective 3.2 is about relevance, so know what each event teaches.
6. Booking before the price and policy are public. Wait until CompTIA posts them.
7. Ignoring timing. Plan for both December 1 and December 8, since the page lists both.
8. Buying heavy prep before launch. Early materials may change after the exam goes live.
9. Practicing on live production systems. Use labs, simulators and sample captures only.

FAQS

What is CompTIA SecOT+? 

It is CompTIA’s first certification focused only on operational technology security, covering OT safety, risk, threat intelligence, architecture, operations and incident management.

When does SecOT+ launch? 

December 2026. CompTIA’s page lists both December 1 and “on or around December 8,” so confirm the exact date with CompTIA.

What is the SecOT+ exam code? 

SOT-001 (V1). The beta announcement lists a beta code of SO1-001.

How many questions are on SecOT+? 

Up to 95, a mix of multiple-choice and performance-based questions, per the CompTIA objectives.

How long is the SecOT+ exam? 

90 minutes, per the objectives.

What is the SecOT+ passing score? 

750 on a scale of 100 to 900, per the objectives.

How much does SecOT+ cost? 

CompTIA’s page did not list a price when we checked. One training provider reports about USD 439, but that is unconfirmed.

What are the SecOT+ domains? 

OT Systems and Safety Foundations (14%), OT Risk Management (17%), OT Threat Intelligence (14%), OT Cybersecurity Architecture, Design and Engineering (18%), OT Security Operations (22%) and OT Incident Management (15%).

What OT protocols are on the SecOT+ exam? 

The objectives name serial protocols (RS-232, RS-485, Modbus RTU, Profibus, Data Highway Plus, DNP3), Ethernet protocols (EtherCAT, Modbus TCP, CIP/EtherNet/IP, OPC DA, OPC UA, BACnet/KNX, Profinet) and wireless options (VHF, AIS, VSAT, M-Bus, 802.15.4, 802.11).

Is SecOT+ for beginners? 

No. CompTIA recommends 3+ years of hands-on OT experience and 2+ years implementing OT cybersecurity solutions.

Do I need Security+ before SecOT+? 

CompTIA does not list it as a prerequisite. Security+ knowledge helps if you are coming from IT.

Is SecOT+ accredited or approved for government roles? 

Accreditation is listed as “TBD” in the objectives, and we did not find a published framework approval. Check CompTIA and your employer’s requirements.

How long is SecOT+ valid, and what happened to the beta? 

CompTIA’s page did not state the validity or renewal credits, though CompTIA’s certifications commonly use a 3-year cycle. The beta window closed August 7, 2026. Qualified candidates who passed earn the certification free, and results are released when the full exam launches.

Final Thoughts

SecOT+ is a real specialist credential, and CompTIA’s own experience recommendation says so. If you work in OT security, the objectives map closely to your job, and taking it at launch is reasonable once the price and rules are public. If you come from IT security, the exam offers a clear map of what you would need to learn about the plant floor, and that map is worth reading even if you never sit the exam. Read the full objectives on CompTIA’s SecOT+ page, check the launch date and price, and decide based on your role, not the novelty.