# IEC 62443 Reference: Parts, Foundational Requirements and Security Levels

> Source: https://netray.co/tools/iec-62443-standard-parts-and-requirements-reference
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A searchable plain-language guide to the IEC 62443 series: which part covers what, the seven foundational requirements and security levels 1 to 4.

## Category

compliance-legal

## Industry

Discrete Manufacturing

## Audience

- IT manager
- OT engineer
- CISO
- Procurement

## Tool

**Kind:** worksheet

**Mode:** reference

**Columns:**

#### Group

**Key:** group

**Type:** text

#### Reference

**Key:** ref

**Type:** text

#### Name or level

**Key:** name

**Type:** text

#### What it means in practice

**Key:** summary

**Type:** text

**Rows:**

#### Terminology, concepts and models

**Group:** Standard part

**Ref:** 62443-1-1

**Summary:** Defines core concepts such as zones, conduits, security levels and foundational requirements. Read first for vocabulary.

#### Master glossary of terms and abbreviations

**Group:** Standard part

**Ref:** 62443-1-2

**Summary:** Common definitions used across the series.

#### System security conformance metrics

**Group:** Standard part

**Ref:** 62443-1-3

**Summary:** Describes how conformance to system security requirements can be measured.

#### IACS security lifecycle and use cases

**Group:** Standard part

**Ref:** 62443-1-4

**Summary:** Describes the security lifecycle and example use cases for industrial automation and control systems.

#### Security program requirements for IACS asset owners

**Group:** Standard part

**Ref:** 62443-2-1

**Summary:** What a plant owner or operator needs in its security management programme: policies, roles, risk, awareness and incident handling.

#### Patch management in the IACS environment

**Group:** Standard part

**Ref:** 62443-2-3

**Summary:** Guidance for asset owners and suppliers on tracking, testing and deploying patches in control system environments.

#### Security program requirements for IACS service providers

**Group:** Standard part

**Ref:** 62443-2-4

**Summary:** Capabilities integrators and maintenance providers should show when they design, install or support control systems.

#### Implementation guidance for IACS asset owners

**Group:** Standard part

**Ref:** 62443-2-5

**Summary:** Practical guidance for applying the asset owner programme requirements.

#### Security technologies for IACS

**Group:** Standard part

**Ref:** 62443-3-1

**Summary:** Reviews security technologies, such as authentication, firewalls and encryption, and how they apply to control systems.

#### Security risk assessment for system design

**Group:** Standard part

**Ref:** 62443-3-2

**Summary:** Method for partitioning a system into zones and conduits and setting a target security level for each.

#### System security requirements and security levels

**Group:** Standard part

**Ref:** 62443-3-3

**Summary:** Technical requirements for a whole system, organised by foundational requirement and security level.

#### Secure product development lifecycle requirements

**Group:** Standard part

**Ref:** 62443-4-1

**Summary:** Process requirements for suppliers building control system products, such as secure design, testing and patch handling.

#### Technical security requirements for IACS components

**Group:** Standard part

**Ref:** 62443-4-2

**Summary:** Requirements for components such as embedded devices, host devices, network devices and software applications.

#### Identification and authentication control

**Group:** Foundational requirement

**Ref:** FR 1

**Summary:** Identify and authenticate users, devices and software before granting access. Covers accounts, passwords, multi-factor.

#### Use control

**Group:** Foundational requirement

**Ref:** FR 2

**Summary:** Enforce the privileges of authenticated users, with least privilege and audit of use.

#### System integrity

**Group:** Foundational requirement

**Ref:** FR 3

**Summary:** Protect the system from unauthorised change, including software integrity and communication integrity.

#### Data confidentiality

**Group:** Foundational requirement

**Ref:** FR 4

**Summary:** Protect information in storage and transit from unauthorised disclosure.

#### Restricted data flow

**Group:** Foundational requirement

**Ref:** FR 5

**Summary:** Segment the control system with zones and conduits so data only flows where intended.

#### Timely response to events

**Group:** Foundational requirement

**Ref:** FR 6

**Summary:** Log, monitor and report security events and respond in time.

#### Resource availability

**Group:** Foundational requirement

**Ref:** FR 7

**Summary:** Keep the system available under attack or failure: denial of service protection, backup, recovery and redundancy.

