IEC 62443: security for industrial automation and control systems

What it is

Industrial automation and control systems (IACS) run factories, power grids, water treatment, building management and transport. They include programmable logic controllers (PLCs), human-machine interfaces, historians, engineering workstations and the networks that connect them. These systems have different priorities from office IT: safety and availability come first, equipment lives for decades, and patching may require a plant shutdown.

IEC 62443, developed with the ISA99 committee and published by the IEC, is a family of standards for securing IACS. It is organised in four groups:

Why it matters

Attacks on industrial systems can cause physical damage, environmental harm and loss of life, not only data loss. Many sites still run flat networks where an infected office laptop can reach a PLC. IEC 62443 is referenced by sector regulators, insurers and procurement teams worldwide, and it is the basis for product certification schemes. Because it assigns responsibilities to each party in the supply chain, it also helps answer the common question "whose job is it to secure this?".

Key ideas

• Roles. The asset owner operates the system and runs the security programme. Service providers and integrators design, install and maintain it. Product suppliers build secure components and support them with patches and security information.
• Seven foundational requirements (FR1 to FR7): identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.
• Zones and conduits. A zone groups assets that share security requirements; a conduit is the communication path between zones. This formalises network segmentation (compare zero trust segmentation).
• Security levels (SL 1 to 4) describe protection against increasingly capable attackers, from casual or accidental violation (SL 1) up to sophisticated attackers with extensive resources (SL 4). A zone can have a different level for each foundational requirement.
• Target, capability and achieved levels. The asset owner sets a target level for each zone from the risk assessment (62443-3-2). Products have capability levels (62443-4-2). The achieved level is what the deployed system actually delivers.
• Compensating countermeasures. Where legacy equipment cannot meet a requirement, other controls, such as a protocol-aware firewall at the conduit, can make up the difference.

What changed recently

The series is being revised part by part rather than all at once, with updates aimed at consistency between parts and at newer topics such as cloud-connected and remotely managed systems. Certification has grown through the IECEE conformity assessment scheme and the ISASecure programme, covering development processes (62443-4-1), components (4-2) and systems (3-3). Regulation is also pushing adoption: the EU NIS2 Directive brings many manufacturers and utilities into scope, and the Cyber Resilience Act applies to many industrial products with digital elements. In MITRE ATT&CK, the ICS matrix gained sub-techniques in 2026, which helps map threats to 62443 controls.

How practitioners apply it

1. Inventory and diagram every IACS asset and data flow, including remote access paths used by vendors.
2. Run a 62443-3-2 risk assessment and divide the system into zones and conduits with target security levels.
3. Enforce conduits with firewalls, industrial DMZs and, where justified, one-way data diodes. Allow only the protocols and directions needed.
4. Specify requirements to suppliers using 62443-4-2 capability levels and ask for 62443-4-1 process evidence.
5. Require integrators to meet 62443-2-4 for hardening, account management and patch handling.
6. Monitor with passive, protocol-aware intrusion detection that does not disturb fragile devices.

Tip: Never run an active network scanner against a live control network without the asset owner’s approval and a test plan. Some older devices crash under unexpected traffic.

A useful way for network engineers to start is to compare an existing plant network with the zone model. Draw today’s VLANs and firewall rules, mark which assets talk to which, and then ask which of those paths would count as a defined conduit. In many sites the first finding is a remote-access path, such as a vendor’s remote desktop tool on an engineering workstation, that bypasses every zone boundary and should be replaced by a monitored, time-limited access service.

Limitations and open questions

• Cost and access. The standards are long, paid documents, which slows adoption by smaller operators and students.
• Legacy reality. Many installed controllers have no authentication at all; compensating controls are the only practical option for years.
• Security levels are qualitative. Deciding whether a zone needs SL 2 or SL 3 involves judgement and can be inconsistent.
• Cloud and IIoT blur zone boundaries, raising questions the original model did not anticipate.