IACS

What is IACS?

IACS (Industrial Automation and Control Systems) is the collection of personnel, hardware, software and policies involved in operating an industrial process that can affect or influence its safe, secure and reliable operation. The term comes from the IEC 62443 series of standards and therefore covers more than technology alone: besides PLCs, SCADA, DCS, RTUs and networks, it also includes operators, maintenance procedures and the security policy. Anyone who wants to secure an IACS therefore looks at the whole chain of industrial processes, from sensor to procedure.

🧠 What exactly falls under an IACS?

IEC 62443 deliberately uses a broad definition. An IACS is not just the control software but everything that can affect how the process runs. It includes:

• Control - PLC, DCS, RTU and safety PLCs that drive the process
• Supervision and operation - SCADA, HMI, historians and engineering stations
• Field level - sensors, actuators, drives and field instruments
• Safety systems - a SIS that brings the installation to a safe state when a hazard occurs
• Networks - Industrial Ethernet with protocols such as ProfiNET and Ethernet IP, plus fieldbuses
• People and processes - operators, maintenance technicians, suppliers, change management and policy

What it does not include is the process plant itself (the pumps, reactors and machines, called equipment under control in the standard) and office IT. In the IEC 62443 reference model, which is based on the Purdue Model, the IACS runs from level 0 (physical process and field) up to and including level 3 (site-wide operations, such as MES). The ERP system at level 4 sits outside it and is usually connected through an IDMZ.

🔄 What is the difference between IACS, ICS and OT?

The three terms are often used interchangeably, but they come from different sources and differ in scope.

Up to revision 2, NIST SP 800-82 was a guide to ICS security. Revision 3, published in September 2023, is called Guide to Operational Technology (OT) Security and also covers building automation, transportation and physical access control. In European standards, contracts and certifications you mainly come across IACS, because IEC 62443 is the reference standard there.

🧱 Who is responsible for an IACS?

IEC 62443 divides responsibility across four roles. The series treats IACS cybersecurity as a shared responsibility, but the asset owner remains ultimately accountable for the risk.

The Automation Solution is the concrete realisation of IACS systems and components at one facility, for example the DCS of a specific plant. The IACS is broader: it is that Automation Solution plus the asset owner’s organisation and procedures. IEC 62443-4-2 distinguishes four component types: embedded devices, network components, host components and software applications.

🏭 Where are IACS used?

• Process industry - chemicals, oil and gas, pharmaceuticals and food, often with a DCS and a separate SIS in line with IEC 61511
• Discrete manufacturing - automotive, packaging and machine building, usually PLC-based, a core part of industrial automation
• Utilities - drinking water, wastewater, electricity and gas, with SCADA and RTUs over large distances
• Infrastructure - tunnels, bridges, locks, rail and traffic systems
• Buildings - BMS and HVAC, especially in hospitals and data centres

In continuous and batch plants the IACS is the heart of process automation, where real-time control loops keep temperatures, pressures and flows within limits.

🔐 Why is IACS security different from IT security?

An IACS controls physical processes. A failure can lead to lost production, environmental damage or injury, which is why availability and safety come first. That changes the approach to cybersecurity and OT security:

• Long service life - control systems often run for twenty years or more, so legacy systems with outdated operating systems are common
• Limited patching - patching requires testing and a downtime window, so compensating measures are often needed
• Insecure protocols - many industrial protocols lack authentication or encryption
• Physical impact - attacks such as Stuxnet (discovered in 2010), Industroyer (Ukraine, December 2016) and TRITON (2017, aimed at a safety system) showed that digital attacks have physical consequences

The baseline measures for an IACS are defence in depth, network segmentation based on the zones and conduits model, hardening of systems and tightly controlled remote access. An air gap is still used, but in practice it is rarely complete, because data has to flow out for planning and analysis.

🧭 How do you secure an IACS step by step?

An asset owner starting with IEC 62443 usually follows this order:

1. Define the system boundary - record which installations, networks, people and suppliers fall under the IACS (the system under consideration).
2. Build an inventory - map all assets, firmware versions and connections in an asset inventory.
3. Carry out a risk assessment - following IEC 62443-3-2 or a risk assessment aligned with it.
4. Define zones and conduits - group assets with the same requirements and give each zone a target security level (SL-T); safety systems get their own zone.
5. Select countermeasures - based on the system requirements in IEC 62443-3-3, grouped into seven foundational requirements.
6. Set requirements for suppliers - ask integrators for IEC 62443-2-4 and product suppliers for IEC 62443-4-1 and IEC 62443-4-2.
7. Operate and improve - set up a security programme in line with IEC 62443-2-1, with monitoring, change management and incident response.

🇪🇺 Which laws affect an IACS in the Netherlands and the EU?

IEC 62443 is not a law itself, but in practice it is the common reference for demonstrating that your OT meets these requirements. As a result, the term IACS increasingly appears in tenders and contracts.

📈 What role does an IACS play in IT/OT convergence?

An IACS no longer stands on its own. Process data flows to MES, ERP, the cloud and the Industrial Internet of Things for Smart Industry applications such as predictive maintenance. This OT convergence makes the IACS more valuable but also enlarges its attack surface. A controlled connection through an IDMZ and clear agreements on data flows are therefore part of every modern IACS design.

❓ Frequently asked questions

What does IACS stand for?

IACS stands for Industrial Automation and Control Systems. The term comes from the IEC 62443 series and covers the people, hardware, software and policies that can affect the safe and reliable operation of an industrial process.

Is a PLC an IACS?

A PLC is a component of an IACS, but not the IACS itself. An IACS is the whole of control components, networks, operator stations, safety systems and the procedures and people around them.

Is the ERP system part of the IACS?

No, in the IEC 62443 reference model ERP sits at level 4, outside the IACS. The connection between ERP and the IACS is still an important point of attention and preferably runs through an industrial DMZ.

Which standard governs IACS security?

IEC 62443 is the international series of standards for IACS security, with requirements for asset owners, service providers and product suppliers. NIST SP 800-82 is a widely used complementary guide to OT security.

Who is responsible for securing an IACS?

The asset owner, who owns and operates the installation, is ultimately accountable for securing an IACS. Under IEC 62443, integrators, maintenance providers and product suppliers each carry their own share of that responsibility.

What is the difference between an IACS and an Automation Solution?

An Automation Solution is the concrete installation of control systems and components at one facility. An IACS is broader: it includes that Automation Solution plus the asset owner’s organisation, people and procedures.

📌 In summary

An IACS is the technical and organisational backbone of industrial automation: control, supervision, field equipment, networks, safety systems and the people and procedures that manage them. IEC 62443 gives the term its meaning and divides responsibility between the asset owner, service providers and product suppliers.

An IACS is more than technology: it is the systems, people and procedures that together keep an industrial process running safely and reliably.