IEC 62443, Explained
IEC 62443 is the international standard suite for securing industrial automation and control systems. If you operate a plant, a pipeline, or a utility, it is the framework your vendors, your integrators, and increasingly your insurers will reference. If you buy OT security services, it is the vocabulary the proposals will use.
This explainer covers the structure, the security levels, the certification landscape, and what the standard actually requires of incident response, in plain terms.
The four series, and what each one governs
The standard is published in four numbered series. The 62443-1 series sets general concepts and terminology. The -2 series addresses policies and procedures for the people and processes operating a system, including the security program requirements an asset owner runs. The -3 series covers the systems themselves, how zones and conduits are designed and assessed. The -4 series covers components, the products and their secure development requirements.
In practice: asset owners live mostly in the -2 series, integrators and security architects in the -3 series, and device vendors in the -4 series. When an RFP asks a firm for 62443 experience, the useful follow-up question is which series, in which role.
Security levels 1 through 4
The standard defines four security levels, and they describe attacker capability, not product quality. SL 1 protects against casual or coincidental attackers. SL 2 against intentional attackers using simple means. SL 3 against sophisticated attackers with substantial resources. SL 4 against attackers with nation-state scale capability.
A target security level is chosen per zone from a risk assessment, not from ambition. That is the practical insight of the standard: your demilitarized zone between the enterprise and the control network may warrant SL 3 while a safety-critical zone may warrant SL 4, and the levels drive which technical requirements apply to each zone.
Zones and conduits
62443 organizes an environment into zones, groups of assets sharing a security requirement, connected by conduits, the controlled pathways between them. Segmentation, access control, and monitoring decisions all hang off the zone and conduit model, which is why the framework pages and directory filters use it as vocabulary.
The model also explains incident response scoping. An incident in one zone is contained by the conduits around it, and the response plan your firm writes should name the zones and conduits it will isolate, validate, and restore, in that order.
The certification landscape
Certification exists at several layers, and they are not interchangeable. Process certificates audit the security management system of the operator or integrator. Product and component certificates assess devices and software against the -4 series requirements. ISASecure is the best-known certification scheme implementing the standard.
When a security firm claims 62443 expertise, the verifiable claims are specific: which individuals hold which certifications, which assessments the firm has conducted, at which security levels, in which industries. The directory treats named-holder certification claims as checkable evidence and records them as such.
What it requires of incident response
The -2 series expects the security program to include incident response as an operational security requirement: plans, roles, handling procedures, and recovery, integrated with the zone and conduit model. In plain terms, 62443 does not let incident response be an afterthought bolted onto the environment; the response plan belongs to the same security architecture as the segmentation.
For buyers, that is a useful test: ask a prospective firm how its response procedures map to your zones and conduits. A firm fluent in the standard will answer in that vocabulary without prompting.
How it relates to NERC CIP and the TSA directives
They are complementary, not competing. NERC CIP and the TSA pipeline security directives are regulatory: they carry reporting clocks and mandatory requirements for the sectors they govern. IEC 62443 is a voluntary engineering standard: it describes how to build and assess the security architecture those regulations expect you to have.
Many operators use 62443 as the how to satisfy the what. If your obligation is a defined incident reporting and response plan under NERC CIP-008, a 62443-aligned security program gives the plan its structure, and the response firm you retain should be able to work in both frames.
Frequently asked questions
Is IEC 62443 certification required by law?
No jurisdiction mandates 62443 certification outright. Regulated sectors carry their own obligations (NERC CIP for electric, TSA directives for pipelines, CFATS for chemical), and 62443 is the engineering standard commonly used to meet them. Certification is often driven contractually by customers or insurers instead.
How do we pick a target security level?
From a risk assessment per zone, considering threat capability, consequence, and the conduits that cross zone boundaries. SL 2 is a common floor for control networks; SL 3 for zones with remote access or higher consequence; SL 4 is reserved for the most critical, highest-consequence cases. A competent assessment partner should show its work.
Does 62443 apply to legacy systems?
The standard applies to the environment you have, and its zone and conduit model is explicitly how legacy assets get accommodated: unpatchable equipment is segmented, compensated, and monitored rather than pretended to be new. Any firm proposing a 62443 program for a brownfield site should talk segmentation-first, not rip-and-replace.
Certification, conformance, or compliance, what should we ask for?
Certification is third-party audited (for example via ISASecure) and strongest. Conformance is self-declared against the standard. Compliance is a claim about regulations, not the standard. Ask prospective firms which they are offering, and for named individuals where certifications are claimed.
Related
Ready to buy?
Browse verified firms in this specialization or start a structured RFP.
Browse OT/ICS firms →