IEC 62443
Security for Industrial Automation and Control Systems (IACS)
1. Overview of IEC 62443, the International Standard for Industrial Control System Security
flowchart LR
A["IT-centric security<br/>ignores plant safety<br/>and availability"] --"Zones, conduits<br/>and Security Levels"--> B["IEC 62443<br/>OT security<br/>framework"] --"Role-based<br/>requirements"--> C["Secure and resilient<br/>industrial operations"]
style A fill:#FFEBEE,stroke:#D32F2F,color:#000
style B fill:#E3F2FD,stroke:#1976D2,color:#000
style C fill:#E8F5E9,stroke:#388E3C,color:#000
Definition: A series of international standards, developed by ISA99 and IEC TC65, that defines security requirements and processes across the lifecycle of Industrial Automation and Control Systems (IACS).
- Covers three roles: asset owners, system integrators, and product suppliers.
- Applies to manufacturing, energy, water, transportation, and other critical infrastructure.
Characteristics:
- (Availability-first) Prioritizes availability, integrity, and safety of physical processes over confidentiality, reversing the usual IT priority order.
- (Defense in depth) Segments the plant network into zones and conduits and sets a target Security Level for each.
- (Lifecycle and role coverage) Splits requirements across the organization, the system, and the component, so each party in the supply chain has a defined responsibility.
2. Structure and Core Concepts of IEC 62443
A. Four-Part Standard Structure
flowchart TD
subgraph R1[" "]
direction LR
G1["Part 1: General<br/>Terminology, concepts<br/>and metrics"]
G2["Part 2: Policies and Procedures<br/>Security program for<br/>owners and service providers"]
end
subgraph R2[" "]
direction LR
G3["Part 3: System<br/>Risk assessment and<br/>system requirements"]
G4["Part 4: Component<br/>Secure development lifecycle<br/>and product requirements"]
end
style G1 fill:#F5F5F5,stroke:#9E9E9E,color:#000
style G2 fill:#E3F2FD,stroke:#1976D2,color:#000
style G3 fill:#F3E5F5,stroke:#7B1FA2,color:#000
style G4 fill:#FFF3E0,stroke:#F57C00,color:#000
style R1 fill:none,stroke:none
style R2 fill:none,stroke:none
| Part | Key Documents | Primary Audience |
|---|---|---|
| 1. General | 62443-1-1 terminology, concepts, and models | All parties |
| 2. Policies and procedures | 62443-2-1 security program requirements for asset owners, 62443-2-4 requirements for service providers | Asset owners, service providers |
| 3. System | 62443-3-2 security risk assessment and system design, 62443-3-3 system security requirements and Security Levels | System integrators, asset owners |
| 4. Component | 62443-4-1 secure product development lifecycle, 62443-4-2 technical requirements for components | Product suppliers |
B. Zones, Conduits, Security Levels, and Foundational Requirements
flowchart LR
Z1["Zone A<br/>Enterprise network"] -->|"Conduit<br/>firewall, DMZ"| Z2["Zone B<br/>Supervisory control"]
Z2 -->|"Conduit<br/>controlled channel"| Z3["Zone C<br/>Safety instrumented system"]
style Z1 fill:#E3F2FD,stroke:#1976D2,color:#000
style Z2 fill:#FFF3E0,stroke:#F57C00,color:#000
style Z3 fill:#FFEBEE,stroke:#D32F2F,color:#000
| Concept | Description | Practical Meaning |
|---|---|---|
| Zone and conduit | A zone groups assets with common security requirements, and a conduit is the controlled communication path between zones | Basis for network segmentation and risk assessment unit |
| Security Level (SL 1-4) | SL 1 guards against casual violation, SL 2 against simple intentional attacks, SL 3 against sophisticated attacks with ICS-specific skills, SL 4 against well-resourced, highly motivated attackers | Target (SL-T), achieved (SL-A), and capability (SL-C) levels are compared to find gaps |
| Foundational Requirements (FR 1-7) | Identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability | Seven categories used to organize technical controls at every level |
| Maturity levels (ML 1-4) | Initial, Managed, Defined, Improving; used to assess processes in 2-4 and 4-1 | Evidence for service provider and supplier certification |
3. Expected Benefits and Application of IEC 62443
| Category | Key Expected Benefit | Practical Application |
|---|---|---|
| Risk management | Replaces ad hoc OT security with risk-based, zone-by-zone target levels | Run a 62443-3-2 risk assessment, assign SL-T per zone, and track gaps to SL-A |
| Supply chain | Gives owners, integrators, and suppliers a shared, verifiable language for security requirements | Require 62443-4-1 and 4-2 conformance in procurement and contracts |
| Operations | Reduces the chance that security controls disrupt plant safety or availability | Segment networks with conduits, restrict remote access, and apply patching suited to OT |
| Compliance | Supports certification and alignment with regulations such as NIS2 and sector-specific rules | Pursue third-party certification of products, processes, or systems and map controls to NIST CSF and ISO/IEC 27001 |