What is a Security Level?
A Security Level (SL) is the measure from the IEC 62443 series of standards that states which type of attacker a zone, conduit, system or component in an industrial environment must withstand or can withstand, on a scale from SL 1 to SL 4. The level is not defined by technology alone, but by the resources, knowledge and motivation of the attacker you want to protect against. The standard distinguishes three variants: the level that is needed (SL-T), the level a product can reach (SL-C) and the level actually reached in practice (SL-A). This gives asset owners, integrators and suppliers one shared language to agree how much security an OT installation needs and what a product can deliver.
In OT networks, you use security levels to set realistic, risk-based requirements for systems such as PLC, SCADA, HMI and Remote Access applications, without securing everything to the maximum.
🧠 Which four security levels does IEC 62443 define?
The definitions are in IEC 62443-3-3 (systems, 2013 edition) and IEC 62443-4-2 (components, 2019 edition). Each level describes an attacker profile:
| Security Level | Attacker | Resources and knowledge | Motivation |
|---|---|---|---|
| SL 1 | Casual or coincidental violation | No intent to attack, for example an operator error or a wrongly connected laptop | None |
| SL 2 | Intentional attack using simple means | Low resources, generic IT skills, freely available tools | Low |
| SL 3 | Intentional attack using sophisticated means | Moderate resources and knowledge specific to industrial control systems (IACS) | Moderate |
| SL 4 | Intentional attack using sophisticated means and extensive capacity | Extended resources and IACS-specific knowledge, as with state actors | High |
SL 0 is sometimes mentioned as well: no specific requirements or protection needed. There are no requirements for SL 0; the system and component requirements start at SL 1. Each step up means considerably more controls, so a higher level is not automatically better, but it is more expensive and more complex to operate.
🔧 What is the difference between SL-T, SL-C and SL-A?
A security level appears in three forms. Mixing them up leads to confusing specifications and disputes with suppliers.
| Type | Meaning | Who determines it? | Standard |
|---|---|---|---|
| SL-T (target) | The level a zone or conduit needs | Asset owner, through a risk assessment | IEC 62443-3-2 |
| SL-C (capability) | The level a system or component can technically reach, provided it is installed and configured correctly | Supplier, possibly backed by certification | IEC 62443-3-3 and IEC 62443-4-2 |
| SL-A (achieved) | The level actually reached in practice | Verification of the delivered installation | Audit, configuration review, penetration test |
The goal is always the same: SL-A must be at least equal to SL-T. A component with a lower SL-C need not be a problem, as long as compensating countermeasures in the zone, such as a firewall or additional logging, close the gap.
A security level is also not a single number but a vector with one value per foundational requirement (FR) from IEC 62443-1-1, in the order IAC, UC, SI, DC, RDF, TRE, RA:
| FR | Abbreviation | Security theme | Example in OT |
|---|---|---|---|
| FR 1 | IAC | Identification and authentication control | Unique accounts on an HMI, access management for engineers |
| FR 2 | UC | Use control: what an authenticated user may do | An operator may operate the process but not change PLC logic |
| FR 3 | SI | System integrity | Signed firmware, detection of unauthorised changes |
| FR 4 | DC | Data confidentiality | Encrypted connections for recipes or remote access |
| FR 5 | RDF | Restricted data flow | Segmentation, firewalls and conduits between zones |
| FR 6 | TRE | Timely response to events | Logging, monitoring and retention of audit data |
| FR 7 | RA | Resource availability | Protection against DoS, backup and recovery |
A control zone might, for example, get SL-T = {2 2 2 1 3 2 3}: strict on restricted data flow and availability, lighter on confidentiality. That suits OT, where availability usually weighs more heavily than secrecy. In conversations and risk matrices the vector is often summarised as a single number such as “SL 2”, but in a tender specification or design the full vector is more precise.
Do not confuse security levels with the maturity levels (ML 1 to 4) in IEC 62443-4-1 and IEC 62443-2-4 either. A maturity level states how mature the processes of a supplier or integrator are; a security level states how resilient a zone, system or component is.
📊 How does a requirement change per security level?
In IEC 62443-3-3, every system requirement (SR) has a base text and often requirement enhancements (RE) that only apply from a higher level. Two examples show how this builds up:
| Level | SR 1.1 Human user authentication | SR 5.1 Network segmentation |
|---|---|---|
| SL 1 | Users are identified and authenticated | The control network is logically separated from other networks |
| SL 2 | Plus: every user is uniquely identifiable | Plus: physical segmentation of the control network |
| SL 3 | Plus: MFA for access via untrusted networks | Plus: independence from non-control system networks |
| SL 4 | Plus: MFA for all networks | Plus: logical and physical isolation of critical networks |
This makes an abstract level concrete: if you choose SL 3 for the zone with remote access, it follows, among other things, that everyone logging in from outside needs multi-factor authentication.
🏭 How do you determine the right security level step by step?
IEC 62443-3-2 (edition 1.0, June 2020) describes the method. In practice the approach looks like this:
- Define the system under consideration - inventory the assets, functions and connections of the system to be protected.
- Partition into zones and conduits - group systems with similar requirements in line with the zones and conduits model, and separate, for example, safety instrumented systems and office IT.
- Assess the risk per zone - in the detailed step (ZCR 5) you weigh threats, vulnerabilities and consequences for safety, the environment and production. Many companies do this as a cyber PHA in HAZOP style, sometimes supplemented by a LOPA-like review of the protection layers already in place.
