ISA/IEC 62443 explained: who is responsible for what

ISA/IEC 62443 is a series of standards for industrial automation and control system security. It addresses asset owners, product suppliers, integrators and service providers, and stresses shared responsibility. Parts cover terminology, security programs, system requirements with security levels, and secure product development.

Who the series is for

According to ISA, the series targets four groups: asset owners, automation product suppliers, integrators who build and maintain control system solutions, and service suppliers who support operation. It applies across industries ISA names, including building automation, power, medical devices, transportation, and process industries such as chemicals and oil and gas.

The page stresses shared responsibility among these groups, which is the useful idea. A plant cannot be secure if its supplier ships weak products or its integrator leaves default settings behind.

How the documents are organized

ISA's page lists documents by part number. The grouping below is our reading of the numbering, not wording from the page:

• Part 1: terminology, concepts and models (for example ISA-62443-1-1).
• Part 2: security program requirements, including 2-1 for asset owners, 2-3 on patch management and 2-4 for service providers.
• Part 3: system level, with 3-2 on risk assessment for system design and 3-3 on system security requirements and security levels.
• Part 4: products, with 4-1 on secure product development life cycle and 4-2 on technical requirements for components.

The page also lists two technical reports on security technologies and related topics.

Security levels

ISA-62443-3-3 covers system security requirements and security levels. The series is meant to help asset owners decide how much security their business and risk profile need. The page we reviewed does not explain the levels in detail, so read the standard itself before you cite a level number.

How to use it in practice

1. As an owner, use Part 2 to shape your program and Part 3 to specify what you need from integrators.
2. As a buyer, ask suppliers whether their development process follows the secure product development part, and ask for evidence rather than a logo.
3. As a supplier, use Part 4 as a design and process benchmark.
4. As an integrator, map your delivery steps to the system parts, and hand over documented settings.

Copying the standard's vocabulary into a contract helps, since each side then means the same thing by "zone" or "security level."

What the standards are not

They are not a legal requirement on their own. They are also not a substitute for the basics in CISA's guidance, such as removing default passwords. Many teams use both. See our five first steps for the basics.

Quick check

Safeguard helps software suppliers evidence parts of their process through SBOM generation, dependency scanning and policy gates. It is not a 62443 certification body and holds no such certification.

Sources

• ISA, ISA/IEC 62443 Series of Standards

Last reviewed: 19 October 2026.