IEC 62443 is the international series of standards for securing industrial automation and control systems (IACS) across their lifecycle. For a plant manager it answers three questions: what your own security programme must cover, what you should demand from integrators and service providers, and what security capabilities to require in the products you buy. You do not need to read every part; you need to know which parts apply to whom.
The series is developed by the ISA99 committee and published identically by ISA and the IEC. ISA describes it as a shared-responsibility model across asset owners, product suppliers, integrators and service providers (ISA).
How the IEC 62443 series is organised
| Group | Key parts | Mainly for |
|---|---|---|
| 1. General | 1-1 terminology, concepts and models | Everyone |
| 2. Policies and procedures | 2-1 asset owner security programme; 2-3 patch management; 2-4 service provider requirements | Asset owners, integrators, service providers |
| 3. System | 3-2 risk assessment and zones; 3-3 system security requirements and security levels | Asset owners and integrators |
| 4. Component | 4-1 secure development lifecycle; 4-2 component technical requirements | Product suppliers |
For an operating plant, the parts that matter most are 2-1, which was revised as IEC 62443-2-1:2024, and 3-2, which sets out how to assess risk and partition the system.
Zones, conduits and security levels
IEC 62443-3-2 asks you to define the system under consideration, partition it into zones (groups of assets with similar security needs, such as a packaging line's PLCs and HMIs) and conduits (the communication paths between zones), assess risk for each, and set a target security level (SL-T) for each zone and conduit. Security levels run from 1, protection against casual or accidental misuse, to 4, protection against sophisticated, well-resourced attackers.
- A typical plant has separate zones for the enterprise network, a DMZ, site operations (SCADA, historians), each production area, and safety systems.
- Every conduit has a defined owner, permitted traffic and a control point, usually a firewall.
- The target level drives which technical requirements from 3-3 you need, such as authentication, logging and integrity checks.
7 things you need to know about IEC 62443
Bureau Veritas
This video is hosted on YouTube. Playing it loads content from Google, which may set cookies.
Watch on YouTube
Who is responsible for what
| Role | Responsibilities under IEC 62443 | What to ask for |
|---|---|---|
| Asset owner (you) | Security programme, risk assessment, zones, operation | Board-level ownership and a budget |
| Integrator or service provider | Secure design, configuration, remote access, patching support | Evidence against 2-4 practices |
| Product supplier | Secure development, component capabilities | 4-1 process and 4-2 capability statements, or ISASecure certification |
A first-90-days plan for a plant manager
- Name an owner. One person accountable for OT security, with a link to IT security but not buried in it.
- Build an asset inventory. Every PLC, HMI, drive, switch, PC and remote access route, with firmware versions.
- Map the network. Draw today's zones and conduits, even if the answer is 'one flat network'.
- Close the obvious holes. Remove unmanaged remote access, change default passwords, disable unused services.
- Run a 3-2 style risk assessment on your most critical production area and set target levels.
- Write security into purchasing. New machines and integration contracts must reference IEC 62443 requirements.
- Plan backups and recovery. Tested backups of PLC code and configurations, stored offline.
What to put in contracts with integrators and machine builders
Most OT security weaknesses arrive with new equipment: a modem left in a panel for the builder's support team, default passwords, an unpatched HMI PC. The cheapest place to fix this is the purchase contract. Clauses we would expect to see:
- Reference to IEC 62443-3-3 requirements at an agreed target security level for the machine or system
- No permanent remote access devices; remote support only through the owner's access route
- Default passwords changed and user accounts documented at handover
- A list of all network services, ports and protocols in use, with unused ones disabled
- Operating system and firmware versions declared, with the supplier's patching policy
- Backups of all PLC, HMI and drive configurations delivered with the as-built documents
- For service providers, evidence of practices aligned with IEC 62443-2-4
Check these at FAT, not after installation. A one-page security checklist added to the FAT procedure catches most issues while the supplier is still contractually motivated to fix them. Keep the evidence with the as-built documents, because the next audit or insurance questionnaire will ask for it.
Where regulation is heading
Regulators increasingly point to IEC 62443 as the reference. In the US, CISA's industrial control systems guidance and NIST SP 800-82 Rev. 3, the September 2023 Guide to OT Security, align closely with its concepts. In the EU, NIS2 and the Cyber Resilience Act raise expectations for both operators and machine builders. Using IEC 62443 as your framework is the most efficient way to meet several regimes at once.
How Wartens helps
We design control systems with zoning and secure remote access from the start, and for existing plants we carry out OT asset inventories, network zoning design and gap assessments based on IEC 62443. When we migrate legacy systems, as in our PLC migration checklist, the new network design is part of the scope.
Start with our automation engineering service, read about OPC UA security, or ask for an OT security conversation.
