IEC 62443 zones, conduits and security levels
Sytance · Updated
Zones group assets with similar security requirements; conduits define communication between those zones. Security levels describe the target, built-in capability or achieved protection for a defined system, zone, conduit or component.
System under consideration
IEC 62443-3-2:2020 establishes requirements for defining a system under consideration for an IACS. The boundary decides which assets, interfaces, users, communication paths, operating modes, and assumptions belong in the risk assessment.
The system description should identify the functions being assessed and the assets and interfaces that support them. For a production line, for example, it should explain which controllers, operator stations and external connections are included.
Zones and conduits
IEC 62443-3-2 then partitions the system under consideration into zones and conduits. The grouping should reflect security requirements and the communication that needs protection.
Zone
A grouping of assets inside the system boundary that should share similar security requirements for the analysis.
Conduit
A communication path between zones that needs its own risk treatment and security requirements.
This structure keeps the assessment practical. A safety PLC, engineering workstation, historian, remote-access service, fieldbus, controller network, and enterprise network should not be treated as one flat trust area if their exposure, consequences, or security needs differ.
Security levels
Public IEC material describes IEC 62443-3-2 as establishing target security levels for each zone and conduit. IEC 62443-3-3 then provides detailed control system requirements and capability security levels. A security level is not a general quality score. It is tied to a defined system, zone, conduit, threat environment, and set of requirements.
- define the system under consideration before assigning levels;
- partition the system into zones and conduits;
- assess risk for each zone and conduit;
- establish SL-T for each zone and conduit;
- document the security requirements that follow from the target.
SL-T is the security level target set for a zone, conduit, or control system after risk assessment. It is a design target tied to the specific asset and threat environment.
SL-C describes the security capability of a control system or component. It is useful supplier or system evidence, but it does not automatically decide the target level for a deployment.
SL-A is the level actually achieved in the implemented system. It depends on architecture, configuration, procedures, verification, and operation, not only on purchased products.
Product limit
A product supplier can provide component capability evidence, secure development evidence, and product documentation. That evidence still has to be placed into the deployed architecture. The same component can sit in different zones, connect through different conduits, and face different risk in different installations.
System integrators and asset owners therefore have roles in the assessment. The asset owner usually owns the risk decision for the operating IACS. The integration service provider may design or assist with partitioning, detailed risk assessment, and technical measures. The product supplier usually contributes capability information and product support, not the final system risk conclusion.