What Is IEC 62443? Industrial Cybersecurity Explained

What Is IEC 62443?

IEC 62443 is the international series of standards for the cybersecurity of industrial automation and control systems (IACS). It describes how operators, integrators, service providers and product suppliers protect these systems across their whole lifecycle. The series is developed by the ISA99 committee together with IEC TC 65/WG 10 and is published with identical content as ISA/IEC 62443. Key parts are also available as European standards, for example EN IEC 62443-4-1.

Why a separate standard? An office network mainly protects information. An automation system controls physical processes, often for decades, and cannot simply be patched or restarted at will. Availability, process integrity and human safety come first. ISO/IEC 27001 deals with how an organisation manages information security. IEC 62443 deals with what an industrial system and its products have to be able to do, and who is responsible for it.

How the IEC 62443 Series Is Structured

The documents fall into four groups:

General (IEC 62443-1-x): Concepts, models, terminology and metrics.
Policies and procedures (IEC 62443-2-x): Security programmes for asset owners (2-1), patch management (2-3) and requirements for service providers (2-4).
System (IEC 62443-3-x): Security technologies (3-1), security risk assessment for system design (3-2), and system security requirements and security levels (3-3).
Component (IEC 62443-4-x): The secure product development lifecycle (4-1) and the technical security requirements for components (4-2).

Who Is Responsible for What?

A central idea of IEC 62443 is that security is shared. The series distinguishes three main roles:

Asset owner: Operates the automation system and is accountable for its security.
Integration and maintenance service providers: Design, commission, maintain and service the automation solution.
Product supplier: Develops and supports the hardware and software components.

A machine builder often holds more than one of these roles. The machine is a product, but it is also a system integrated from purchased components. That is why the system parts and the component parts both matter in machinery.

The Core Concepts of IEC 62443

Zones and conduits: Assets with similar security needs are grouped into zones. Communication between zones runs through defined conduits, which limits how far an attacker can get.
Defence in depth: Several independent layers of protection, so that one failed measure does not open the whole system.
Essential functions: Security measures must not get in the way of the functions that keep the process and people safe.
Seven foundational requirements: Identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability. All technical requirements in parts 3-3 and 4-2 are sorted under these seven.

IEC 62443 Security Levels Explained

Security levels (SL) describe the strength of attacker a zone, system or component can withstand:

SL 1: Casual or accidental violations.
SL 2: Intentional attacks with simple means, few resources and general skills.
SL 3: Intentional attacks with sophisticated means, moderate resources and skills specific to industrial systems.
SL 4: Intentional attacks with sophisticated means, extensive resources, skills specific to industrial systems and high motivation.

The series separates the level you need (target, SL-T), the level a system or component can deliver (capability, SL-C) and the level actually reached in operation (achieved, SL-A). Maturity levels 1 to 4 are a different scale: they describe how consistently an organisation carries out its security processes.

Risk Assessment According to IEC 62443-3-2

Part 3-2 sets out what a security risk assessment for system design has to achieve, without prescribing one particular method:

Identify the system under consideration.
Carry out an initial risk assessment.
Partition the system into zones and conduits.
Compare the initial risk with the tolerable risk.
Carry out a detailed risk assessment where the tolerable risk is exceeded.
Document the results in a cybersecurity requirements specification.
Obtain the asset owner’s approval.

Which Parts Matter Most for Machine Builders?

Three parts stand out, and they are the three that the draft machinery standard EN 50742 names for its Approach B:

IEC 62443-4-1: How products are developed and maintained, from security requirements and secure design to testing, vulnerability handling and updates. It includes threat modelling that covers data flows, trust boundaries, attack vectors and potential threats.
IEC 62443-3-3: What a system has to be able to do, sorted by foundational requirement and security level.
IEC 62443-4-2: The corresponding technical requirements for individual components such as embedded devices, network devices, host devices and software applications.

Certification schemes for products and development processes, such as ISASecure, build on these parts.

Why IEC 62443 Matters Now

IEC 62443 is not a law, and applying it does not automatically give you a CE mark. A presumption of conformity exists only for standards whose reference has been published in the Official Journal of the EU under the regulation concerned.

It matters because new EU rules ask for exactly what the series has been describing for years. The EU Machinery Regulation requires protection against corruption from 20 January 2027, and the Cyber Resilience Act sets cybersecurity requirements for products with digital elements. IEC 62443 gives engineering teams a recognised structure for that work, in a language that operators and test bodies already understand.

How to Start

Clarify which roles you hold: product supplier, integrator, service provider, or several of them.
Draw your system with its assets, interfaces, zones and conduits.
Compare your development process with IEC 62443-4-1 and write down the gaps.
Run a first threat model on your most connected machine.
For machinery, connect the result with your risk assessment according to EN ISO 12100 and the EN 50742 threat assessment in EnCo ASE.
Schedule a free consultation to discuss your first analysis.

Conclusion

IEC 62443 describes who has to do what to keep industrial automation secure, from the operator’s security programme down to the requirements for a single component. For manufacturers, parts 3-3, 4-1 and 4-2 are the natural starting point. With the Machinery Regulation and the CRA now setting binding requirements, the series is becoming the common language of industrial cybersecurity.