IEC 62443 is a series of international standards for the cybersecurity of industrial automation and control systems (IACS). It is developed by the ISA99 committee and IEC Technical Committee 65, and it is widely used across energy, process industries, manufacturing, transportation and water.
Unlike many IT security frameworks, IEC 62443 is written with industrial realities in mind: long equipment lifecycles, safety and availability priorities, and the shared responsibilities of asset owners, system integrators and product suppliers. This article explains its purpose, structure and key concepts. It summarizes ideas from the series; it does not replace the standards themselves, which should be obtained under license.
What IEC 62443 is for
The series aims to give everyone involved in an industrial system a common way to define, build, operate and evaluate its security. It answers questions such as:
- What security program should an operator of industrial systems have?
- How should a system be divided into parts with different security needs?
- How much protection does each part need, given the risk?
- What security capabilities should products and systems provide?
- What should service providers such as integrators and maintenance contractors do?
Its industrial context
IEC 62443 addresses the automation and control system as a whole — the people, processes and technology involved in operating an industrial process. That context drives several features of the series:
- Safety, availability and integrity usually come before confidentiality.
- Systems are long-lived, so requirements must work for existing installations as well as new projects.
- Responsibility is shared. A secure outcome depends on product suppliers building secure components, integrators designing secure systems and asset owners operating them securely.
How the series is organized
The documents are grouped into four categories. The parts most often referenced are:
| Group | Focus | Commonly used parts |
|---|---|---|
| 1 — General | Terminology, concepts and models | IEC 62443-1-1 (concepts and models) |
| 2 — Policies and procedures | The security program and operations | IEC 62443-2-1 (security program requirements for asset owners), IEC 62443-2-3 (patch management), IEC 62443-2-4 (requirements for service providers) |
| 3 — System | Requirements for the integrated system | IEC 62443-3-2 (risk assessment for system design), IEC 62443-3-3 (system security requirements and security levels) |
| 4 — Component | Requirements for products | IEC 62443-4-1 (secure product development lifecycle), IEC 62443-4-2 (technical requirements for components) |
Parts are revised over time, so check the current edition of any part you rely on.
Organizational and technical aspects
IEC 62443 covers both sides of security:
- Organizational — governance, roles, policies, training, supplier management, incident handling and the overall security management system. IEC 62443-2-1 is the main reference for asset owners here, and IEC 62443-2-4 for service providers.
- Technical — the security capabilities a system or component provides. IEC 62443-3-3 and IEC 62443-4-2 express these as requirements grouped under seven foundational requirements:
- Identification and authentication control
- Use control
- System integrity
- Data confidentiality
- Restricted data flow
- Timely response to events
- Resource availability
These seven headings are a useful checklist even outside a formal 62443 program.
Scope and applicability matter
No organization implements every part of the series. The first step is deciding which parts apply to your role and which systems are in scope:
- An asset owner typically focuses on IEC 62443-2-1, 3-2 and 3-3, and uses 2-4 when contracting service providers.
- An integrator focuses on 2-4 and 3-3.
- A product supplier focuses on 4-1 and 4-2.
IEC 62443-3-2 introduces the idea of the system under consideration — a clearly bounded set of assets that the risk assessment and requirements apply to. Defining it precisely avoids vague "plant-wide" scopes that cannot be assessed.
Zones and conduits
Zones and conduits are among the most practical ideas in the series.
- A zone is a grouping of assets that share common security requirements — for example, a safety system, a basic process control network or a DMZ.
- A conduit is a grouping of communication channels that connect zones and share common security requirements.
Partitioning a system into zones and conduits makes the architecture explicit. It shows where boundaries should be enforced, which communications must cross them and where the strongest controls are needed. It is also the basis for setting security levels.
Security levels and risk-based requirements
IEC 62443 uses security levels (SL) to express how much protection a zone or conduit needs, based on the capability of the threat it should resist. In summary:
- SL 1 — protection against casual or coincidental violation.
- SL 2 — protection against intentional violation using simple means, low resources and generic skills.
- SL 3 — protection against intentional violation using sophisticated means, moderate resources and IACS-specific skills.
- SL 4 — protection against intentional violation using sophisticated means, extended resources and high motivation.
The series distinguishes the target security level (what risk assessment says is needed), the capability security level (what the components and system can provide) and the achieved security level (what is actually in place). Comparing them reveals gaps.
Target levels come from risk assessment. IEC 62443-3-2 describes a process: define the system under consideration, perform an initial risk assessment, partition into zones and conduits, perform a detailed risk assessment, set target security levels and document the requirements. For a broader view of risk prioritization, see Prioritizing OT cybersecurity risks.
Evidence and improvement planning
IEC 62443 is most useful when it drives action rather than paperwork. A practical approach for asset owners:
- Confirm applicable parts and the system under consideration.
- Document zones and conduits.
- Map applicable requirements to existing controls.
- Identify the evidence that demonstrates each control.
- Record gaps between target and achieved levels.
- Prioritize remediation by risk and operational feasibility.
- Reassess periodically and after significant changes.
A note on certification
Certification schemes based on IEC 62443 exist, notably for products, development processes, systems and service provider capabilities. Certification is performed by accredited certification bodies. Consulting and assessment support can help an organization understand gaps and prepare, but it does not itself confer certification or guarantee compliance.
Key takeaways
- IEC 62443 is a family of standards covering organizations, systems and products.
- Start by deciding which parts apply to your role and system.
- Zones and conduits make the architecture and its boundaries explicit.
- Security levels connect risk to the strength of required controls.
- The value comes from mapping requirements to evidence and acting on the gaps.