This guide shows how the current edition is structured, how the program connects with risk assessment, zones and security levels, and where to start. The examples are invented.
What IEC 62443-2-1 is about
Technology alone does not protect a plant. Firewalls between zones help little if nobody reviews the rules, remote maintenance runs through a forgotten modem or no backup of the control program exists after an outage. IEC 62443-2-1 therefore covers the organizational side: the processes an asset owner needs to run its industrial automation and control systems (IACS) securely.
The current edition is edition 2.0 of August 2024. It replaces the 2010 edition and brings three visible changes:
- New structure. The requirements are grouped into eight security program elements (SPE), each with its own identifiers such as ORG, CM or NET.
- Maturity model. The implementation of each requirement can be rated with maturity levels.
- Fewer duplicates. Requirements that would only repeat an information security management system (ISMS) were removed. The standard recommends aligning the security program with the existing ISMS or integrating it there.
The 2010 edition still spoke of a cyber security management system (CSMS). Many companies still use the term, and it means essentially the same.
The eight elements at a glance
The table describes the elements in our own words. Your licensed edition of the standard is authoritative.
| Element | Identifier | What it covers | Typical evidence |
|---|---|---|---|
| SPE 1 Organizational security measures | ORG | Policy, roles, training, suppliers, physical protection, program reviews | Approved OT policy, role matrix |
| SPE 2 Configuration management | CM | Inventory, baselines, changes | Asset inventory, change records |
| SPE 3 Network and communications security | NET | Segmentation, zone boundaries, remote access | Network plan with zones, firewall rule review |
| SPE 4 Component security | COMP | Hardening, malware protection, patch management | Hardening rules, patch status |
| SPE 5 Protection of data | DATA | Confidentiality and integrity of data, secure deletion | Data classes, deletion records |
| SPE 6 User access control | USER | Accounts, rights, authentication | Account list, access review |
| SPE 7 Event and incident management | EVENT | Logging, detection, response | Incident response plan, exercise record |
| SPE 8 System integrity and availability | AVAIL | Backup, recovery, emergency operation | Backup concept, restore test |
How 2-1, 3-2 and zones fit together
The parts of the series work together:
- IEC 62443-3-2 assesses the risk of a defined system, partitions it into zones and conduits and sets the target security level (SL-T) per zone.
- IEC 62443-3-3 provides the technical system requirements a zone uses to reach its SL-T.
- IEC 62443-2-1 makes sure that this level holds in operation: through processes for changes, patches, remote access, accounts, backups and incidents.
The security program also sets the frame for the risk assessment: who owns it, which method applies and when it is repeated. Without a program, good zoning goes stale after the first major change to the plant.
Seven steps to a security program
- Mandate and scope. Management commissions the program and names sites, plants and owners. Start with one site or one important plant.
- Set the roles. Name one person responsible for OT security and settle the interfaces with IT, maintenance, integrators and manufacturers.
- Lay the foundations. The asset inventory, the risk assessment under 3-2, and zones and conduits show what you protect and how strongly.
- Assess the current state per element. Go through the eight elements and record how far each requirement is implemented today. That is your gap analysis.
- Build processes by priority. Start where the risk is highest. That is often remote access, backup and recovery, patch management and incident response.
- Connect it with the ISMS. If you already have an ISMS under ISO/IEC 27001, extend it with the OT aspects instead of building a second system. The 2024 edition no longer repeats the ISMS requirements; for those it refers to ISO/IEC 27001.
- Review and improve. Internal audits, metrics and a regular maturity assessment show management whether the program works.
Using maturity levels well
The maturity model of the 2024 edition rates how well a requirement is implemented, not only whether it exists. A process that exists on paper but is not lived reaches a lower maturity level than one that is introduced, measured and improved. Take the exact levels and the assessment procedure from your licensed edition.
Three tips from practice:
- Set a target per requirement. Not every requirement needs the highest level. The target follows from the risk.
