What is IEC 62443? The OT security standard series explained
IEC 62443 is a series of standards for the security of industrial automation and control systems. The ISA99 committee and IEC Technical Committee 65 Working Group 10 develop it together, which is why you’ll see it written as ISA/IEC 62443 or ISA-62443 depending on the source. When OT security work needs a structure for risk assessment, network design or product requirements, this is the standard it usually points to.
How the series is organized
The series has four groups, and each one aims at a different part of the problem:
| Group | Focus | Examples |
|---|---|---|
| 1: General | Concepts, terminology and models | 62443-1-1 |
| 2: Policies and procedures | The security program of an asset owner or service provider | 62443-2-1, 62443-2-4 |
| 3: System | Risk assessment, system design and system requirements | 62443-3-2, 62443-3-3 |
| 4: Component | Secure product development and component requirements | 62443-4-1, 62443-4-2 |
For an operator, Parts 3-2 and 3-3 usually matter first. Part 3-2 covers how to assess risk and divide a system into zones and conduits. Part 3-3 lists the technical requirements a system has to meet at a given security level.
Who it is written for
ISA names four stakeholder groups: asset owners, automation product suppliers, integrators and service providers. The asset owner operates the control system. The integrator builds and installs it. The product supplier makes the components. The service provider maintains or supports them.
Each group has its own parts of the series. Part 2-1 covers an asset owner’s security program, Part 2-4 a service provider’s, and Parts 4-1 and 4-2 the product supplier’s work. So a pipeline operator and a PLC vendor can both cite 62443 and mean different documents.
Zones and conduits
A zone is a group of assets that share the same security requirements. A conduit is a defined communication path between zones. The model asks two things: was every path between two zones deliberately defined, and does each conduit allow only what that communication needs? How to verify IT/OT segmentation in operational networks applies the idea to an operational network.
People often sketch zones along Purdue model levels first. A zone still follows shared requirements, not a level number.
Security levels
The risk assessment gives each zone or conduit a target security level from 1 to 4:
- SL 1: protection against casual or coincidental violation.
- SL 2: protection against intentional violation using simple means with few resources.
- SL 3: protection against intentional violation by an attacker with sophisticated means and moderate resources.
- SL 4: the same sophisticated means, backed by extended resources.
The series tracks three values: the target level a zone needs, the capability a product or system can deliver, and the level achieved once it’s deployed. The gap between target and achieved is what an assessment measures.
Foundational requirements
Part 3-3 groups its technical requirements under seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability. Each one scales with the security level, so a zone targeting SL 2 and a zone targeting SL 3 carry different requirements under the same heading.
Certification
The ISASecure certification schemes cover components (CSA), systems (SSA), IIoT components (ICSA) and supplier development processes (SDLA). The system and component schemes depend on the supplier’s SDLA certification.
The standard itself isn’t a regulation. An operator uses it to structure risk assessment and requirements. Regulatory requirements, like the TSA Security Directives for pipelines, come from the regulator.
How it fits with other frameworks
NIST SP 800-82r3 is the federal guide to OT security, and NIST CSF 2.0 gives a program-level view. IEC 62443 goes deeper on OT network design, product requirements and security levels. Active vs. passive vulnerability scanning in OT shows how Parts 3-2 and 3-3 shape the choice of assessment method. What an ICS security assessment covers lists the frameworks findings usually map to.
For segmentation work built on zones and conduits, see IT/OT segmentation design and review.
Sources: ISA/IEC 62443 series of standards, ISA, for the developers and stakeholder groups. IEC 62443 SDLA certification and CSA certification, ISASecure, for the certification schemes. ISASecure certifications guide for system certification against Part 3-3.