Learn
IEC 62443 implementation guide
IEC 62443 is the international standard for industrial automation and control system security. This is the asset owner's route through it: security levels, the seven foundational requirements, and how to get from an inventory to a defensible zone and conduit model.
IEC 62443 and NIST SP 800-82 Rev. 3 are complementary, not competing. SP 800-82 is guidance on applying security controls to OT while respecting performance, reliability and safety constraints; IEC 62443 is a certifiable standard family with defined roles for asset owners, integrators and product suppliers. Most programmes use SP 800-82 for control selection and 62443 for structure, contracts and assessment.
SL 0 – SL 4
Security levels
A security level is defined by the adversary it is expected to resist, not by a control count.
SL 0
No specific requirement
No protection expected. Only defensible for isolated, non-consequential equipment.
SL 1
Casual or coincidental violation
Protects against accidental misuse: a technician on the wrong subnet, a mis-addressed write.
SL 2
Intentional, simple means, low resources, generic skills
Typical target for most manufacturing zones. Stops opportunistic attackers and commodity malware.
SL 3
Intentional, sophisticated means, moderate resources, IACS-specific skills
Appropriate for safety-related and high-consequence zones (SIS, substation protection, water treatment).
SL 4
Intentional, sophisticated means, extended resources, IACS-specific skills
State-level adversary. Rare outside critical national infrastructure; costly to sustain.
Three variants matter in practice: SL-T (target, set by the risk assessment), SL-A (achieved, what the zone actually delivers today) and SL-C (capability, what a product can support). Remediation is the work of closing SL-A to SL-T.
FR 1 – FR 7
Foundational requirements
Every technical requirement in 62443-3-3 and 4-2 rolls up to one of these seven.
FR 1 · Identification and authentication control
Kill shared engineering logins on Rockwell FactoryTalk and Siemens TIA Portal; individually named accounts with an OT-scoped directory.
FR 2 · Use control
Restrict who may download logic. Enforce Siemens S7-1500 protection levels, Schneider Modicon application password, ABB 800xA role assignments.
FR 3 · System integrity
Controller keyswitch in RUN, signed firmware, and change detection on logic — the control that would have surfaced TRITON on Triconex.
FR 4 · Data confidentiality
Encrypt remote access and historian replication. Do not attempt to encrypt deterministic cell-level traffic such as PROFINET IO or GOOSE.
FR 5 · Restricted data flow
Zones and conduits: Purdue L3 to L2 firewalling, no direct L4 to L1 paths, protocol-aware inspection of Modbus/TCP 502, CIP 44818, S7comm 102, PCOM 20256.
FR 6 · Timely response to events
OT-specific logging and monitoring: engineering-workstation events, controller mode changes, unauthorised UMAS FC90 and CIP write services.
FR 7 · Resource availability
Tested logic and configuration backups, spares strategy, and DoS resilience — availability is the primary OT loss condition.
Structure
Which part applies to whom
IEC 62443-2-1
Asset ownerEstablish and run the IACS security programme: policies, risk assessment, patch and change management.
IEC 62443-2-4
Service provider / integratorSecurity capabilities the integrator must deliver during commissioning and support. Put this in the contract.
IEC 62443-3-2
Asset ownerZone and conduit partitioning plus risk assessment; produces the target SL for every zone.
IEC 62443-3-3
SystemSystem security requirements and SLs — how a delivered system is assessed against SL-T.
IEC 62443-4-1
Product supplierSecure development lifecycle. Ask vendors for their 4-1 certification when specifying new controllers.
IEC 62443-4-2
ComponentTechnical requirements for embedded devices, host devices, network devices and software applications.
Implementation
A staged path for asset owners
Six steps that produce evidence an assessor will accept.
01 · Inventory and characterise the system under consideration
Passive discovery on the process network, then reconcile against drawings. Record vendor, firmware, protocols and Purdue level for every device — you cannot zone what you cannot list.
02 · Partition into zones and conduits (3-2)
Group assets by shared consequence and trust, not by geography. Safety instrumented systems always get their own zone. Every crossing traffic path becomes a named conduit with an owner and an allowed protocol list.
03 · Run the detailed risk assessment
For each zone, evaluate the unmitigated consequence, likelihood and existing countermeasures. Output a target security level (SL-T) per zone. Use the OT risk model on this site as the working method.
04 · Close the gap between SL-A and SL-T
Assess achieved level (SL-A) against SL-T using the seven FRs. Most gaps land in FR 1, FR 5 and FR 6. Sequence remediation around outage windows, never around the audit date.
05 · Specify 4-1 and 4-2 in procurement
New controllers, gateways and HMIs should arrive with documented capability security levels. This is the cheapest point at which to buy security.
06 · Operate and reassess (2-1)
Maintain the programme: patch triage against CISA ICS advisories and KEV, periodic reassessment after any process change, and exercised incident response.
Continue
Related pages
Purdue model
The level structure most zone and conduit designs start from.
Zones and conduits in practice
Firewall placement, conduit rules and protocol-aware inspection.
OT risk model
Reachability, consequence and compensating controls — the input to SL-T.
Maturity assessment
Score ten capability areas and track SL-A movement over time.
Framework comparison
How 62443, NIST SP 800-82 and the CSF map onto each other.
CISA ICS advisories
Feed the 2-1 patch triage process with live vendor advisories.
Sources
Verify these statements
- IEC 62443 series (IEC / ISA-99), parts 2-1, 2-4, 3-2, 3-3, 4-1, 4-2.
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security.
- CISA, Defense in Depth strategies and ICS recommended practices.