# IEC 62443 Security Levels and Parts Reference

> Source: https://netray.co/tools/iec-62443-security-levels-and-parts-reference
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A quick lookup of the IEC 62443 series structure, the four security levels, the seven foundational requirements and the zone and conduit vocabulary.

## Category

compliance-legal

## Industry

Manufacturing

## Audience

- IT security lead
- OT engineer
- Automation engineer

## Tool

**Kind:** worksheet

**Mode:** reference

**Columns:**

#### Item

**Key:** item

**Type:** text

#### Group

**Key:** group

**Type:** text

#### What it covers

**Key:** meaning

**Type:** text

#### Mostly used by

**Key:** who

**Type:** text

**Rows:**

**Item:** 62443-1-1

**Group:** Part

**Meaning:** Terminology, concepts and models, including the foundational requirements and security levels

**Who:** Everyone starting out

**Item:** 62443-2-1

**Group:** Part

**Meaning:** Security program requirements for IACS asset owners

**Who:** Plant owner, IT security lead

**Item:** 62443-2-3

**Group:** Part

**Meaning:** Patch management in the IACS environment

**Who:** Asset owner, service provider

**Item:** 62443-2-4

**Group:** Part

**Meaning:** Security program requirements for IACS service providers (integrators, maintainers)

**Who:** System integrator, vendor

**Item:** 62443-3-2

**Group:** Part

**Meaning:** Security risk assessment for system design, including partitioning into zones and conduits

**Who:** OT architect, integrator

**Item:** 62443-3-3

**Group:** Part

**Meaning:** System security requirements and security levels

**Who:** System designer, buyer

**Item:** 62443-4-1

**Group:** Part

**Meaning:** Secure product development lifecycle requirements

**Who:** Product vendor

**Item:** 62443-4-2

**Group:** Part

**Meaning:** Technical security requirements for IACS components (embedded devices, host, network, software)

**Who:** Product vendor, buyer

**Item:** SL 1

**Group:** Security level

**Meaning:** Protection against casual or coincidental violation

**Who:** Risk assessor

**Item:** SL 2

**Group:** Security level

**Meaning:** Protection against intentional violation using simple means, low resources, generic skills and low motivation

**Who:** Risk assessor

**Item:** SL 3

**Group:** Security level

**Meaning:** Protection against intentional violation using sophisticated means, moderate resources, IACS specific skills and moderate motivation

**Who:** Risk assessor

**Item:** SL 4

**Group:** Security level

**Meaning:** Protection against intentional violation using sophisticated means, extended resources, IACS specific skills and high motivation

