What is IEC 62443-3-2?
IEC 62443-3-2 is the international standard in the IEC 62443 series that describes how you use a cyber risk assessment to partition an industrial automation and control system (IACS) into zones and conduits and set the required target security level (SL-T) for each zone and conduit. Its official title is Security risk assessment for system design; edition 1.0 was published on 24 June 2020, alongside the American version ANSI/ISA-62443-3-2-2020. The standard forms the bridge between risk assessment and the technical security requirements of IEC 62443-3-3: first you decide what needs protecting and how strongly, then you choose the measures.
IEC 62443-3-2 answers the question “which security level does this zone need, and why?”, with a rationale that the asset owner formally approves.
🧠 What exactly does IEC 62443-3-2 cover?
The standard sets out the steps an asset owner, together with the integrator and suppliers, follows to design an OT installation securely. According to the IEC abstract, it delivers five results:
- Scoping - defining the System under Consideration (SuC), including its boundaries and access points
- Partitioning - dividing the SuC into zones and conduits in line with the zones and conduits model
- Risk assessment - assessing the Cybersecurity risk for each zone and conduit
- Target level - setting a target security level (SL-T) for each zone and conduit
- Documentation - recording the resulting security requirements
The standard is performance-based: it states what you must do, not which risk method you must use. Your own risk matrix, a HAZOP-style cyber risk assessment or an approach based on ISO 27005 are all acceptable, provided the steps and results are traceable.
🔁 What are the seven steps (ZCRs) of IEC 62443-3-2?
The workflow consists of seven Zone and Conduit Requirements (ZCRs):
| ZCR | Step | Output |
|---|---|---|
| ZCR 1 | Identify the System under Consideration | Boundary, access points and asset inventory |
| ZCR 2 | Perform an initial risk assessment | Worst-case consequences if the system is compromised |
| ZCR 3 | Partition the SuC into zones and conduits | Initial zone and conduit diagram |
| ZCR 4 | Compare the initial risk with the tolerable risk | Decision on whether a detailed assessment is needed |
| ZCR 5 | Perform a detailed risk assessment | Residual risk and SL-T per zone and conduit |
| ZCR 6 | Document requirements, assumptions and constraints | Cyber Security Requirements Specification (CSRS) |
| ZCR 7 | Obtain asset owner approval | Formal acceptance |
Under ZCR 3 the standard prescribes fixed separations. Business assets are kept apart from IACS assets (ZCR 3.2), safety-related systems such as an SIS get their own zone (ZCR 3.3), and temporarily connected devices (ZCR 3.4), wireless devices (ZCR 3.5) and devices connected via external networks (ZCR 3.6) are separated as well. These rules make a flat network virtually impossible.
🔍 How does the detailed risk assessment in ZCR 5 work?
ZCR 5 is the heart of the standard and consists of thirteen sub-steps. In summary:
- Identify threats - who could attack the zone, and how? Threat modelling and MITRE ATT&CK for ICS make this concrete.
- Identify vulnerabilities - outdated operating systems, insecure protocols, shared passwords.
- Determine consequences and impact - for safety, the environment, production and reputation; a business impact analysis or HAZOP provides the process consequences.
- Determine unmitigated likelihood and risk - without taking existing controls into account.
- Determine the SL-T - which security level is needed to bring the risk down?
- Take existing countermeasures into account - firewalls, access management, procedures.
- Compare residual risk with tolerable risk - and, where needed, select additional mitigating measures.
- Document and communicate the results - for example in a risk register.
The asset owner sets the tolerable risk, usually through the company’s own risk matrix. As a result, the OT assessment lines up with the way safety and business risk are weighed elsewhere in the organisation.
🎯 How does a risk translate into a security level?
The SL-T describes which type of attacker a zone must withstand. The levels come from IEC 62443-3-3:
| Level | Protection against | Typical zone (illustrative) |
|---|---|---|
| SL 1 | Casual or coincidental violation | Monitoring zone without control functions |
| SL 2 | Intentional attack using simple means, low resources and generic skills | SCADA and HMI zone in an ordinary factory |
| SL 3 | Intentional attack using sophisticated means, moderate resources and IACS-specific skills | Control zone with PLCs and RTUs in critical infrastructure |
| SL 4 | Intentional attack using sophisticated means, extended resources, IACS-specific skills and high motivation | Highly critical systems, for example against state actors |
Explanatory material also uses SL 0: no specific requirements. Formally, the SL-T is a vector of seven values, one per foundational requirement from IEC 62443-1-1, so a zone can, for instance, receive a high level for integrity and a lower level for confidentiality. After construction you verify that the achieved level (SL-A) is at least equal to the SL-T, using components whose capability (SL-C) has been demonstrated against IEC 62443-4-2.
🏭 What does zoning look like in practice?
