This guide explains the four levels, the three forms and the seven foundational requirements. You will also see how to set a target and find gaps.
The four levels
The levels differ in whom you want to fend off. The examples in the last column are our own invented illustrations.
| Level | Protection against | Means and knowledge | Example |
|---|---|---|---|
| SL 1 | Accidental or coincidental violations | No intent | Operating error at the panel |
| SL 2 | Intentional attacks | Simple means, few resources, general IT knowledge, low motivation | An offender uses a freely available tool against an open service |
| SL 3 | Intentional attacks | Sophisticated means, moderate resources, automation knowledge, moderate motivation | A group with knowledge of control protocols |
| SL 4 | Intentional attacks | As SL 3, but extensive resources and high motivation | Very well equipped attackers |
The definitions are in Annex A of IEC 62443-3-2 and in IEC 62443-3-3. Use your licensed copy for the classification.
The three forms
- SL-T (target). The target for a zone or conduit. It is a requirement, not an inventory, and comes from the risk assessment under IEC 62443-3-2.
- SL-C (capability). What a system or component can deliver when properly configured. IEC 62443-3-3 covers systems, IEC 62443-4-2 covers components.
- SL-A (achieved). What has actually been achieved in the plant, including compensating measures.
The difference matters in every project: an SL-C says what is possible. Only the SL-A shows whether the function is switched on and used.
Seven foundational requirements instead of one number
A security level does not apply across the board. IEC 62443-3-3 assigns requirements to seven foundational requirements (FR), and the target can differ for each FR. The questions in the last column are our own translation into practice.
| FR | Foundational requirement | Question for the plant |
|---|---|---|
| FR 1 | Identification and authentication control | Do we know who is logging on? |
| FR 2 | Use control | Is this person allowed to do this? |
| FR 3 | System integrity | Do programs and data stay unchanged? |
| FR 4 | Data confidentiality | Are recipes and credentials protected? |
| FR 5 | Restricted data flow | Does only permitted traffic run between zones? |
| FR 6 | Timely response to events | Do we detect and log incidents? |
| FR 7 | Resource availability | Does the plant keep running under load? |
For a control zone, integrity and availability often come first, while confidentiality is frequently less critical. An SL-T can therefore be stated as a vector, for example {2, 2, 3, 1, 3, 2, 3} for FR 1 to FR 7.
Many asset owners start pragmatically with one value per zone and differentiate later.
How to set the SL-T
IEC 62443-3-2 does not prescribe a specific method for this. A proven sequence:
- Assess the zone and conduit. Determine threats, impact and likelihood without countermeasures.
- Place the attacker. Ask which kind of attacker the zone must withstand.
- Derive the level. Use the distance to the tolerable risk or the definitions of the levels, or raise the level step by step until the risk is tolerable.
- Check per FR. Decide whether one value is enough or individual foundational requirements differ.
- Justify and approve. Refer to the relevant scenarios. Approval rests with the asset owner.
Exposed areas such as the OT DMZ and remote maintenance conduits often need a higher SL-T than the zones behind them because of where they sit.
What one level higher means
Requirements are added with each level. IEC 62443-3-3 contains 51 system requirements (SR) and 49 requirement enhancements (RE) that apply depending on the level. For the login of people, SR 1.1, it looks like this:
| Level | What is required (in our own words) |
|---|---|
| SL 1 | All people are identified and authenticated |
| SL 2 | Each person is uniquely identified; group accounts are no longer enough |
| SL 3 | In addition, MFA for access over untrusted networks |
| SL 4 | MFA on all networks |
Some system requirements apply only from SL 2 or SL 3. A higher target is therefore not automatically better, but above all more work.
From gap to measure
- Determine the SL-C. Use manufacturer information, certificates, security manuals and, for legacy systems, your own check.
- Compare. For each zone and FR, compare the SL-T with the state of the plant.
- Switch on what exists. You can close many gaps by activating existing functions, such as personal accounts on the panel.
- Compensate. If a system cannot meet a requirement, make up for it, for example with a tight firewall rule or a two-person rule for program changes.
- Plan the replacement. Record what the substitute measure stands in for and how long it should apply.
Example: a zone with an older controller
This example is invented. A zone in a filling plant has an SL-T of 2 in FR 1. The controller has no user management, so its SL-C in FR 1 stays below the target.
The operator panel supports personal accounts, but they have not been set up.
- Panel: The accounts are activated. This needs no investment.
- Controller: The zone boundary allows write access only from the engineering station, and program changes follow a two-person rule.
- Plan: The measure stays in place until the planned replacement of the controller.
Common mistakes
- Reading a security level as a product seal. The SL-C of a component says nothing about the SL-A of your plant.
- Confusing the SL-T with the current state. The target comes from the risk, not from what exists.
- One value without looking at the FRs. A single number for everything hides where the gap really is.
- Choosing a level out of habit. Every level needs a reason.
- Compensation as a permanent state. Substitute measures need a plan for their replacement.
Checklist
- SL 1 to SL 4, SL-T, SL-C and SL-A are understood the same way across the team
- Every zone and conduit has a justified SL-T
- For important zones you have checked whether individual FRs differ
- SL-C information has been requested from manufacturers
- Legacy systems without information have been checked
- Gaps per zone and FR are recorded in an action plan
- Compensating measures have a reason and an end date
Security levels in Complass
A spreadsheet with seven columns per zone is quick to build but rarely stays up to date. With a booked IEC 62443 module, Complass keeps target, capability and status in one place:
- SL-T from the assessment. In the zone assessment the portal proposes an SL-T from the risk class. You decide and apply the value to the zone.
- Per foundational requirement. If you wish, you set the SL-T per FR 1 to FR 7. Without an own value, the zone value applies to all FRs.
- SL-C on the asset. You maintain the values in the asset's master data.
- SL-A and gap. As a starting value the portal takes the lowest SL-C value of the assets in operation. If a value is missing, SL-A stays open, and with a justification you can override SL-A in the zone.
- Measure for the gap. From a gap you create a task in the action plan directly.
- Catalogues for 3-3. You assess system requirements and enhancements with status and evidence, and you filter the enhancements by level. The implementation guide names steps, evidence and common findings.
The texts of the standard are not included, because standards are protected by copyright.
Frequently asked questions
Which security level do we need?
That follows from your risk assessment, not from an industry list. It depends on impact, threats and tolerable risk per zone.
Who sets the SL-T?
The asset owner. Integrators provide method and proposals, manufacturers the information on the SL-C.
Can a zone have a higher SL-A than its components?
Yes, that can happen. Compensating measures at the zone boundary or organisational rules can make up for capabilities that individual devices lack. Document for each measure which requirement it replaces.
What is the difference between a security level and a maturity level?
A security level describes technical protection. A maturity level assesses processes, such as the development process under IEC 62443-4-1. A process certificate of this kind says nothing on its own about the SL-C of a particular product.
In a demo we show you how SL-T, SL-C and SL-A come together in Complass.
Request a demo Try it for 14 days
Read more
- Whitepaper "IEC 62443 for asset owners, integrators and manufacturers"
- IEC 62443 in Complass: from system under consideration to security programme
- Guide: zones and conduits explained
- Guide: IEC 62443-3-2: risk assessment step by step
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed copy of the standard is authoritative.