What it asks for. IEC 62443-2-4 sets requirements for the security capabilities of service providers, such as integrators and maintenance providers, that work on industrial automation and control systems for asset owners. It covers areas such as solution staffing, architecture, wireless, safety instrumented systems, configuration management, remote access, event management, account management, malware protection and patch management.
In practice. Asset owners use the standard to specify what they expect from integrators and maintenance providers in contracts, and service providers use it to structure their own processes and to demonstrate capability, sometimes through certification. Evidence includes contract requirements, service provider procedures, staff training records and records of how remote access and changes are handled.
Common gaps. Contracts often reference the standard without specifying which requirements apply. Remote maintenance access by service providers is frequently weaker than agreed.