A simplified example for a production site:
| Zone | Components | SL-T (illustrative) | Example controls |
|---|---|---|---|
| Engineering zone | Engineering Station, project server | SL 2 | Access Control, patch management |
| Control zone | PLC, RTU, IO modules | SL 3 | Protocol Filtering, Firewall |
| Safety zone | SIS, safety PLC | SL 3 | Own zone under ZCR 3.3, no write access from outside |
| IDMZ | Remote Access, reporting systems | SL 3 | Jump Server, MFA, Monitoring |
| Supplier access | Remote maintenance connection | SL 2–3 | Own zone under ZCR 3.6, time-limited access |
The SL values are not values from the standard: they follow from your own risk assessment. The zoning often follows the levels of the Purdue Model, but risk determines the boundaries, not the model.
That is also the main benefit of the approach: you focus security on the zones with the highest risk and avoid over-engineering elsewhere. A substantiated SL-T per zone also gives IT, OT and management a common language for decisions on investment and residual risk.
🧭 How do you apply IEC 62443-3-2 step by step?
- Ensure an up-to-date asset inventory and network drawing - without that foundation, ZCR 1 cannot be carried out.
- Define the tolerable risk - record the risk matrix and acceptance criteria, in line with the security programme from IEC 62443-2-1.
- Organise a multidisciplinary session - process safety, OT engineering, IT security and operations together; reuse the HAZOP scenarios.
- Draw zones and conduits - apply the ZCR 3 separations and give every zone a responsible owner.
- Assess every zone and conduit - following the ZCR 5 sub-steps, and record the SL-T.
- Write the CSRS - with zone and conduit drawings, characteristics per zone (ZCR 6.3 and 6.4), assumptions about the environment, the threat landscape and legal requirements.
- Have the asset owner sign off - ZCR 7 makes the choices explicit and auditable.
- Repeat the assessment - after major changes, new threats or incidents.
Integrators and suppliers then use the CSRS as a specification; IEC 62443-2-4 describes the capabilities such a service provider must have.
🔐 How does IEC 62443-3-2 relate to other standards and legislation?
| Standard or framework | Relationship with IEC 62443-3-2 |
|---|---|
| IEC 62443-2-1 | The asset owner’s security programme (CSMS); provides risk policy and acceptance criteria |
| IEC 62443-3-3 | Technical system requirements per security level; implements the SL-T |
| IEC 62443-2-4 | Requirements for integrators and service providers carrying out the design |
| IEC 61511 | Has required a security risk assessment of the SIS since the 2016 edition; 3-2 provides the method |
| Cybersecurity Act | The Dutch NIS2 law: since 15 August 2026 a duty of care including risk analysis and risk acceptance criteria |
| ISO 27001 and NIST CSF | Organisation-wide frameworks; 3-2 makes the OT part concrete |
For organisations covered by NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet), a documented assessment according to IEC 62443-3-2 is a strong way to demonstrate the duty of care for OT and to support compliance. The standard is not legally mandatory, but it is increasingly requested in tenders and audits. The ISASecure ACSSA programme assesses an asset owner’s security programme against this standard, among others.
❓ Frequently asked questions
Is IEC 62443-3-2 mandatory?
IEC 62443-3-2 is a voluntary international standard and is not legally mandatory in itself. However, the Dutch Cybersecurity Act and NIS2 require a risk analysis and appropriate measures, and IEC 62443-3-2 is the internationally recognised, OT-specific method to demonstrate this. Clients also frequently include the standard in tender specifications.
Who performs a risk assessment according to IEC 62443-3-2?
The asset owner, the organisation that owns and operates the installation, is ultimately responsible for a risk assessment according to IEC 62443-3-2 and approves the result in ZCR 7. The work is usually done together with the system integrator, process safety experts and OT security. Suppliers provide information on the capability of their components.
What is the difference between IEC 62443-3-2 and IEC 62443-3-3?
IEC 62443-3-2 describes how you use a risk assessment to partition a system into zones and conduits and determine the required security level (SL-T) for each zone. IEC 62443-3-3 describes which technical system requirements belong to each security level. The two standards are therefore almost always used together.
What is a CSRS?
A Cyber Security Requirements Specification (CSRS) is the end product of ZCR 6 in IEC 62443-3-2. The CSRS contains, among other things, the system description, zone and conduit drawings, the characteristics and SL-T of each zone and conduit, assumptions about the environment, the threat landscape and the tolerable risk. Integrators use the document as the basis for design and specification.
Can IEC 62443-3-2 be used for existing installations?
IEC 62443-3-2 was written for system design, but in practice it is also widely applied to existing installations. The assessment then shows where the achieved security level falls short of the target. On that basis you plan segmentation and compensating countermeasures, often in phases.
How often should an IEC 62443-3-2 assessment be repeated?
IEC 62443-3-2 expects the risk assessment to be kept up to date, but does not prescribe a fixed interval. Common practice is to repeat it after major changes to the installation, when new threats or vulnerabilities emerge, after incidents, and periodically as well, for example every one to three years.
📌 In summary
IEC 62443-3-2 is the method you use to partition an OT installation into zones and conduits through a risk assessment and to set the required security level for each zone and conduit. Through seven ZCRs, from scoping to approval by the asset owner, the standard produces a substantiated CSRS that steers the technical requirements of IEC 62443-3-3 and makes the duty of care under NIS2 and the Dutch Cybersecurity Act concrete for OT.