- Rate honestly. A low level with an action and a date helps more than a nice number without evidence.
- Show progress. Repeat the assessment at fixed intervals. Comparing it with the last assessment makes progress visible to management.
Example from production
The example is invented. A maker of food packaging runs an ISMS under ISO/IEC 27001 for its administration. Production with two lines has so far been outside it.
- Starting point: The risk assessment under 3-2 resulted in three zones. The assessment of the eight elements shows gaps mainly in SPE 3, SPE 4 and SPE 8.
- Visible at once: Two machine suppliers do maintenance through their own modems, without approval and without a time limit. The control programs exist only on one engineering laptop.
- Priority: first a remote maintenance concept with approval per access, then backup and a restore test, then patch management with the manufacturers' approvals.
- After that: The OT policy becomes part of the existing ISMS. Management sees the maturity level per element in the half-yearly report.
Checklist
- Management has commissioned the security program and set the scope.
- One person responsible for OT security is named.
- The interfaces with IT, maintenance, integrators and manufacturers are settled.
- Asset inventory, risk assessment, and zones and conduits are in place.
- The current state is assessed per element, with a target per requirement.
- Remote access, backup, patch management and incident response are in place.
- Requirements for suppliers and service providers are in the contracts.
- The program is aligned with the ISMS.
- Audits and maturity assessments take place regularly.
The security program in Complass
Running a security program in spreadsheets, folders and email means nobody sees which process is current or where the evidence is. In Complass you work in one place:
- Guided route. The IEC 62443 module for asset owners leads in nine phases from the system under consideration through zones, conduits and SL-T to the security program under 2-1 and on to gap analysis, action plan and operation, with checklists for each step.
- Templates. Including an OT security policy, a patch and vulnerability process, a remote maintenance concept, a backup and recovery concept and an OT incident response plan.
- One inventory. Zones, conduits and SL-T are derived from the shared asset inventory.
- Remote maintenance access. A second person approves each supplier access, and it is valid for at most twelve months.
- Maturity. In the gap analysis you rate today's maturity per measure on a scale from 0 to 4 against a target and see the previous assessment next to it.
- Audit. The auditor workspace has a ready-made request list for IEC 62443-2-1. You export training records as PDF or Excel.
The texts of the standard are not included, because standards are protected by copyright. Complass explains the requirements in its own words.
Frequently asked questions
Do we need a separate security program next to ISO 27001?
Not as a second system. The 2024 edition recommends aligning the program with the ISMS or integrating it there. What is new are the plant-specific parts, such as zones, remote maintenance, patch management with manufacturer approval and emergency operation.
Is the 2010 edition still valid?
The 2024 edition replaces it. Contracts and tenders sometimes still refer to 2010, though. In such cases, clarify which edition is meant.
Is IEC 62443-2-1 mandatory?
IEC 62443 is a series of standards, not a law. It becomes binding through a contract or a tender. Under NIS2 it can serve as a structure for the OT measures under Art. 21 NIS2 Directive and § 30 BSIG (German BSI Act), but it does not replace the legal duties.
How does it differ from IEC 62443-2-4?
2-1 is aimed at asset owners. 2-4 describes the requirements for integrators and maintenance service providers. As an asset owner you can ask your service providers for evidence under 2-4.
How long does it take to build?
The standard gives no figure. It depends on size, starting point and an existing ISMS. Plan in steps and start with the biggest risks.
In a demo we use the demo company to show you how risk assessment and zones turn into a security program that is actually lived.
Request a demo Try it for 14 days
Read more
- Guide "IEC 62443 overview: which part applies to whom?"
- Guide "IEC 62443-3-2: risk assessment step by step"
- Guide "Zones and conduits explained"
- Guide "Security levels in IEC 62443 explained"
- Whitepaper "IEC 62443 for asset owners, integrators and manufacturers"
- IEC 62443 in Complass
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG and your licensed edition of the standard are authoritative. As of November 2026.