Standards and regulations
OT cybersecurity standards: International
Standards that apply across borders and are referenced by most regional regulations. They form the common technical language for industrial cybersecurity.
Key standards and regulations
| Standard | Who it applies to | What it covers | OTVista modules |
|---|---|---|---|
| ISA/IEC 62443Security for industrial automation and control systemsStandard series | Asset owners, integrators and product suppliers | The reference series for OT security: security programs, zones and conduits, risk-based security levels and system and component requirements. | Zones & ConduitsStandards & ComplianceOT Risk Management |
| ISO/IEC 27001 & 27002Information security management systemsStandard | Any organization, often extended to OT | A certifiable management system for information security. Many operators extend their ISMS scope to OT and use IEC 62443 for the technical depth. | Governance & PolicyEvidence & Audit Trail |
| ISO/IEC 27019Information security controls for the energy utility industryStandard | Electricity, gas and heat utilities | Sector-specific guidance that extends ISO/IEC 27002 to process control systems in energy utilities. | Standards & ComplianceGovernance & Policy |
| IEC 62351Power system communication securityStandard series | Utilities and grid equipment suppliers | Security for power system protocols such as IEC 61850, IEC 60870-5 and DNP3, including authentication and key management. | Zones & ConduitsAsset Visibility |
| IEC 61511Functional safety of safety instrumented systemsStandard | Process industries | Requires a security risk assessment for safety instrumented systems, connecting process safety and cybersecurity. | OT Risk ManagementZones & Conduits |
| ISO 31000Risk management guidelinesGuideline | Any organization | General principles for risk management that OT cyber risk processes often align with. | OT Risk Management |
Summaries are for orientation only and are not legal advice. Applicability depends on your sector, size and jurisdiction, and regulations change. Confirm obligations with the official texts and your legal or compliance advisers. OTVista does not certify compliance.
Other regions
European Union
NIS2, CRA, NCCS, CER, Machinery Regulation, CLC/TS 50701
ViewUnited Kingdom
NIS Regulations 2018, Cyber Security and Resilience Bill, NCSC CAF, HSE OG86, Cyber Essentials
ViewUnited States
NIST CSF 2.0, NIST SP 800-82 Rev. 3, NERC CIP, TSA Security Directives, AWIA 2018, CISA CPGs, DOE C2M2, CMMC 2.0
ViewMiddle East
NCA ECC-2:2024, NCA OTCC-1:2022, NCA CSCC, SACS-002, UAE IA Regulation, Dubai ISR, Qatar NIA
View
From the blog
Insights on International requirements
Preparing for ISA/IEC 62443 or another requirement?
We combine the OTVista Platform with compliance readiness services to get you audit-ready.