IEC 62443-3-2 risk assessment in seven steps

This guide takes you through every step. It also includes an invented example from production, common mistakes and a checklist.

What IEC 62443-3-2 sets out

The current edition is IEC 62443-3-2:2020, edition 1.0. It sets requirements for five results:

A defined system. The system under consideration (SUC) is the part of your automation that you look at.
Zones and conduits. The SUC is partitioned into groups of assets and their connections.
Risk per zone and conduit. Each zone and each conduit is assessed separately.
Target security level. The SL-T states how strongly a zone or conduit should be protected.
Documented requirements. The results go into a requirements specification that you can hand to an integrator, for example.

The risk assessment belongs to the asset owner. Integrators provide method and proposals; the decision on tolerable risk and SL-T rests with the asset owner.

What you need before you start

Risk matrix. Use a matrix your company already has, for example from occupational safety or risk management. This makes cyber risks comparable with other risks.
Tolerable risk. Senior management states in writing up to which point a risk is accepted. Without this limit you cannot justify an SL-T later.
Mixed team. Production, maintenance, automation, IT and safety sit at one table.
Inventory and data flows. You know which assets exist and who talks to whom over which protocol.

The seven steps

ZCR 1: Define the system. Describe the function, the physical and logical boundaries of the SUC and all access points: network links, remote maintenance, removable media, wireless. Do not make the SUC too large; a whole plant quickly becomes hard to follow.
ZCR 2: Make a first risk assessment. For each part of the plant, ask for the worst realistic outcome. You deliberately look at the unprotected state, meaning the impact before security measures take effect.
ZCR 3: Form zones and conduits. Group assets with the same security requirements into zones and assign every necessary data flow to a conduit. Enterprise IT and automation are separated, and so are safety assets.
ZCR 4: Compare with the tolerable risk. If the first result is within the tolerable range, no detailed analysis is needed. Everything above it moves to step 5.
ZCR 5: Assess in detail. For each affected zone and conduit you determine threats, vulnerabilities, risk and SL-T. The table below shows the sub-steps.
ZCR 6: Document the requirements. The requirements specification brings together the SUC description, drawings, characteristics of each zone and conduit, assumptions on the operating and threat environment, policies, tolerable risk and regulatory requirements.
ZCR 7: Approve. The asset owner formally approves the results. They are then ready to serve as a requirement for implementation and procurement.

Network map of the demo company by Purdue level with zones, target security level per zone, conduits and findings — Result of ZCR 3 and ZCR 5 on the network map: zones with SL-T and the conduits between them (sample project).

The detailed assessment in five stages

ZCR 5 is the largest step. It runs separately for each zone and conduit.

Stage	ZCR	What you do
Understand the situation	5.1 and 5.2	Name threats and vulnerabilities as specifically as possible: who, by which route, with which means
Risk without measures	5.3 to 5.5	Determine impact and likelihood, and from them the unmitigated risk
Set the target	5.6 and 5.7	Set the SL-T and compare the risk with the tolerable risk
Risk with measures	5.8 to 5.11	Evaluate existing countermeasures, reassess, determine the residual risk and compare it
Finish	5.12 and 5.13	Define additional measures, document the results and communicate them

Only run active vulnerability scans in running plants with approval and a fallback plan. Vendor advisories, documents and a plant walk-through provide many findings without this intervention.

Example from production

This example is invented, and so are all values. A company assesses the zone "Line 1 control" of a packaging line with controllers, drives and operator panels.

Threat: Malware reaches an operator panel through a service technician's USB stick.
Vulnerability: The panel runs with one shared operator account, and the USB ports are open.
Risk without measures: Impact 4 of 5, because the line stands still for several shifts. Likelihood 4 of 5. This is above the company's limit.
Target: SL-T 2, because the zone should fend off offenders with simple means and general IT knowledge.
Existing measure: A firewall limits the spread. Likelihood falls to 3, but the residual risk stays too high.
Additional measures: USB ports are blocked, and service devices are connected only after approval. The residual risk is then within the tolerable range.

Common mistakes

Counting today's protection. In the first assessment the unprotected state counts; otherwise you lose the comparison.
Deriving likelihood from the past. "Nothing has ever happened here" is no benchmark. The threat situation is what counts.
Leaving safety out. Safety systems can often be reached through engineering stations or gateways, so they belong in the assessment.
An SL-T without a reason. "SL 2 because that is usual" explains nothing. Refer to the relevant scenarios.
Leaving it to IT alone. Without automation and maintenance you get concepts that do not work on the plant.

Checklist

Risk matrix and tolerable risk are set in writing
Boundaries and access points of the SUC are described
The first assessment looks at the unprotected state
Every asset belongs to exactly one zone, every data flow to a conduit
A detailed assessment exists for every zone and conduit above the limit
Every SL-T is justified with scenarios
Additional measures have owners
The requirements specification is approved by the asset owner

The risk assessment in Complass

For the first workshop a spreadsheet is enough. It gets tedious once assessments, network plans and measures sit in separate files and emails. In Complass everything hangs on the shared asset inventory:

Guided project. The IEC 62443 module leads you through nine phases from project start to operation, with checklists and templates for the SUC description, risk assessments, zone model and requirements specification.
Method. In the risk methodology you choose the IEC 62443-3-2 template and adapt it to your matrix.
Zone assessment. For each zone and conduit you record threats, the levels without and with countermeasures, and the SL-T. The portal proposes an SL-T from the risk class; you make the decision.
From target to task. You apply the SL-T to the zone. The portal shows the gap per foundational requirement, and from a gap you create a task in the action plan.
Requirements per zone. You record boundaries, access points and assumptions per zone and create a report as PDF or Word. Conduits appear automatically as access points.
Report. The zone risk report summarises the assessment as PDF, Word or Excel for audits and requirements specifications.

The zone assessment and report are available with a booked IEC 62443 module. The texts of the standard are not included, because standards are protected by copyright.

Frequently asked questions

Does IEC 62443-3-2 prescribe a specific method?

Not for the SL-T. Three approaches are common: from the distance between unmitigated and tolerable risk, from the definitions of the levels, or step by step using the risk matrix. Informative Annex B of the standard contains examples of risk matrices.

Who approves the results?

The asset owner. This is the last step, ZCR 7. An integrator can support the assessment, but risk acceptance and SL-T stay with the asset owner.

Does this replace the risk assessment of the machine?

No. Functional safety and cybersecurity have their own standards; for functional safety the BSI names ISO 12100, for example. Still, coordinate impacts on safety functions with the people responsible for functional safety.

How often do we repeat the risk assessment?

Review the results at every significant change to the system, such as a new line or a new remote access. We also recommend a fixed interval that you set yourself.

In a demo we show you how zones, risk assessment and measures come together in Complass.

Request a demo Try it for 14 days

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed copy of the standard is authoritative.

IEC 62443-3-2: risk assessment step by step