IEC 62443 is a series of cybersecurity standards for operational technology in automation and control systems. It is organised into general, policies and procedures, system, component, profiles and evaluation areas, and it assigns duties to asset owners, product suppliers and service providers using a risk based approach.
The six areas
- General: basic terms, concepts and models.
- Policies and procedures: managing industrial security programs.
- System: security functions for control and automation systems.
- Components and requirements: product development processes and component requirements.
- Profiles: industry specific requirements.
- Evaluation: assessment methods meant to give consistent, reproducible results.
Some parts were still under development when the source was written, so check the current list.
Three roles
Asset owner. Operates the automation solution and handles security during plant operation, covered in Part 2-1.
Product supplier. Develops components. Secure development requirements are in Part 4-1 and technical requirements in Part 4-2.
Service provider. Does integration and maintenance, with capability requirements in Part 2-4.
Each follows a risk based approach. For a buyer, this means asking a supplier which parts they conform to and how that was assessed, and for an operator, knowing which duties stay with you.
Security levels
Security levels rate resistance to different attacker classes. SL 1 covers accidental misuse. SL 4 covers intentional misuse by an attacker with extensive resources and high motivation. SL 0 means no special protection. The reference notes that levels are meant to be assessed per technical requirement and are not a general product classification, so a product labelled SL 2 needs clarification about which requirements that covers.
Zones and conduits
A zone groups assets with common security requirements, separated from other elements by a boundary. Zones can have sub zones with different levels to give defence in depth. A conduit groups the communication paths between two zones and provides the security functions for that traffic.
A practical start is to draw the plant as zones, label each conduit, and ask what crosses it and who approved that. Many incidents, such as the ones in our Ukraine summary, involved traffic moving between zones nobody had defined.
Where safety fits
The reference reviewed does not describe how IEC 62443 relates to functional safety. Industry commentary connects them, for example through security assessment of safety instrumented systems, but we could not confirm the exact clauses from a primary source. Read the current editions of IEC 61511 and IEC 62443 side by side, and see our post on safety and control systems.
Mapping evidence to frameworks
Safeguard maps evidence to compliance frameworks and automates evidence collection for the frameworks it supports. Check the product to see whether a specific framework is available.
Click through it at your own pace, or open it full screen.
Quick check
Is IEC 62443 a certification you hold as a company?
The sources reviewed describe a standards series with an evaluation area. Which certifications exist is a question for the certification bodies.
What is the difference between a zone and a conduit?
A zone groups assets with shared requirements. A conduit groups the communication paths between zones.
Sources
Secondary summary; consult the standards.
Last reviewed: 19 October 2026.
