What Is IEC 62443?

IEC 62443 is a series of international standards for securing industrial automation and control systems (IACS): the controllers, HMIs, SCADA servers, networks and software that run physical processes. It is developed jointly by the ISA99 committee of the International Society of Automation, which publishes the same documents as ISA/IEC 62443, and by IEC Technical Committee 65. That is why the series is also searched for as ISA 62443 or ISA/IEC 62443.

Unlike IT security frameworks, IEC 62443 is written for systems where availability and safety come first. It is also unusual in splitting responsibility between the three groups involved in a plant: the asset owner who operates it, the system integrator who designs and builds it and the product supplier who makes the components. Each part of the series says what one of them must do.

It is the main reference for OT security programs worldwide, is cited by NIST SP 800-82 and the NCSC Cyber Assessment Framework, and is a reference point for industrial products under the EU Cyber Resilience Act.

The series has four groups of documents. Some are full international standards and some are technical specifications or reports.

IEC 62443-3-2 asks the asset owner to group assets with similar security needs into zones, and to treat every communication path between zones as a conduit that must be controlled. Each zone and conduit gets a target security level based on a risk assessment. In practice zones are usually built with VLANs and firewalls, and many designs start from the levels of the Purdue model.

Requirements throughout the series are grouped under seven foundational requirements (FRs): identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability. IEC 62443-3-3 turns them into system requirements, and IEC 62443-4-2 into component requirements for four types of component: software applications, embedded devices, host devices and network devices.

Security levels describe how capable an attacker a zone or component is designed to resist. The same scale is used as a target (SL-T), as the capability of a component or system (SL-C) and as the level actually achieved once installed (SL-A).

IEC 62443-4-1 adds a separate scale of maturity levels, from 1 (initial) to 4 (improving), for how consistently a supplier follows its secure development process.

On a typical project the parts are used in a fixed order, with the asset owner, integrator and suppliers each handling their own share.

Component requirements are where the standard meets the hardware in a cabinet. For embedded and host devices, IEC 62443-4-2 covers points such as unique user identification, strong authentication, role-based access, protection of software and firmware integrity, secure update, audit logging, disabling unused ports and services, and recovery to a known secure state.

Several of these map directly to hardware features. A TPM stores keys and boot measurements, Secure Boot blocks unsigned code at start-up, and port authentication and VLANs enforce zones at the switch. Our managed industrial switches list IEEE 802.1X on most models, and TPM 2.0 is listed on many of our DIN rail PCs. These features support a design to IEC 62443, but certification applies to a specific product and version, so ask for the manufacturer’s certificate where a project requires one.

We configure the industrial PCs, gateways and managed switches we supply with the security features each model supports enabled as standard, and pass on the manufacturer’s security documentation for your IEC 62443 assessment.