Security Standards

What are security standards for IT and OT?

Security standards for IT and OT are documented frameworks of requirements and controls that organisations use to demonstrably protect both their information and their industrial control systems; in the Netherlands, ISO 27001, IEC 62443, the BIO and the CSIR are the four frameworks most often used side by side. They partly overlap, but each has its own audience and focus. ISO 27001 governs the management system, IEC 62443 the technology and division of roles in industrial automation, the BIO the mandatory baseline for Dutch government, and the CSIR the translation of both into physical assets such as pumping stations and locks. Together they form the backbone of cybersecurity where IT and OT meet.

🧠 Why do different security standards exist?

Office IT and process automation have different priorities. In IT, confidentiality of data often comes first; in OT, availability, process integrity and physical safety take precedence. A PLC that operates a lock gate cannot simply be restarted to install a patch. That is why dedicated standards for ICS and SCADA emerged alongside the generic ISO standards, together with sector frameworks that bridge both worlds.

• Management system standards - describe how you organise security, with policy, risk assessment, roles and continual improvement
• Technical standards - describe which properties a system or component must have, such as authentication, segmentation and logging
• Baselines - set a mandatory minimum level for a group of organisations, such as government bodies
• Implementation guidelines - translate standards into concrete requirements for a specific type of installation

📋 How do ISO 27001, IEC 62443, BIO and CSIR differ?

🛡️ What does ISO 27001 cover?

ISO/IEC 27001 is the international standard for establishing, implementing, maintaining and improving an Information Security Management System (ISMS). The current edition is ISO/IEC 27001:2022, published in the Netherlands as NEN-EN-ISO/IEC 27001:2023. Annex A lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Examples include risk assessment, access management and authorisation, backup and recovery, and incident management. Guidance for each control is given in ISO 27002.

ISO 27001 protects the confidentiality, integrity and availability of all information (the CIA triad), including information in OT. Its controls are generic, though: the standard has no zones, security levels or requirements for a PLC. A certificate is valid for three years, with annual surveillance audits. Certificates against the 2013 edition have no longer been valid since 31 October 2025.

🔧 What does IEC 62443 add for OT?

IEC 62443 is the series of standards for the security of industrial automation and control systems (IACS), such as PLCs, DCSs, SCADA, sensors and actuators. It is modular, organised in four groups: general, policies and procedures, system and component. It divides responsibilities between three roles: the asset owner, the service provider (integrator and maintenance contractor) and the product supplier.

Its core concepts are the zones and conduits model, five security levels (SL 0 to SL 4) and seven foundational requirements, which IEC 62443-3-3 works out into 51 system requirements. The second edition of IEC 62443-2-1, published in 2024, was deliberately designed to work alongside an ISO 27001 ISMS. Certification covers more than components alone: ISASecure certifies development processes (4-1), components (4-2) and systems (3-3), and service providers can be certified against 2-4 through IECEE. See OT Security Certifications for details.

🏛️ What is the role of the BIO?

The BIO (Baseline Informatiebeveiliging Overheid, the Dutch government information security baseline) is the common framework for information security across central government, provinces, municipalities and water boards. In 2020 it replaced the separate baselines BIR2017 (central government), IBI (provinces), BIWA (water boards) and BIG (municipalities). BIO 1.04 used three baseline security levels (BBN1 to 3) and was based on ISO 27002:2013.

Its successor BIO2, adopted on 23 September 2025, aligns with ISO 27001:2023 and ISO 27002:2022 and drops the BBN levels in favour of risk-based control selection through risk management. Since the Dutch Cybersecurity Act (Cyberbeveiligingswet) entered into force on 15 August 2026, BIO2 has been legally mandatory for government bodies within its scope; for other public bodies it remains binding self-regulation. The BIO explicitly applies to OT as well, and BIO2 allows OT controls to be implemented equivalently using the CSIR and IEC 62443.

🏗️ What is the CSIR for?

The CSIR (Cybersecurity Implementatierichtlijn Objecten, the cybersecurity implementation guideline for physical assets) is a guideline from Rijkswaterstaat and Het Waterschapshuis that combines the BIO and IEC 62443 into one actionable set of controls for assets with industrial automation, such as pumping stations, locks, weirs, bridges and treatment plants. The first version appeared in December 2013; version 3.0 dates from 16 September 2021 and can be used by all partners of the Dutch Water Governance Agreement (Bestuursakkoord Water).

