IEC 62443

What is IEC 62443?

IEC 62443 is the international series of standards for the cybersecurity of industrial automation and control systems (IACS), setting requirements for asset owners, service providers and product suppliers across the entire lifecycle of an installation. The series targets environments where Operational Technology (OT) controls the physical world, such as factories, power plants, water treatment and other critical infrastructure. Where ISO 27001 describes a management system for information security, IEC 62443 also covers the technical properties of systems and components such as PLCs, RTUs and HMIs.

The standard is developed jointly by ISA (International Society of Automation) and the IEC (International Electrotechnical Commission). That is why it is often called ISA/IEC 62443; its older name is ISA-99.

🕰️ How did IEC 62443 grow out of ISA-99?

In 2002 ISA set up the ISA99 committee to protect industrial control systems against cyberattacks. Its first result was ANSI/ISA-99.00.01-2007, approved in October 2007, covering terminology, concepts and models.

Around 2010 the numbering was changed to ANSI/ISA-62443 to align with IEC numbering. Since then ISA99 and IEC TC65 WG10 have worked on the same texts: ISA publishes them in the US and the IEC internationally, with identical technical content. In November 2021 the IEC designated the series a horizontal standard: a base standard that applies to every sector, not just the process industry. In Europe much of the series has been adopted as EN IEC 62443; in the Netherlands it is available through NEN.

📚 Which parts make up IEC 62443?

The series is divided into four groups. Each part is an International Standard (IS), a Technical Specification (TS) or a Technical Report (TR).

Group 1 lays the foundations, group 2 covers policies and processes, group 3 the system and group 4 individual products.

🧱 Who is IEC 62443 for?

IEC 62443 spreads responsibility across three roles. That is an important difference from standards that only look at the user organisation.

• Asset owner — the owner and operator of the installation, such as a factory, water authority or grid operator. This party is ultimately accountable, performs the risk assessment and sets up a security programme in line with 2-1.
• Service provider — the integrator that designs and builds the system, and the party that maintains it. Requirements are in 2-4, for example on remote access, backup and patching.
• Product supplier — the manufacturer of components and systems such as PLCs, DCSs and SCADA software. This party follows 4-1 for its development process and 4-2 or 3-3 for technical capabilities.

In-house administrators and IT/OT teams formally fall under the asset owner. They are the ones who run the security programme day to day.

🧠 What are the core concepts of IEC 62443?

Zones and conduits

A zone is a group of assets with the same security requirements; a conduit is the controlled connection between zones. The zones and conduits model is the basis for segmentation and fits alongside the Purdue Model. Every zone and conduit gets its own security target.

Security levels

A security level (SL) expresses the type of attacker a zone or component can withstand:

The standard uses three variants: SL-T (target, the goal from the risk assessment), SL-C (capability, what a product can deliver) and SL-A (achieved, what is actually reached in operation). The aim is for SL-A to be at least equal to SL-T.

Seven foundational requirements

All technical requirements are grouped under seven foundational requirements: identification and authentication control (FR 1), use control (FR 2), system integrity (FR 3), data confidentiality (FR 4), restricted data flow (FR 5), timely response to events (FR 6) and resource availability (FR 7). Part 3-3 expands these into 51 system requirements, with requirement enhancements per security level.

Maturity levels

For processes the series uses four maturity levels: 1 Initial (ad hoc), 2 Managed (following documented guidelines), 3 Defined (repeatable across the organisation) and 4 Improving (driven by process metrics). Security levels therefore concern technology, while maturity levels concern processes.

Around these sit principles such as Defense in Depth, several layers of security in succession, and Security by Design, building security in from the design stage.

🔄 How does IEC 62443 relate to NIS2, the CRA and the Machinery Regulation?

IEC 62443 is not a law in itself. It is, however, increasingly the technical translation of legal requirements, and asset owners include it in purchasing conditions as part of supplier security and compliance.

🏅 How can you get IEC 62443 conformity certified?

