Control frameworks and standards
ISA/IEC 62443
The international series for securing industrial automation and control systems (OT).
Official source Published by ISA and IEC. Summaries in our own words.
What it is
ISA/IEC 62443 is a series of international standards for the security of industrial automation and control systems, also known as operational technology. It covers the whole chain: asset owners, system integrators, service providers and product suppliers, each with their own requirements.
Who it applies to
- Operators of industrial plants, utilities, manufacturing and other OT environments (asset owners)
- System integrators and service providers that design, build or maintain control systems
- Manufacturers of industrial control components and systems
- Organisations in NIS2 sectors such as energy, water and manufacturing, where it is a common reference for OT security
- Product makers preparing for EU Cyber Resilience Act requirements for industrial products
- Status
- A voluntary series of international standards developed by ISA and published by IEC, with parts issued and revised at different times. It is consensus based and not law, but is widely referenced by regulators and customers.
- Enforcement
- Voluntary. Products, development processes and some service providers can be certified by independent schemes such as ISASecure or by certification bodies; in practice it becomes required through procurement specifications and regulator expectations.
Key points
- Zones and conduits: group assets with similar security needs and control the communication between groups
- Security levels 1 to 4 express how strong protection must be, from casual violation to sophisticated attackers with extensive resources
- Risk assessment (3-2) sets a target security level for each zone, which is then matched by system capabilities (3-3)
- Suppliers are expected to follow a secure development lifecycle (4-1) and deliver components meeting technical requirements (4-2)
- Responsibilities are split between asset owner, integrator and product supplier, so contracts should state who does what
- Safety and availability usually outweigh confidentiality in OT, which shapes control choices such as patching
Where to start
- 1Build an inventory of OT assets and network connections
- 2Define zones and conduits and run a risk assessment to set target security levels
- 3Require 62443 conformity (for example 4-1 and 4-2) from product suppliers in procurement
- 4Set up an OT security programme with roles, patching and incident response adapted to plant operations
How it is structured
| Part 1 series: General | Concepts, terminology, models and metrics |
|---|---|
| Part 2 series: Policies and procedures | Security programme for asset owners and requirements for service providers |
| Part 3 series: System | Risk assessment, zones and conduits, and system security requirements by security level |
| Part 4 series: Component | Secure product development lifecycle and technical requirements for components |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (5)
In the order of the framework itself.
- 62443IEC 62443 seriesCited 69 times in our lessons
- 62443-2-1IEC 62443-2-1: Security program requirements for IACS asset ownersCited 48 times in our lessons
- 62443-2-4IEC 62443-2-4: Security program requirements for IACS service providersCited 16 times in our lessons
- 62443-3-3IEC 62443-3-3: System security requirements and security levelsCited 215 times in our lessons
- 62443-4-2IEC 62443-4-2: Technical security requirements for IACS componentsCited 17 times in our lessons