IEC 62443 Security Levels and Parts Reference
IEC 62443 is the standard that most OT security conversations eventually point to, yet few people can say which part answers their question. This lookup maps parts, security levels, foundational requirements and vocabulary in one searchable table.
| Item | Group | What it covers | Mostly used by |
|---|---|---|---|
62443-1-1 | Part | Terminology, concepts and models, including the foundational requirements and security levels | Everyone starting out |
62443-2-1 | Part | Security program requirements for IACS asset owners | Plant owner, IT security lead |
62443-2-3 | Part | Patch management in the IACS environment | Asset owner, service provider |
62443-2-4 | Part | Security program requirements for IACS service providers (integrators, maintainers) | System integrator, vendor |
62443-3-2 | Part | Security risk assessment for system design, including partitioning into zones and conduits | OT architect, integrator |
62443-3-3 | Part | System security requirements and security levels | System designer, buyer |
62443-4-1 | Part | Secure product development lifecycle requirements | Product vendor |
62443-4-2 | Part | Technical security requirements for IACS components (embedded devices, host, network, software) | Product vendor, buyer |
SL 1 | Security level | Protection against casual or coincidental violation | Risk assessor |
SL 2 | Security level | Protection against intentional violation using simple means, low resources, generic skills and low motivation | Risk assessor |
SL 3 | Security level | Protection against intentional violation using sophisticated means, moderate resources, IACS specific skills and moderate motivation | Risk assessor |
SL 4 | Security level | Protection against intentional violation using sophisticated means, extended resources, IACS specific skills and high motivation | Risk assessor |
SL-T | Security level type | Target security level for a zone, set by the risk assessment | Asset owner |
SL-C | Security level type | Capability security level a component or system can deliver when configured correctly | Vendor, buyer |
SL-A | Security level type | Achieved security level of the installed system, verified after commissioning | Integrator, asset owner |
FR 1 | Foundational requirement | Identification and authentication control (IAC) | Designer |
FR 2 | Foundational requirement | Use control (UC): enforce assigned privileges | Designer |
FR 3 | Foundational requirement | System integrity (SI): protect against unauthorized manipulation | Designer |
FR 4 | Foundational requirement | Data confidentiality (DC) | Designer |
FR 5 | Foundational requirement | Restricted data flow (RDF): segmentation of zones and conduits | Network architect |
FR 6 | Foundational requirement | Timely response to events (TRE): audit logs and incident reporting | Security operations |
FR 7 | Foundational requirement | Resource availability (RA): resist denial of service and keep essential functions | Designer, operations |
Zone | Term | A grouping of logical or physical assets that share common security requirements | OT architect |
Conduit | Term | A path for communication between zones that carries its own security requirements | OT architect |
IACS | Term | Industrial automation and control system: people, process and technology that operate a plant | Everyone |
Asset owner | Role | The organization that operates the IACS, normally the manufacturer | Plant management |
Product supplier | Role | The party that develops and supports a control product such as a PLC or HMI | Vendor |
Summary of structure only, based on the published series. Buy the standard from IEC or ISA for exact requirement text and check which editions apply to your contracts.
Zone and conduit review
Optional expert review of your plant zone diagram against 62443 practice.
Optional. The tool and every export work without this. No spam.
How to use the table
Type a part number, a term such as conduit, or a role to filter. If you own the plant, start with the 2-1 program requirements and the 3-2 risk assessment. If you buy PLCs or HMIs, look at 4-2 component capability. If you are an integrator, 2-4 and 3-3 govern your work. Export the table to Excel to attach to an RFQ or a security requirements annex.
- Owners: 2-1, 2-3, 3-2
- Integrators: 2-4, 3-3
- Product vendors: 4-1, 4-2
Security levels in practice
Security levels describe the strength of attacker a zone should resist, from casual mistake at SL 1 to a well-funded, motivated attacker at SL 4. The important habit is to set a target per zone from the risk assessment, ask vendors for the capability level of what you buy, and verify the achieved level after commissioning. Most plant-floor zones land at SL 1 or SL 2 today, while safety and critical control zones are argued upward.
Zones and conduits
The practical heart of the series is partitioning. Group assets that share risk into zones, such as a CNC cell or a packaging line, and treat every link between zones as a conduit with defined rules. This is the language behind firewalls between the office network and the plant, and between cells. A zone and conduit diagram is usually the first deliverable an auditor asks for.
Common mistakes
Teams often claim they are IEC 62443 compliant after buying a firewall. The series certifies products, processes and service providers separately, and it expects a documented risk assessment, not a product list. Another error is setting every zone to the highest level, which makes projects unaffordable and gets abandoned. Set targets honestly and revisit them yearly.
Frequently Asked Questions
Is IEC 62443 mandatory?
Not by itself. It becomes mandatory when a customer contract, insurer or national regulation references it. Many buyers of automation equipment now ask suppliers for 4-1 process or 4-2 component evidence in tenders.
What is the difference between SL-T, SL-C and SL-A?
SL-T is the target you set from risk. SL-C is what a product or system can achieve when properly configured. SL-A is what you actually achieved after installation. The goal is SL-A at or above SL-T.
Does it replace NIST CSF or ISO 27001?
No. Those are enterprise frameworks. IEC 62443 is specific to industrial automation and control systems. Many manufacturers use CSF or ISO 27001 for governance and 62443 for the plant floor.
Which part do I read first?
Read 1-1 for vocabulary, then 3-2 if you need to do a risk assessment, or 2-1 if you need a security program. Product buyers should go to 4-2 and the vendor's declared capability.
If you want help mapping your plant zones and conduits to the controls you already have, Netray can run that review with your OT team.
Related Tools
OT Network Segmentation Maturity Assessment
Ten questions that score your plant network segmentation from flat network to enforced zones, with next steps for each band.
Developer ToolsCommon OT and ICS Protocol Ports Reference
Default TCP and UDP ports used by industrial protocols and the IT services that sit beside them, with a firewall risk note for each.
Compliance & ContractsOT Vendor Remote Access Hardening Checklist
A checklist of controls for machine builders, integrators and ERP partners who connect to your plant, grouped by identity, path, monitoring and lifecycle.
Compliance & ContractsNIST CSF 2.0 Categories Reference for Manufacturers
The six functions and 22 categories of NIST CSF 2.0, translated into a plain example for a factory so you can map your controls quickly.
More Compliance & Contracts tools
See all- ISO 14001 Internal Audit Checklist
- Environmental Compliance Obligations Register Worksheet
- AI Governance Policy Template for Manufacturers
- AI Acceptable Use Policy Template for ERP Users
- Annualized Loss Expectancy Cyber Risk Calculator
- Cyber Insurance Retention Tradeoff Calculator
- MFA Rollout Risk Reduction Calculator
- Cyber Risk Register with ALE Worksheet
- SAP SoD Residual Risk Score Calculator