IEC 62443: zones, conduits and security levels

What IEC 62443 is

IEC 62443 is a series of standards for the security of industrial automation and control systems (IACS). It grew out of work by the ISA99 committee and is published jointly by ISA and the IEC. Unlike general standards, it addresses safety, real-time constraints and the shared responsibility between plant owners, the engineering firms that build systems, and the vendors who make the products.

Roles and key parts

Zones and conduits

A zone is a group of assets that share the same security requirements, for example all the controllers and HMIs for one production line, or the safety system on its own. A conduit is the set of communication paths between zones, together with the controls on them, such as firewalls, VPNs or data diodes. All traffic between zones must pass through a defined conduit.

Part 3-2 describes how to get there: list the assets and data flows, do an initial risk assessment, partition into zones and conduits, perform a detailed risk assessment for each, and document a target security level and the controls needed to reach it.

Security levels

Security levels describe how strong an attacker a zone must withstand:

• SL 1: protection against casual or accidental violation.
• SL 2: intentional attack using simple means, low resources, generic skills and low motivation.
• SL 3: intentional attack using sophisticated means, moderate resources, IACS-specific skills and moderate motivation.
• SL 4: intentional attack using sophisticated means, extended resources, IACS-specific skills and high motivation, such as a nation state.

Three variants are used together. SL-T (target) is the level the risk assessment says a zone needs. SL-C (capability) is what a product or system can provide when properly configured. SL-A (achieved) is what is actually in place after deployment. Your job is to make SL-A meet SL-T, using SL-C to choose suitable products.

Levels are measured against seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability. A zone may need SL 3 for integrity but only SL 1 for confidentiality.

Using it in practice

1. Start with an accurate asset inventory and data-flow map; most projects stall here.
2. Keep zones simple and meaningful: by line, function or criticality, with the safety system always separate.
3. Document each conduit with its allowed protocols, directions and endpoints.
4. Ask suppliers for 62443-4-1 and 4-2 evidence or certification when buying components.
5. Review zones and levels after changes, incidents and new threat intelligence.

Tip: 62443 complements rather than replaces ISO/IEC 27001. Many organisations use 27001 for their overall management system and 62443 for the technical and operational detail of OT.