IEC 62443 certification and conformity

Certificate scope

To understand a certificate, check its certification scheme, standard part and edition, assessed product or process, and stated limitations. The scheme version, product or system version, capability or maturity level, certificate holder and issuing body further define what was assessed.

• process scope for secure development or service-provider capability;
• component scope for software applications, embedded devices, host devices, or network devices;
• system scope for a control system product, reference layout, and security zones;
• operating IACS scope for an asset-owner evaluation or site assessment;
• legal scope for CRA, which depends on the Regulation and OJ-cited harmonised standards, common specifications, or eligible EU cybersecurity certification schemes.

ISASecure scheme boundaries

ISASecure is an ISA-owned certification scheme for IEC 62443-related automation and control system claims. Its public scheme pages separate product, system, development-process, and IACS assessment claims.

IECEE certificate boundaries

IEC’s July 2019–June 2020 activity report, section 9.3.1, describes IECEE industrial cyber security certification as a route for testing and certifying cyber security in the industrial automation sector. It distinguishes assessment of an applicant’s security capabilities from assessment of their application to a specific product, automation solution, or IACS. The public IECEE database can help locate a certificate. The certificate and its report specify what was assessed; a reference to IEC 62443 alone does not establish whether the assessment covered a product, system or process.

CRA presumption is a legal mechanism

CRA presumption of conformity depends on Regulation (EU) 2024/2847. A product with digital elements or a manufacturer's process can benefit from presumption only for the essential cybersecurity requirements covered by an applicable harmonised standard whose reference has been published in the Official Journal, or by another CRA mechanism such as common specifications or an eligible European cybersecurity certification scheme.

That is a different legal mechanism from ordinary IEC 62443 use, ISASecure certification, or an IECEE certificate. CEN-CENELEC’s 9 September 2025 webinar material describes work to adapt EN IEC 62443 material into CRA-facing harmonised standards, including A11 work for EN IEC 62443-4-1:2018 and EN IEC 62443-4-2:2019. On that harmonised-standard route, until the relevant reference is published and the product is within its scope, the existing IEC 62443 evidence is supporting evidence, not CRA presumption by itself.

Reading certificates without overclaiming

A certificate supports conclusions about the work it actually assessed. Applying it to another role, product version, deployment or legal requirement requires a separate explanation of why the evidence remains relevant.

• Do not treat SDLA as proof that a specific component meets IEC 62443-4-2 technical requirements.
• Do not treat CSA as proof that a deployed system has the right zones, conduits, SL-T, or operating procedures.
• Do not treat SSA as proof that the asset owner's operating IACS security programme meets IEC 62443-2-1.
• Do not treat a 2-4 service-provider certificate as proof that the product supplied by that provider has a component capability level.
• Do not treat an IEC 62443 certificate as CRA presumption without identifying the applicable Article 27 mechanism, the covered Annex I requirements, and the product or process scope. The harmonised-standard route also requires publication of the standard reference in the Official Journal; common specifications and European cybersecurity certification use their own Article 27 conditions.