**Who:** Risk assessor

**Item:** SL-T

**Group:** Security level type

**Meaning:** Target security level for a zone, set by the risk assessment

**Who:** Asset owner

**Item:** SL-C

**Group:** Security level type

**Meaning:** Capability security level a component or system can deliver when configured correctly

**Who:** Vendor, buyer

**Item:** SL-A

**Group:** Security level type

**Meaning:** Achieved security level of the installed system, verified after commissioning

**Who:** Integrator, asset owner

**Item:** FR 1

**Group:** Foundational requirement

**Meaning:** Identification and authentication control (IAC)

**Who:** Designer

**Item:** FR 2

**Group:** Foundational requirement

**Meaning:** Use control (UC): enforce assigned privileges

**Who:** Designer

**Item:** FR 3

**Group:** Foundational requirement

**Meaning:** System integrity (SI): protect against unauthorized manipulation

**Who:** Designer

**Item:** FR 4

**Group:** Foundational requirement

**Meaning:** Data confidentiality (DC)

**Who:** Designer

**Item:** FR 5

**Group:** Foundational requirement

**Meaning:** Restricted data flow (RDF): segmentation of zones and conduits

**Who:** Network architect

**Item:** FR 6

**Group:** Foundational requirement

**Meaning:** Timely response to events (TRE): audit logs and incident reporting

**Who:** Security operations

**Item:** FR 7

**Group:** Foundational requirement

**Meaning:** Resource availability (RA): resist denial of service and keep essential functions

**Who:** Designer, operations

**Item:** Zone

**Group:** Term

**Meaning:** A grouping of logical or physical assets that share common security requirements

**Who:** OT architect

**Item:** Conduit

**Group:** Term

**Meaning:** A path for communication between zones that carries its own security requirements

**Who:** OT architect

**Item:** IACS

**Group:** Term

**Meaning:** Industrial automation and control system: people, process and technology that operate a plant

**Who:** Everyone

**Item:** Asset owner

**Group:** Role

**Meaning:** The organization that operates the IACS, normally the manufacturer

**Who:** Plant management

**Item:** Product supplier

**Group:** Role

**Meaning:** The party that develops and supports a control product such as a PLC or HMI

**Who:** Vendor

**Notes:** Summary of structure only, based on the published series. Buy the standard from IEC or ISA for exact requirement text and check which editions apply to your contracts.

## Content

**Intro:** IEC 62443 is the standard that most OT security conversations eventually point to, yet few people can say which part answers their question. This lookup maps parts, security levels, foundational requirements and vocabulary in one searchable table.

**Sections:**

#### How to use the table

**Body:** Type a part number, a term such as conduit, or a role to filter. If you own the plant, start with the 2-1 program requirements and the 3-2 risk assessment. If you buy PLCs or HMIs, look at 4-2 component capability. If you are an integrator, 2-4 and 3-3 govern your work. Export the table to Excel to attach to an RFQ or a security requirements annex.

**Bullets:**

- Owners: 2-1, 2-3, 3-2
- Integrators: 2-4, 3-3
- Product vendors: 4-1, 4-2

#### Security levels in practice

**Body:** Security levels describe the strength of attacker a zone should resist, from casual mistake at SL 1 to a well-funded, motivated attacker at SL 4. The important habit is to set a target per zone from the risk assessment, ask vendors for the capability level of what you buy, and verify the achieved level after commissioning. Most plant-floor zones land at SL 1 or SL 2 today, while safety and critical control zones are argued upward.

#### Zones and conduits

**Body:** The practical heart of the series is partitioning. Group assets that share risk into zones, such as a CNC cell or a packaging line, and treat every link between zones as a conduit with defined rules. This is the language behind firewalls between the office network and the plant, and between cells. A zone and conduit diagram is usually the first deliverable an auditor asks for.

#### Common mistakes

**Body:** Teams often claim they are IEC 62443 compliant after buying a firewall. The series certifies products, processes and service providers separately, and it expects a documented risk assessment, not a product list. Another error is setting every zone to the highest level, which makes projects unaffordable and gets abandoned. Set targets honestly and revisit them yearly.

**Cta:** If you want help mapping your plant zones and conduits to the controls you already have, Netray can run that review with your OT team.

**Faq:**

#### Is IEC 62443 mandatory?

**Answer:** Not by itself. It becomes mandatory when a customer contract, insurer or national regulation references it. Many buyers of automation equipment now ask suppliers for 4-1 process or 4-2 component evidence in tenders.

#### What is the difference between SL-T, SL-C and SL-A?

**Answer:** SL-T is the target you set from risk. SL-C is what a product or system can achieve when properly configured. SL-A is what you actually achieved after installation. The goal is SL-A at or above SL-T.

#### Does it replace NIST CSF or ISO 27001?

**Answer:** No. Those are enterprise frameworks. IEC 62443 is specific to industrial automation and control systems. Many manufacturers use CSF or ISO 27001 for governance and 62443 for the plant floor.

#### Which part do I read first?

**Answer:** Read 1-1 for vocabulary, then 3-2 if you need to do a risk assessment, or 2-1 if you need a security program. Product buyers should go to 4-2 and the vendor's declared capability.

## Search terms

iec 62443 parts explained, iec 62443 security levels sl1 sl2 sl3 sl4, iec 62443 foundational requirements, iec 62443 3-3 system requirements, iec 62443 zones and conduits, ot security standard for manufacturers, iec 62443 cheat sheet

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json