What it covers. IEC 62443 is a series of international standards for the security of industrial automation and control systems. It covers general concepts, policies and procedures for asset owners and service providers, system level requirements and component level requirements, including secure product development. Core ideas include zones and conduits, security levels and shared responsibility among asset owners, integrators and product suppliers.
In practice. Asset owners run a security programme for their operational technology, segment systems into zones and conduits, set target security levels based on risk and require suppliers and integrators to meet the relevant parts. Evidence includes risk assessments, zone models, security level documentation, supplier certifications and maintenance procedures. The series is often referenced alongside NIS2 for operators of essential services.
Common gaps. Organisations sometimes adopt the vocabulary without the risk assessment behind it. Responsibilities between owner, integrator and supplier are often unclear in contracts.