IEC 62443 industrial cybersecurity standards
Sytance · Updated
IEC 62443 is a cybersecurity standards series for industrial automation and control systems (IACS). Different parts address the operating organisation, service providers, system design, secure product development and component capabilities.
Industrial control system standards
The series addresses industrial automation and control systems across their lifecycle. It is not only a device standard and not only a network-security baseline. The same site may need records of the asset owner’s security programme, the services provided, the system design and the products supplied.
Roles and scope
A common mistake is to say a product, service, or plant is simply IEC 62443 compliant. A conformity statement needs to identify the role, standard part, edition and assessment scope.
Asset owner
Owns the operating environment, policies, risk decisions, and many site-level controls.
System designer
Defines the system boundary, zones, conduits, requirements, and target security levels.
Product supplier
Provides secure development evidence and component capability evidence for supplied products.
Service provider
Shows capability for integration, maintenance, and related services within a defined profile.
Main parts used in practice
The six parts below are common starting points. Their requirements apply to different responsibilities and stages of the IACS lifecycle.
IEC 62443-2-1
Asset-owner security programme for an IACS in operation.
IEC 62443-2-4
Service-provider capabilities for integration and maintenance.
IEC 62443-3-2
System risk assessment, zones, conduits, and target security levels.
IEC 62443-3-3
System security requirements and security levels.
IEC 62443-4-1
Secure product development lifecycle for product suppliers.
IEC 62443-4-2
Technical security capability requirements for IACS components.
Zones, conduits, and security levels
System assessment usually starts by defining the system under consideration, its zones and conduits, then assessing the risks. Security levels then express target or achieved capability in a defined scope; they should not be used as a loose product marketing label.
Certification and product law
Certification schemes and product laws use IEC 62443 in different ways. A certificate can show process, component, system, or service capability within its stated scope. Product-law conformity still depends on the law, product, requirement, edition, and recognised standard route.