#### Protection against casual or coincidental violation

**Group:** Security level

**Ref:** SL 1

**Summary:** Guards against accidental mistakes and unplanned misuse.

#### Protection against intentional violation using simple means

**Group:** Security level

**Ref:** SL 2

**Summary:** Attacker has low resources, generic skills and low motivation.

#### Protection against intentional violation using sophisticated means

**Group:** Security level

**Ref:** SL 3

**Summary:** Attacker has moderate resources, IACS-specific skills and moderate motivation.

#### Protection against intentional violation using sophisticated means with extended resources

**Group:** Security level

**Ref:** SL 4

**Summary:** Attacker has extended resources, IACS-specific skills and high motivation.

#### Target security level

**Group:** Security level concept

**Ref:** SL-T

**Summary:** The level a zone should reach, set by the risk assessment in 62443-3-2.

#### Capability security level

**Group:** Security level concept

**Ref:** SL-C

**Summary:** What a component or system can achieve when correctly configured.

#### Achieved security level

**Group:** Security level concept

**Ref:** SL-A

**Summary:** The level actually reached in the installed system.

#### Security zone

**Group:** Concept

**Ref:** Zone

**Summary:** A grouping of assets with the same security requirements, for example all HMIs on one production line.

#### Communication path between zones

**Group:** Concept

**Ref:** Conduit

**Summary:** A controlled channel, for example a firewall rule set, that carries traffic between zones.

#### Initial

**Group:** Maturity level

**Ref:** ML 1

**Summary:** Process is performed but often ad hoc and not consistently documented.

#### Managed

**Group:** Maturity level

**Ref:** ML 2

**Summary:** Process is planned and executed according to written policy, at least at the level of a project.

#### Defined

**Group:** Maturity level

**Ref:** ML 3

**Summary:** Process is defined across the organisation and followed consistently.

#### Improving

**Group:** Maturity level

**Ref:** ML 4

**Summary:** Process is measured and improved using metrics and feedback.

**Notes:** Plain-language summaries of a standard that is published and sold by IEC, ISA and national bodies. This table is a navigation aid, not a substitute for the standard. Part numbers and titles are updated over time, so confirm current editions before citing them in contracts.

## Content

**Intro:** IEC 62443 is a series of standards, not one document, which makes it hard to know which part answers your question. This searchable reference lists the parts, the seven foundational requirements, the four security levels and the maturity levels in plain language, so IT managers and buyers can find the right piece quickly.

**Sections:**

#### How to use the reference

**Body:** Type a keyword such as patch, supplier, risk or FR 5 into the search box, or filter by group. Use the Standard part rows to find which document covers a topic, the Foundational requirement rows to organise technical controls, and the Security level rows to understand what a target level means. Export the filtered list to Excel to paste into a requirement spec, a supplier questionnaire or an audit plan.

**Bullets:**

- Asset owners: start with 2-1, 2-3 and 3-2
- Integrators: 2-4 and 3-3
- Product vendors and buyers: 4-1 and 4-2

#### How the series is organised

**Body:** The series has four groups. Group 1 sets vocabulary and models. Group 2 covers policies and procedures for asset owners and service providers, including patching. Group 3 covers the system: how to assess risk and partition into zones and conduits (3-2) and what a system must provide at each security level (3-3). Group 4 covers products: how suppliers develop securely (4-1) and what components must support (4-2). Different roles meet different parts, which is why a supplier may hold a 4-1 process certification while a plant works toward a system level target.

#### Security levels and requirements together

**Body:** Each foundational requirement is implemented through system requirements and component requirements, with enhancements that raise the security level. A target level is assigned per zone by risk assessment: a safety or quality critical production cell may need a higher level than a break room printer network. Capability level describes what a component can do and achieved level describes the final installed result. Treat the levels as a design language, not a score you can read off a single device.

#### Common mistakes

**Body:** Common misreadings include treating the standard as a checklist you can pass, setting one security level for the whole plant, and asking suppliers for 62443 certification without saying which part. Buyers should state part, scope and level, for example component requirements from 4-2 at a named level, or a supplier development process under 4-1. Another mistake is skipping the risk assessment, which is the step that makes security levels meaningful.

**Cta:** If you need help turning IEC 62443 references into purchase specifications or an ERP and MES integration design for a plant, Netray can review it with you.

**Faq:**

#### Which part of IEC 62443 applies to a plant owner?

**Answer:** Mainly 62443-2-1 for the security programme, 2-3 for patch management and 3-2 for risk assessment and zone design. Asset owners also reference 3-3 when specifying system requirements to integrators.

#### What is the difference between SL-T, SL-C and SL-A?

**Answer:** SL-T is the target level for a zone from risk assessment, SL-C is what components or systems are capable of when properly configured, and SL-A is the level actually achieved in the installed system. The goal is SL-A meeting SL-T.

#### Can a device be IEC 62443 certified?

**Answer:** Component certifications against 62443-4-2 and supplier process certifications against 4-1 exist through accredited bodies. Check the scope and security level on the certificate. Certification of a device does not make a whole plant compliant.

#### How does IEC 62443 relate to ISO 27001?

**Answer:** ISO 27001 defines an information security management system, mostly for IT. IEC 62443 addresses industrial automation and control systems, including safety and availability concerns. Many companies use both: 27001 for the organisation, 62443 for the plants.

## Search terms

iec 62443 parts list, iec 62443 security levels, iec 62443 foundational requirements, iec 62443-3-3 requirements, iec 62443 explained, iec 62443 cheat sheet, iec 62443-2-1 asset owner, iec 62443 4-2 component requirements

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json