IEC 62443 Audits and Certifications, Explained
IEC 62443 is the reference standard for industrial automation and control system security: a four-part architecture (zones and conduits), a four-level security model (SL 1–4), and process requirements for both suppliers and operators.
An audit against it is a structured interrogation of your network segmentation, your security level targets, and the evidence that your systems meet them.
What renders on this page
- ▸Requirement-to-evidence map for audits at Purdue Levels 0–3
- ▸Verified firm matrix filtered by IEC 62443 alignment
- ▸Purdue Model Level 1–3 competency validation tags
- ▸Hardware lab availability indicators
- ▸"Request Secure RFP" form pre-wired to the OT/ICS RFP template
Zones, conduits, and security levels
The standard divides your control network into zones (groupings sharing security requirements) connected by conduits, the channels through which data legitimately crosses. Each zone gets a target Security Level from SL 1 (protection against casual violation) through SL 4 (protection against intentional, sophisticated attackers). Auditors verify that targets are justified, not aspirational.
What auditors actually check
Network diagrams against physical reality, segmentation enforcement (not just firewalls on paper), SL justification documentation, patch and vulnerability management practice, and (most frequently failed) conduits that exist in production but not in documentation. Hardware lab availability matters because SL conformance at Levels 1–3 often requires bench validation of devices.
ISASecure and certification distinctions
Product certifications (ISASecure IEC 62443 for components), process certifications (for suppliers), and audits (for operators) are different artifacts. The directory flags which firms deliver which, because hiring a product-certification lab when you need an operational audit wastes a quarter.
Find verified IEC 62443 auditors
Filter by region for onsite-intensive engagements (see the Houston deployment page for how proximity filtering works) and by hardware lab availability where bench validation is required.
Frequently asked questions
What is the difference between IEC 62443 and ISA/IEC 62443?
None in practice, ISA developed the standard series and IEC adopted it internationally; the terms are interchangeable. ISASecure is the associated certification scheme for products and processes.
Which security level should we target?
Most operators target SL 2–3 for critical zones. SL targets are risk decisions, not aspirations, auditors want the justification traceable to your risk assessment. Verified firms document target rationale as part of the engagement.
How long does an IEC 62443 audit take?
An operational audit of a mid-size facility typically runs two to six weeks including evidence gathering, with onsite time concentrated in the first and last weeks. Proximity of the auditor shortens both, the reason the directory supports location filtering.
Do we need a hardware lab?
For SL conformance validation of devices at Purdue Levels 1–3, often yes. The directory flags firms with bench-lab capability so you do not discover mid-engagement that device validation is out of scope.