• ISASecure — the programme of the ISA Security Compliance Institute (ISCI), founded in 2007 and issuing certifications since 2010. Its schemes include SDLA (development process, 4-1), CSA (components, 4-2), SSA (systems, 3-3), ICSA (IIoT components) and ACSSA (an asset owner’s OT security programme).
• IECEE — the IEC’s own conformity assessment system. Through its Industrial Cyber Security Programme, affiliated certification bodies and test laboratories certify against parts including 2-4, 4-1 and 4-2.

A certificate applies to a product, process or organisation, never automatically to your whole installation. The level finally reached (SL-A) depends on how you deploy and configure the components.

🧭 How do you apply IEC 62443 step by step as an asset owner?

1. Take inventory — map all OT assets, connections and suppliers.
2. Assess the risk — carry out a risk assessment according to 3-2 and determine the consequences for safety, the environment and production.
3. Define zones and conduits — group assets and set an SL-T for each zone and conduit. Part 3-2 requires safety-related assets, such as a safety instrumented system under IEC 61511, to be placed in a zone of their own.
4. Compare against 3-3 — check per zone which system requirements are missing and select measures such as network segmentation, least privilege and logging.
5. Set supplier requirements — ask integrators for 2-4 and require 4-1/4-2 or ISASecure certificates for products.
6. Establish the security programme — define policy, roles, patch management and incident response in line with 2-1.
7. Measure and improve — periodically check whether SL-A still meets the target and repeat the risk assessment whenever the installation changes.

In practice SL 2 is a common baseline for production zones, with SL 3 for critical or safety-related zones. The standard does not prescribe this; the SL-T always follows from your own risk assessment.

❓ Frequently asked questions

Is IEC 62443 mandatory?

IEC 62443 as a standard is not legally mandatory. Laws such as NIS2, the Dutch Cyberbeveiligingswet, the Cyber Resilience Act and the Machinery Regulation do require appropriate cybersecurity measures, and IEC 62443 is the most widely used way to demonstrate them for OT. In addition, more and more clients require IEC 62443 contractually.

What is the difference between ISA-99 and IEC 62443?

ISA-99 is the original name of the standards series developed by the ISA99 committee since 2002. Around 2010 the numbering changed to ISA-62443 so that the series runs in parallel with IEC 62443. In substance they are the same standards, maintained jointly by ISA and the IEC.

What is the difference between IEC 62443 and ISO 27001?

ISO 27001 describes an information security management system for any organisation, in which the confidentiality of information traditionally carries great weight. IEC 62443 focuses specifically on industrial automation and control systems, where availability and safety come first, and also contains technical requirements for systems and components. Many organisations combine the two.

Which security level does my installation need?

The required security level (SL-T) follows from a risk assessment according to IEC 62443-3-2 and is set per zone and conduit, not for the installation as a whole. A zone containing a safety system often gets a higher level than an office-like monitoring zone. SL 2 and SL 3 are the most commonly chosen targets in industry.

Which part of IEC 62443 should I start with?

As an asset owner you usually start with IEC 62443-3-2 for the risk assessment and zoning, and with 2-1 for the security programme. An integrator starts with IEC 62443-2-4, a product supplier with 4-1 and 4-2. Part 1-1 is useful for learning the terminology.

Can a product be IEC 62443 certified?

A product can be certified against IEC 62443-4-2 (components) or 3-3 (systems), for example through ISASecure CSA or SSA or through the IECEE scheme. The certificate states the security level the product is capable of (SL-C). Whether your installation actually reaches that level depends on how it is configured and managed.

📌 In summary

IEC 62443 is the international standard for OT security: one coherent series that gives asset owners, service providers and product suppliers each a distinct set of requirements. With zones and conduits, security levels SL 1–4, seven foundational requirements and four maturity levels, the series turns risks into concrete measures. Having grown from its ISA-99 origins into a horizontal IEC standard, IEC 62443 is now the technical foundation organisations and manufacturers use to meet NIS2, the Cyber Resilience Act and the Machinery Regulation.