minimum selection IEC 62443
Start package, size S
€199 net per month
- IEC 62443: Required by your customers? The framework then covers the requirements. Not a legal duty.
- GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)
Framework · IEC 62443 – industrial cybersecurity
IEC 62443 for systems that have to keep running
Risk-based OT security for production, process and utility plants, from zones and conduits to the asset owner’s security programme.
What is IEC 62443?
IEC 62443 is an international series of standards on the cybersecurity of industrial automation and control systems (OT). It describes requirements for asset owners, integrators and manufacturers, including the division into zones and conduits, security levels and the asset owner’s security programme.
Content as of:
Does it apply to me?
IEC 62443 is a series of standards, not a legal obligation. It is the recognised framework for OT security in industry and is often referenced by customers or in the context of NIS2 and the Machinery Regulation.
The module is aimed at asset owners as well as integrators and OT service providers supporting them.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- IEC 62443-2-1Security programme requirements for asset owners
- IEC 62443-3-2Security risk assessment, zones and conduits
- IEC 62443-3-3System security requirements and security levels
- Anhang III Abschn. 1.1.9 MaschinenVOAnnex III Section 1.1.9 Machinery Regulation Protection against corruptionThe machinery or related product shall be designed and constructed so that the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with the machinery or related product does not lead to a hazardous situation. A hardware component transmitting signal or data, relevant for connection or access to software that is critical for the compliance of …Open original (EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026) ↗Protection against corruption, often implemented with IEC 62443
Key dates
There are no statutory deadlines for IEC 62443. Schedules result from your projects, customer requirements or obligations under NIS2 and the Machinery Regulation; you maintain dates in the project plan.
How Complass helps
Nine phases for asset owners
System under consideration, asset inventory, initial and detailed risk assessment, zones and conduits, target security levels, security programme, gap analysis and action plan.
Connected with asset management
Zones, conduits and SL-T are derived from the shared asset inventory, including a zone proposal from the networks.
Catalogue IEC 62443-3-3
System requirements by foundational requirements FR1–FR7 with status and evidence.
OT templates
Including cybersecurity requirements specification, remote maintenance concept, patch and vulnerability process, backup and recovery concept and OT incident response plan.
The phases in the module
- Project start, roles and approach
- System under consideration and asset inventory
- Initial risk assessment (high-level)
- Zone and conduit model
- Detailed risk assessment and target security levels
- Operator's security programme (62443-2-1)
- Technical requirements and gap analysis (62443-3-3)
- Action plan and implementation
- Operation, monitoring and continual improvement
Catalogue: IEC 62443-3-3 – system requirements (SR) by foundational requirement
IEC 62443 in Complass: what you need at a minimum
If your customers require IEC 62443, this selection covers the requirements in Complass.
Recommended
Business
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview
You can also meet the requirements without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
Frequently asked questions
Does Complass also support manufacturers under IEC 62443-4-1/4-2?
Yes. Complass covers IEC 62443 with one module per role. Manufacturers have their own module for IEC 62443-4-1 and 4-2, linked with the CRA and the Machinery Regulation.
Are the texts of the standard included?
No, IEC standards are protected by copyright. Complass explains the requirements and refers to the source; you can store your own excerpts.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.