- Record the SL-T vector per zone and conduit. SL 2 is a common starting point; SL 3 is usual for critical zones and remote access.
- Select systems and components whose SL-C fits, or plan compensating countermeasures.
- Verify the SL-A after commissioning and repeat this after major changes, new threats or incidents.
Typical outcomes of such an analysis are indicative, not prescribed by the standard:
| Zone | Example systems | Typical SL-T | Key controls |
|---|---|---|---|
| Office link / DMZ | Historian, MES interface | SL 2 | Firewall, patch management, Logging |
| Supervision | SCADA servers, HMI | SL 2–3 | access control, auditing, hardening, high availability |
| Engineering | Engineering Station | SL 3 | MFA, strong authorisation, encryption |
| Control | PLC, I/O | SL 2–3 | Segmentation, protocol filtering |
| Remote access | VPN, Jump Server | SL 3 | MFA, session logging, time-limited access |
The level is therefore assigned per zone and conduit, not per individual PLC. All components in a zone inherit the requirement of that zone.
🔍 What is the difference between a Security Level and a SIL?
Security levels are often compared with the Safety Integrity Level from functional safety. Both run from 1 to 4, but they measure different things:
| Characteristic | Security Level (SL) | Safety Integrity Level (SIL) |
|---|---|---|
| Goal | Resistance to intentional cyberattacks | Reliability of safety functions |
| Standard | IEC 62443 | IEC 61508, IEC 61511 |
| Threat | Intelligent attacker who adapts | Random hardware failures and systematic faults |
| Justification | Qualitative, through requirements per level | Quantitative, through failure probabilities (PFDavg or PFH) |
| Higher level | Withstands a stronger attacker | Lower probability of failure on demand |
The two do meet: since its 2016 edition, IEC 61511 has required a security risk assessment of the safety instrumented system. A SIL calculation is of little value if an attacker can reprogram the safety PLC.
🔐 Where do you encounter security levels in procurement and regulation?
- Procurement - in tender specifications you ask for an SL-C per FR, preferably demonstrated with an ISASecure certificate: CSA for components against IEC 62443-4-2 and SSA for systems against IEC 62443-3-3, both at capability security level 1 to 4. IEC 62443-4-2 distinguishes four component types (software application, embedded device, host device and network device), and a CSA certificate states the type and the level. An SSA certificate lists the certified level for each zone of the system. See also supplier security.
- Integration - IEC 62443-2-4 sets out which security capabilities an integrator must provide when delivering an installation.
- Process industry - NAMUR recommendation NE 177 for the NAMUR Open Architecture defines, based on IEC 62443-3-3, two protection profiles (NOA BASIC and NOA EXTENDED) that achieve different security levels. They apply to the core process control system and to the NOA Security Gateway that passes data to monitoring and optimisation systems.
- European rules - the Cyber Resilience Act and the Machinery Regulation do not mention security levels, but the OT standards being developed under the CRA build on IEC 62443.
- The Netherlands - the Dutch Cybersecurity Act (Cyberbeveiligingswet) does not prescribe a security level, but a justified SL-T per zone helps you show that your measures are appropriate within risk management and compliance.
A security level is therefore a product property (SL-C), a design goal (SL-T) and a measured result (SL-A) at the same time. Only together do they give a reliable picture.
🧮 Which security level fits your threat?
Describe the attacker a zone must withstand. The selector gives the indicative SL-T according to the IEC 62443 definitions.
❓ Frequently asked questions
Which security level is common for an OT installation?
For most zones in an OT installation, SL 2 is a common starting point, because it protects against intentional attacks using simple means. Zones with remote access, engineering functions or critical processes often get SL 3. SL 4 is mainly intended for critical infrastructure that has to account for state actors.
Is a security level the same as a product’s SL certificate?
No, a product certificate only states the SL-C: the security level a component or system can technically reach. Whether an installation actually reaches that level (SL-A) depends on configuration, placement in the right zone and ongoing management. The required SL-T follows from the asset owner’s risk assessment.
Why is a security level a vector?
A security level in IEC 62443 consists of seven values, one per foundational requirement, such as authentication, data flow and availability. This allows a zone to be strict on availability and segmentation and lighter on confidentiality. That matches the real risk better than a single number.
May a component have a lower security level than its zone?
A component with a lower SL-C than the zone’s SL-T is acceptable if compensating countermeasures cover the difference. Think of a firewall in front of a PLC without encryption, or central logging for a device with limited logging functions. The achieved security level of the zone must then still be demonstrated.
What do SL, SL-T, SL-C and SL-A stand for?
SL is the abbreviation of Security Level, the protection level defined in IEC 62443. SL-T is the target security level a zone or conduit needs, SL-C the capability security level a system or component can reach, and SL-A the achieved security level actually reached after commissioning. Where SL 0 is mentioned, it means that no specific security requirements apply; the requirements of the standard start at SL 1.
Is a higher security level always better?
A higher security level protects against stronger attackers, but it also demands more controls, management effort and budget. Overly strict requirements can even affect the availability or operability of an installation. That is why IEC 62443 ties the security level to a risk assessment per zone.
📌 In summary
A Security Level from IEC 62443 describes, on a scale from 1 to 4, which attacker a zone, system or component must withstand. With the distinction between SL-T, SL-C and SL-A, the vector per foundational requirement and a risk assessment per zone and conduit, you make OT security measurable, procurable and proportionate.