What it asks for. IEC 62443-3-3 defines technical security requirements for industrial automation and control systems at the system level. Requirements are grouped under seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability. Each is mapped to security levels that reflect the capability of the attacker the system should resist.
In practice. Asset owners and integrators define a target security level for each zone and conduit, then select and verify system requirements and enhancements to meet it. Evidence includes zone and conduit models, target and achieved security level documentation, test results and gap analyses. Suppliers may obtain certification of systems against the standard.
Common gaps. Target security levels are often set without a real risk assessment. Legacy components that cannot meet requirements are frequently left without documented compensating controls.