Service Provider Requirements

Service-provider scope

The relevant actor is the IACS service provider. The work can be integration, maintenance, or both, and the service provider may be an external supplier or an internal organisation acting in that role. The part is useful because integration and maintenance decisions can strengthen or undermine the security assumptions that the asset owner depends on.

Integration and maintenance capabilities

IEC describes the 2-4 capabilities as policy, procedure, practice, and personnel related. That boundary is important. A service-provider capability claim should show how the provider performs security related work for the asset owner, not only that the provider sells a secure product.

• security planning and responsibilities for the contracted service;
• secure engineering, configuration, testing, and handover activities during integration;
• remote access, account, event, backup, malware, patch, and vulnerability practices relevant to the service;
• coordination with the asset owner's IACS security policies and procedures;
• personnel competence and project staffing for the service being provided.

Profiles and subsetting

IEC 62443-2-4:2023 allows profiles because not every requirement fits every industry group, organisation, or service environment. A profile can narrow the requirement set, but it also narrows the claim. A profile-based certificate or assessment should be read with the profile, service scope, edition, maturity level, and excluded activities visible.

Boundary with other roles

IEC 62443-2-4 sits between the asset owner and the product supplier. The provider may use product information, system requirements, and asset-owner policies, but the service-provider requirement set remains about the provider's processes.

• It does not replace IEC 62443-2-1 for the asset owner's IACS security programme.
• It does not replace IEC 62443-3-2 for system risk assessment, zones, conduits, SL-T, and documented requirements.
• It does not replace IEC 62443-3-3 for control system security requirements.
• It does not replace IEC 62443-4-1 or IEC 62443-4-2 for product supplier lifecycle and component capability claims.

Evidence and certificate scope

A useful 2-4 evidence set names the service, the asset owner interface, the Automation Solution boundary, the applicable profile, the edition used, and the activities performed. ISASecure ACSSA material treats suitable 2-4 certification as evidence that can contribute to an IACS evaluation, but additional evidence may still be needed for the IACS under evaluation.