IEC 62443: frequently asked questions
Sytance · Updated
Which IEC 62443 part applies depends on the work being assessed. These answers explain the main roles, system concepts and limits of certification.
Series structure
No. It is a series. Different parts address security programmes, service providers, system risk assessment, system requirements, secure product development, and component requirements.
A zone groups assets with similar security requirements. A conduit describes communication between zones. This model helps identify which requirements and security levels apply to each part of the system.
SL-T is a target security level set through risk assessment. SL-C is capability designed into a system or component. SL-A is achieved security level after assessment. The terms need a defined system, zone, conduit, or component scope.
Roles and claims
IEC 62443-4-1 is usually the secure development lifecycle part for product suppliers. IEC 62443-4-2 is usually the technical capability part for IACS components.
System work usually uses IEC 62443-3-2 for risk assessment and IEC 62443-3-3 for system security requirements. Product evidence from 4-1 or 4-2 does not replace system design evidence.
No. Asset-owner programme evidence covers the operating organisation and site lifecycle. Product security evidence covers the supplier product, secure development process, and component capabilities.
Certification and legal use
Not by itself. A certificate proves only what its scheme and scope say it proves. Legal conformity still depends on the applicable law, product, requirement, edition, and recognised standard route.
Yes. It can support secure development, component, system, and service evidence. The product-law file must still explain which legal requirement is being supported and why the IEC 62443 evidence is relevant.