IEC 62443 overview: which part applies to whom?

This guide sorts the parts, shows how they work together and helps you determine your role. It also includes a table, an invented example and a checklist.

What the series is

The series is developed jointly by ISA and IEC, and the parts appear from both publishers under their own designations. According to ISA, the IEC recognised the series in 2021 as a horizontal standard that applies across industries.

It covers organisational and technical security over the entire life cycle of a plant. The core idea is that asset owners, integrators and manufacturers each contribute their part.

The four groups of the series

• General (1-x). Terms, concepts and models. This is where the basis for all other parts is laid.
• Policies and procedures (2-x). Security programmes of asset owners and service providers, plus patch management.
• System (3-x). Risk assessment, zones and conduits, and technical requirements for systems.
• Components (4-x). Secure product development and technical requirements for components.

The three roles

• Asset owner. Carries the risk, sets the tolerable risk and target security levels, and runs the security programme.
• Integrator and service provider. Plan, build, extend and maintain the automation solution and implement the system requirements.
• Product supplier. Develops controllers, switches, operating software or control systems with a secure process and defined security capabilities.

Which part applies to whom?

The table shows the central parts. The mapping is for orientation; the BSI gives a similar overview in its ICS Security Compendium.

TS stands for Technical Specification, TR for Technical Report. Check the current status in the IEC Webstore before you buy, because the series keeps evolving.

Further parts of the series

There are also parts you may need depending on your project:

• IEC 62443-2-2. A method for evaluating the protection of automation systems in operation.
• IEC TR 62443-3-1. A report on security technologies and tools for IACS.

How the parts work together

1. The asset owner sets the target. Under 3-2 the asset owner assesses the risk, partitions the plant into zones and conduits and sets an SL-T per zone.
2. The requirements go into the tender. The asset owner hands the documented requirements to integrators and suppliers.
3. The integrator builds the solution. The integrator works to its security programme under 2-4 and implements the system requirements from 3-3.
4. The manufacturer provides the capabilities. Components under 4-2 from a development process under 4-1 bring the functions the system needs.
5. The asset owner keeps up the level. The security programme under 2-1 governs operation: configuration, networks, access, incidents and availability.

How to find your role

1. Ask per plant. Roles do not apply to the whole company but to a specific plant or product.
2. List your services. Do you operate, build and maintain, or develop? Often more than one applies.
3. Create a role matrix. Record for each plant who is manufacturer, integrator and asset owner and who holds maintenance contracts.
4. Check the contracts. See whether supply and maintenance contracts cover security duties, such as reporting vulnerabilities.

Example: a machine builder with service

This example is invented. A machine builder supplies a packaging machine with controller, operator panel and remote maintenance router. It writes the control software itself and also handles commissioning and service.

• As a manufacturer it looks to 4-1 for development and 4-2 for the machine controller as a component.
• As a service provider it looks to 2-4 for commissioning, remote maintenance and service.
• For its own production it is an asset owner itself. There, 2-1, 3-2 and 3-3 apply.

The customer who buys the machine remains the asset owner of its plant. The customer decides on SL-T and risk acceptance, and the machine builder supplies information and proposals.

Mandatory or voluntary?

IEC 62443 is a series of standards, not a law. It becomes binding when a contract or tender requires it.

Under NIS2, the Cyber Resilience Act or the Machinery Regulation it can serve as a technical basis. It does not replace the legal obligations.

For an existing ISMS, note that IEC 62443-2-1 follows ISO/IEC 27001 according to the BSI. Much of it can therefore be reused, and the plant-specific parts come on top.

Common misunderstandings

• "We are IEC 62443 certified." Without naming the part, the subject and the role, this says little.
• "62443 is only for manufacturers." The series is just as much aimed at asset owners and service providers.
• "IT will handle it." The project does not work without production, maintenance and automation.
• "We only have one role." Machine builders and large asset owners with their own automation departments often have several.

Checklist

• Asset owner, integrator and manufacturer are named for every plant
• Your own roles are documented per plant or product
• The relevant parts are identified and available as licensed copies
• The current status of the parts is checked
• Contracts are reviewed for security duties
• The interface between OT security and IT security is defined
• SL-T, SL-C and SL-A are understood the same way across the team

IEC 62443 in Complass

Keeping parts of the standard, roles and evidence together in lists and emails takes a lot of coordination. In Complass, IEC 62443 is one offer with a module for each role:

• Asset owners. Nine phases from defining the system through zones, conduits and SL-T to the security programme, plus the catalogues for 3-3.
• Integrators and service providers. Nine phases from the scope of services to handover and audit, plus the catalogue for 2-4 with status and evidence.
• Manufacturers. Nine phases from the product goal to the component requirements, plus the catalogues for 4-1 and 4-2. You can filter the 4-2 catalogue by component type.
• Implement once. The framework overview shows which measure covers several frameworks at once, for example NIS2 or ISO 27001 alongside IEC 62443.
• Include suppliers. You assess integrators and service providers with a questionnaire on IEC 62443-2-4.
• Prepare for audits. There is a ready-made request list for audits against IEC 62443-2-1.

The texts of the standard are not included, because standards are protected by copyright. Complass explains the requirements in its own words and refers to the numbers.

Frequently asked questions

Which part should an asset owner read first?

IEC 62443-3-2 is a good place to start, because risk assessment, zones and target security levels come from there. In parallel you build the security programme under 2-1, and 3-3 supplies the technical requirements.

Can an asset owner get certified to IEC 62443?

Certification mostly covers components under 4-2, development processes under 4-1, or the processes of integrators and service providers under 2-4. For asset owners, a traceable, risk-based security programme is what counts most.

Are ISA/IEC 62443 and IEC 62443 the same?

Essentially, yes. ISA and IEC publish the parts under their own designations and as a rule with the same content. New editions can appear at different times, though, and some parts exist in different editions at the two publishers. So check the status of your edition.

Is ISO 27001 enough for production?

ISO 27001 is a good basis for the management system. Zones, conduits and system requirements for plants are described in IEC 62443, and the two complement each other.

In a demo we show you the modules for your role.

Request a demo Try it for 14 days

Read more

• Whitepaper "IEC 62443 for asset owners, integrators and manufacturers"
• IEC 62443 in Complass: from system under consideration to security programme
• IEC 62443 for integrators and service providers
• IEC 62443 for manufacturers
• Guide: IEC 62443-3-2: risk assessment step by step
• Guide: security levels in IEC 62443 explained

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed copy of the standard is authoritative.