Each asset is given a function box (A to E) and a resistance level (1 to 4) that maps onto the security levels of IEC 62443. The CSIR does not introduce a second management system; instead, it places the OT controls inside the existing ISMS. It is not a law or formal standard, but it becomes binding for contractors and suppliers through contracts. In the Dutch water sector it is the established baseline.

🔄 How do these standards complement each other?

The four frameworks are not competitors but layers in a single stack:

• ISO 27001 as the framework - the ISMS provides policy, the risk process, audits and management review for the whole organisation
• IEC 62443 as the OT layer - zones, conduits and security levels make the generic controls concrete for the process environment
• BIO as the mandatory baseline - public bodies add the mandatory government controls to their Statement of Applicability
• CSIR as the translation to the asset - controls are scaled to the risk of each pumping station or lock

An industrial company usually chooses ISO 27001 plus IEC 62443. A water board combines BIO2 with the CSIR, which in turn draws on IEC 62443. Many organisations also refer to the NIST CSF and NIST SP 800-82 (Revision 3, September 2023), the US NIST guide to OT security.

🧭 How do you choose which standards to apply?

A practical five-step approach:

1. Determine your legal framework - are you in scope of NIS2 and the Dutch Cybersecurity Act, are you a public body, or do you supply products with digital elements under the Cyber Resilience Act (reporting obligations from 11 September 2026, full application from 11 December 2027)?
2. Choose the management system - ISO 27001 for companies, BIO2 for public bodies; both provide an ISMS with risk assessment and a Statement of Applicability.
3. Bring OT into scope - inventory installations and the boundary with IT, for example using the Purdue Model, and group them into zones.
4. Define the OT requirements - use IEC 62443-3-2 and 3-3 for zones and security levels, or the CSIR for public assets, and ask suppliers for 2-4 and 4-1/4-2.
5. Demonstrate compliance - through audits, certification where it adds value, and continual improvement.

❓ Frequently asked questions

Which security standard is mandatory in the Netherlands?

Of the four security standards, only the BIO is legally mandatory, and only for part of the organisations: since 15 August 2026, BIO2 applies through the Dutch Cybersecurity Act to government bodies within its scope. ISO 27001 and IEC 62443 are voluntary, but are widely used to demonstrate compliance with the duty of care under the Cybersecurity Act. The CSIR becomes binding through contracts.

What is the difference between ISO 27001 and IEC 62443?

ISO 27001 describes an information security management system for the whole organisation, with generic controls. IEC 62443 focuses on industrial control systems and describes zones, conduits, security levels and technical requirements for systems and components. In industry, the two standards are usually combined.

Can a company be certified for IEC 62443?

Yes, but an IEC 62443 certificate applies to a defined product, process or part of an organisation, and never automatically to your entire installation. Schemes such as ISASecure and IECEE certify development processes (4-1), components (4-2), systems (3-3) and service providers (2-4), among others. An ISO 27001 certificate, by contrast, covers the scope of an organisation’s ISMS.

Is the BIO the same as ISO 27001?

No, the BIO is based on ISO 27001 and ISO 27002, but adds mandatory government controls that cannot be dropped through risk acceptance. BIO2 also requires public bodies to publish the scope of their ISMS and their Statement of Applicability. An ISO 27001 certificate is not required under the BIO, but it makes accountability easier.

Does a Dutch water board have to follow both the BIO and the CSIR?

A water board within the scope of the Dutch Cybersecurity Act must apply BIO2, including to its pumping stations and treatment plants. The CSIR is the usual way to implement the OT controls equivalently, because it combines the BIO with IEC 62443. Version 3.0 of the CSIR still follows the old BIO numbering, so a mapping table to BIO2 is often needed.

Is ISO 27001 enough for OT security?

ISO 27001 on its own is usually not enough for OT security, because its controls do not include zones, security levels or requirements for control components. The ISMS does provide the organisational framework in which OT risks are managed. That is why industrial organisations supplement ISO 27001 with IEC 62443.

📌 In summary

ISO 27001, IEC 62443, the BIO and the CSIR together form a layered system: ISO 27001 provides the management system, IEC 62443 the OT technology, the BIO the mandatory government baseline and the CSIR the translation to concrete physical assets. If you secure IT and OT together, choose one management system and complete it for the process environment with IEC 62443 or the CSIR, aligned with the Dutch Cybersecurity Act and the Cyber Resilience Act.