IEC 62443: roles, systems and products
Sytance · Updated
IEC 62443 addresses cybersecurity across the lifecycle of industrial automation and control systems (IACS). Its parts distinguish the responsibilities of asset owners, service providers and product suppliers, alongside system design and component requirements.
How the series fits together
An IACS includes the technology, people and work processes used to operate industrial equipment. ISA and ISAGCA therefore describe security as a shared responsibility: asset owners manage operation, service providers integrate and maintain systems, and product suppliers develop and support products.
Series structure
Start here when the question is which part applies to an asset owner programme, service provider, system design, secure development lifecycle, or component.
Zones and security levels
Use this page for the system under consideration, zones, conduits, risk assessment, SL-T, SL-C, and SL-A.
Secure development
IEC 62443-4-1 addresses how product suppliers develop and maintain hardware, software and firmware used in IACS.
Component requirements
IEC 62443-4-2 expresses technical component capability requirements through the seven foundational requirements.
System requirements
IEC 62443-3-3 applies the foundational requirements at control system level, together with the zones and conduits from system design.
Certification and conformity
Certificates and harmonised standards need their own scope. A component, process, system, service capability, and legal product file are not the same assessment object.
Reading order
The starting point depends on the work: assessing an operating system, certifying a component and reviewing a development process each call for different parts.
- Use Series structure to identify the role and part: asset owner, service provider, system designer, product supplier, or component.
- Use Zones, conduits, and security levels once the system boundary, operational environment, and risk question are known.
- Use System requirements when the claim is about a deployed or designed control system, not only a supplier product.
- Use Secure product development when the claim is about the supplier lifecycle behind a product.
- Use Component requirements when the claim is about an embedded device, host device, network device, software application, or control-system component.
Using IEC 62443 for regulatory compliance
IEC 62443 can support product-law evidence, but it does not replace the law. A product-law file still needs the applicable legal requirement, the product or system scope, the standard edition, and the exact claim being made. Certification and conformity claims are handled on the dedicated page.