minimum selection IEC 62443
Start package, size S
€199 net per month
- IEC 62443: Required by your customers? The framework then covers the requirements. Not a legal duty.
- GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)
Framework · IEC 62443 for integrators and service providers
IEC 62443 as an integrator: Your security program is in place
The security programme for integrators, machine and plant builders with service and OT service providers, from the scope of services and system design to handover to the asset owner.
What is IEC 62443 integrator?
IEC 62443-2-4 is the part of the IEC 62443 series that describes requirements for the security programme of service providers who build or maintain industrial Automation Solutions. Each requirement in twelve functional areas is assigned one of four maturity levels; the system requirements in the design come from IEC 62443-3-3.
Content as of:
Does it apply to me?
IEC 62443-2-4 is a standard, not a legal obligation. Asset owners increasingly require it in tenders and contracts, partly because NIS2 obliges them to address the security of their supply chain and their service providers.
The module is aimed at system integrators, machine and plant builders with commissioning and service, remote maintenance and OT service providers, and in-house automation departments.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- IEC 62443-2-4Security programme requirements for integration and maintenance service providers
- IEC 62443-3-3System security requirements and security levels in the design
- IEC 62443-3-2Security risk assessment, zones and conduits
Key dates
There are no statutory deadlines for IEC 62443-2-4. Schedules result from projects, maintenance contracts and your customers’ requirements; you maintain dates in the project plan.
How Complass helps
Nine phases for service providers
Role and scope of services, security programme and maturity levels, staff, system design, hardening and remote access, patch, malware and backup services, incident reporting, FAT/SAT and handover, audit.
Shared zone model with the asset owner
Zones, conduits and SL-T on the shared asset inventory, inventory register for patch and vulnerability management.
Catalogue IEC 62443-2-4
All 123 requirements of the 2015 edition with Amendment 1:2017, functional areas SP.01 to SP.12, with base requirement, enhancements, status and evidence, each with an implementation guide from the service provider’s point of view.
Templates for service providers
Including security statement of work, security architecture document, remote access concept, patch approval process, incident reporting process, FAT/SAT test plan and handover documentation.
The phases in the module
- Role and scope of services
- Security programme of the service provider and maturity levels
- Staff, qualification and confidentiality
- Architecture and system design
- Hardening, accounts and access, remote access
- Patch, malware and backup management as a service
- Event and incident management, reports to the asset owner
- FAT/SAT, handover and documentation to the asset owner
- Operation, evidence and audit
Catalogue: IEC 62443-2-4 – Security programme requirements (SP.01–SP.12)
IEC 62443 in Complass: what you need at a minimum
If your customers require IEC 62443, this selection covers the requirements in Complass.
Recommended
Business
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview
You can also meet the requirements without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
Frequently asked questions
Do I also need the asset owner module as an integrator?
Both modules belong to the IEC 62443 framework and use the same zone model. You carry out the gap analysis against the individual system requirements from 3-3 in the asset owner module, ideally together with your customer.
Are the texts of the standard included?
No, IEC standards are protected by copyright. Complass explains the requirements in its own words and refers to the requirement number; you can store your own excerpts.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.