General
Concepts, terminology and models (62443-1).
IEC 62443 · Industrial cybersecurity
IEC 62443: cybersecurity for industrial control systems
Protect your plants, OT networks and automation systems with the international standard adopted by operators, integrators and manufacturers.
What is IEC 62443?
The reference standard for OT security
ISA/IEC 62443 is a series of standards that defines how to protect industrial automation and control systems (IACS): PLCs, SCADA, DCS, sensors and the networks that connect them.
Unlike ISO 27001, it puts availability and process safety first: the plant has to keep running even under attack.
It assigns responsibilities to every player in the ecosystem: the asset owner, the system integrator and the component manufacturer.
Structure of the series
Four groups of documents
Policies and procedures
Security program for the asset owner and service providers (62443-2).
System
Risk assessment, zones and conduits, and technical requirements per security level (62443-3).
Components
Secure product development and technical requirements for each component (62443-4).
Phases
How we implement it
- 1OT asset inventory and network architecture assessment.
- 2Risk assessment and definition of zones and conduits.
- 3Target security level for each zone.
- 4Remediation plan: segmentation, remote access, hardening and monitoring.
- 5OT security program, procedures and training for plant staff.
- 6Internal audit and readiness for certification by an accredited body.
Security levels
Four levels based on the threat
SL 1
Protection against accidental errors or violations.
SL 2
Against intentional attacks with simple means and few resources.
SL 3
Against sophisticated attacks with moderate resources and knowledge of the industrial environment.
SL 4
Against sophisticated attacks with extensive resources, such as state-sponsored ones.
The standard defines seven foundational requirements: identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability.
Why IEC 62443
Continuous, secure production
Less downtime
You reduce the risk of ransomware halting production.
Orderly IT/OT convergence
You segment without disrupting operations or plant schedules.
Regulatory compliance
A technical foundation for NIS2 and critical infrastructure requirements.
Commercial advantage
Certified manufacturers and integrators win industrial tenders.
Who it applies to
Operators, integrators and manufacturers
- Energy, oil and gas
- Mining
- Water and sanitation
- Food and beverage
- Pharmaceutical industry
- Manufacturing and automotive
- System integrators
- Manufacturers of PLCs, sensors and industrial software
FAQ
What clients ask us most
What is IEC 62443?
It is the international series of cybersecurity standards for industrial automation and control systems. It sets requirements for asset owners, integrators and manufacturers, with security levels based on the threat.
How is it different from ISO 27001?
ISO 27001 manages information security across the whole organization. IEC 62443 focuses on industrial control systems, where availability and process safety come first. They complement each other.
Can you get certified?
Yes. Accredited bodies certify the security programs of asset owners and integrators, system security, and manufacturers’ processes and products.
Do we have to stop the plant?
No. We survey with passive techniques and schedule changes within maintenance windows so operations are not affected.
Is your plant ready for a cyberattack?
We assess your OT network and build an IEC 62443 plan without stopping production.