Iec 62443 · Controls/Automation · 4 min read

IEC 62443 — Industrial Automation and Control Systems (IACS) Security

IEC 62443 — Industrial Automation and Control Systems (IACS) Security

Issuing body: IEC Technical Committee 65 / Working Group 10 (with ISA as the U.S. mirror — documents are published jointly as ISA/IEC 62443). Jurisdiction: International — voluntary standard; increasingly invoked by contract, sector regulation, and (critically) as the technical basis for EU Cyber Resilience Act conformity.

1. What it is

IEC 62443 is the reference security framework for industrial automation and control systems — PLCs, DCS, SCADA, SIS, HMIs, and the networks around them. It assigns security responsibilities across the lifecycle to four roles (asset owner, system integrator, product supplier, service provider) and defines Security Levels (SL) — SL 0 (no protection) through SL 4 (protection against sophisticated, well-resourced attackers) — in three flavors: target (SL-T, what the risk assessment says is needed), achieved (SL-A, what the system actually delivers), and capability (SL-C, what a component can provide). The series is the OT counterpart to ISO/IEC 27001, but unlike 27001 it reaches into product engineering and system architecture.

2. Scope, triggers, thresholds

The series is organized in four groups:

  • General (62443-1-x): concepts and models (1-1), master glossary (1-2), security lifecycle (1-4), security-profile scheme (TS 1-5).
  • Policies & Procedures (62443-2-x): asset-owner security program (2-1), patch management (2-3), service-provider requirements (2-4), implementation guidance (2-5), and the new ISA-TR 62443-2-2 (2025) on building a Security Protection Scheme.
  • System (62443-3-x): risk assessment and zones/conduits design (3-2), system security requirements and SLs (3-3).
  • Component (62443-4-x): secure product development lifecycle (4-1), technical security requirements for components (4-2), plus the new evaluation guidance category (TS 6-1/6-2).
  • Zones and conduits (3-2) are the signature architectural concept: partition the plant into zones of common security requirements, connect them via controlled conduits — the OT-native alternative to flat networks.
  • Trigger: customer/owner specification, sector regulation, or CRA conformity strategy for industrial products with digital elements.

3. Key requirements and compliance obligations

  1. Risk assessment (3-2): identify the system under consideration, partition into zones/conduits, assess threats and consequences, and derive the target SL per zone.
  2. System requirements (3-3): seven foundational requirements — identification/authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability — each with requirement enhancements graded SL 1–4.
  3. Component requirements (4-2): technical requirements for four component types (software application, embedded device, host device, network device), graded by SL-C; application of 4-1 (secure development lifecycle) is mandatory context.
  4. Secure development lifecycle (4-1): eight practices — security management, security-requirements specification, secure design, secure implementation, verification/validation testing, defect management, update delivery, and security guidelines documentation.
  5. Asset-owner program (2-1): the 2024 edition restructured requirements into security-program elements with a maturity model and removed duplication with ISO/IEC 27001.
  6. Certification: ISASecure certification schemes (administered by ISA Security Compliance Institute) certify components (SSA), development lifecycles (SDLA), and systems against 62443 — the closest thing to a "62443 mark."

4. Penalties and consequences

None statutory — 62443 is voluntary. But non-conformance now carries regulatory-adjacent consequences: under the EU Cyber Resilience Act, products with digital elements (including industrial controllers, HMIs, and network devices) must meet essential cybersecurity requirements from December 11, 2027, and EN IEC 62443-4-2 / 3-3 / 4-1 are positioned as the harmonized-route technical basis. Failing to meet the standard can therefore translate into CRA market-surveillance action (fines up to €15M or 2.5% turnover, product withdrawal). Contractually, missing a specified SL is a defect like any other — with warranty and liability exposure.

5. Version status and live changes (verified 2026-09-30)

Current published editions (IEC webstore):

  • 62443-2-1:2024 (asset-owner program — restructured, maturity model added)
  • 62443-2-4:2023 (service-provider requirements)
  • 62443-3-2:2020, 62443-3-3:2013 (system requirements — 3-3 is the oldest core part still current)
  • 62443-4-1:2018, 62443-4-2:2019 (component requirements)
  • ISA-TR62443-2-2:2025 (new — Security Protection Scheme guidance); IEC PAS 62443-2-2:2025
  • TS 62443-6-1:2024 and TS 62443-6-2:2025 (new evaluation-methodology category)
  • Revisions of 3-3 and 4-2 are long discussed in the working groups — [Flag: confirm current draft status before committing a multi-year product program to the 2013/2019 texts; working-group timelines slip.]
  • CRA linkage: CENELEC/industry positioning (e.g., the September 2025 "CRA Standards Unlocked" work) treats EN IEC 62443-4-1, 4-2, and 3-3 as covering CRA Annex I essential cybersecurity requirements for industrial products — the most important strategic fact about 62443 in 2026. If you build OT products for the EU, 62443 conformance is now your CRA conformity strategy.
  • ISA Certified Automation Professional (CAP) (Controls/Automation flagship): ISA's broad automation credential; its domains include system design and safety/security considerations that overlap 62443's system-level thinking.
  • TÜV Rheinland Functional Safety Engineer / CFSE (Controls/Automation flagship): safety-side credentials; note that 62443 explicitly addresses the safety–security interface (security compromises can defeat safety instrumented functions), so safety engineers increasingly need 62443 literacy.
  • CISSP (Computer flagship): for the governance/risk side of OT security programs.
  • No catalogue certification tests 62443 clauses directly; ISASecure component/system certifications certify products, not people.

7. Practical notes

  • Do the 3-2 risk assessment before buying security products: most OT "62443 projects" that skip straight to 4-2 component requirements end up with expensive capabilities at the wrong SL in the wrong zone.
  • For product suppliers: implement 4-1 (lifecycle) before chasing 4-2 (technical requirements) — auditors and ISASecure assessors treat the lifecycle as the foundation, and CRA conformity will demand the same evidence.
  • SL claims must be consistent: a component certified SL-C 2 does not make a zone SL-A 2 — system integration determines achieved SL.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

Next step

Credentials prove you studied. ETS proves the part works.

The Academy maps to the codes your auditors ask about — PPAP, APQP, FMEA, GD&T, ISO 13485 — taught by engineers who have defended designs in production and in court.

Browse the 90-course catalog →October seminar
  • NDA on request
  • Senior engineer replies in one business day
  • Fixed price where applicable
  • Your data stays yours