What it asks for. IEC 62443-4-2 defines technical security requirements for individual components of industrial automation and control systems, such as embedded devices, network devices, host devices and software applications. Requirements are derived from the same foundational requirements as IEC 62443-3-3 and are mapped to security levels, describing the security capabilities a component must provide.
In practice. Product suppliers design components to meet the requirements for their target security level and often seek certification. Asset owners and integrators use the standard to specify component requirements in procurement and to check that components support the system level design. Evidence includes supplier declarations or certificates, product security documentation and test reports.
Common gaps. Certification claims are sometimes accepted without checking which security level and which configuration were assessed. Security capabilities may exist but remain disabled in deployment.