Compliance & ContractsFree referencePDF, Excel, Word exportDiscrete Manufacturing

IEC 62443 Reference: Parts, Foundational Requirements and Security Levels

IEC 62443 is a series of standards, not one document, which makes it hard to know which part answers your question. This searchable reference lists the parts, the seven foundational requirements, the four security levels and the maturity levels in plain language, so IT managers and buyers can find the right piece quickly.

Download:

Group	Reference	Name or level	What it means in practice
Standard part	62443-1-1	Terminology, concepts and models	Defines core concepts such as zones, conduits, security levels and foundational requirements. Read first for vocabulary.
Standard part	62443-1-2	Master glossary of terms and abbreviations	Common definitions used across the series.
Standard part	62443-1-3	System security conformance metrics	Describes how conformance to system security requirements can be measured.
Standard part	62443-1-4	IACS security lifecycle and use cases	Describes the security lifecycle and example use cases for industrial automation and control systems.
Standard part	62443-2-1	Security program requirements for IACS asset owners	What a plant owner or operator needs in its security management programme: policies, roles, risk, awareness and incident handling.
Standard part	62443-2-3	Patch management in the IACS environment	Guidance for asset owners and suppliers on tracking, testing and deploying patches in control system environments.
Standard part	62443-2-4	Security program requirements for IACS service providers	Capabilities integrators and maintenance providers should show when they design, install or support control systems.
Standard part	62443-2-5	Implementation guidance for IACS asset owners	Practical guidance for applying the asset owner programme requirements.
Standard part	62443-3-1	Security technologies for IACS	Reviews security technologies, such as authentication, firewalls and encryption, and how they apply to control systems.
Standard part	62443-3-2	Security risk assessment for system design	Method for partitioning a system into zones and conduits and setting a target security level for each.
Standard part	62443-3-3	System security requirements and security levels	Technical requirements for a whole system, organised by foundational requirement and security level.
Standard part	62443-4-1	Secure product development lifecycle requirements	Process requirements for suppliers building control system products, such as secure design, testing and patch handling.
Standard part	62443-4-2	Technical security requirements for IACS components	Requirements for components such as embedded devices, host devices, network devices and software applications.
Foundational requirement	FR 1	Identification and authentication control	Identify and authenticate users, devices and software before granting access. Covers accounts, passwords, multi-factor.
Foundational requirement	FR 2	Use control	Enforce the privileges of authenticated users, with least privilege and audit of use.
Foundational requirement	FR 3	System integrity	Protect the system from unauthorised change, including software integrity and communication integrity.
Foundational requirement	FR 4	Data confidentiality	Protect information in storage and transit from unauthorised disclosure.
Foundational requirement	FR 5	Restricted data flow	Segment the control system with zones and conduits so data only flows where intended.
Foundational requirement	FR 6	Timely response to events	Log, monitor and report security events and respond in time.
Foundational requirement	FR 7	Resource availability	Keep the system available under attack or failure: denial of service protection, backup, recovery and redundancy.
Security level	SL 1	Protection against casual or coincidental violation	Guards against accidental mistakes and unplanned misuse.
Security level	SL 2	Protection against intentional violation using simple means	Attacker has low resources, generic skills and low motivation.
Security level	SL 3	Protection against intentional violation using sophisticated means	Attacker has moderate resources, IACS-specific skills and moderate motivation.
Security level	SL 4	Protection against intentional violation using sophisticated means with extended resources	Attacker has extended resources, IACS-specific skills and high motivation.
Security level concept	SL-T	Target security level	The level a zone should reach, set by the risk assessment in 62443-3-2.
Security level concept	SL-C	Capability security level	What a component or system can achieve when correctly configured.
Security level concept	SL-A	Achieved security level	The level actually reached in the installed system.
Concept	Zone	Security zone	A grouping of assets with the same security requirements, for example all HMIs on one production line.
Concept	Conduit	Communication path between zones	A controlled channel, for example a firewall rule set, that carries traffic between zones.
Maturity level	ML 1	Initial	Process is performed but often ad hoc and not consistently documented.
Maturity level	ML 2	Managed	Process is planned and executed according to written policy, at least at the level of a project.
Maturity level	ML 3	Defined	Process is defined across the organisation and followed consistently.
Maturity level	ML 4	Improving	Process is measured and improved using metrics and feedback.

Plain-language summaries of a standard that is published and sold by IEC, ISA and national bodies. This table is a navigation aid, not a substitute for the standard. Part numbers and titles are updated over time, so confirm current editions before citing them in contracts.

Optional help writing 62443 supplier requirements

Tell us the equipment you are buying and we will suggest which parts and levels to reference in your specification.

Optional. The tool and every export work without this. No spam.

How to use the reference

Type a keyword such as patch, supplier, risk or FR 5 into the search box, or filter by group. Use the Standard part rows to find which document covers a topic, the Foundational requirement rows to organise technical controls, and the Security level rows to understand what a target level means. Export the filtered list to Excel to paste into a requirement spec, a supplier questionnaire or an audit plan.

Asset owners: start with 2-1, 2-3 and 3-2
Integrators: 2-4 and 3-3
Product vendors and buyers: 4-1 and 4-2

How the series is organised

The series has four groups. Group 1 sets vocabulary and models. Group 2 covers policies and procedures for asset owners and service providers, including patching. Group 3 covers the system: how to assess risk and partition into zones and conduits (3-2) and what a system must provide at each security level (3-3). Group 4 covers products: how suppliers develop securely (4-1) and what components must support (4-2). Different roles meet different parts, which is why a supplier may hold a 4-1 process certification while a plant works toward a system level target.

Security levels and requirements together

Each foundational requirement is implemented through system requirements and component requirements, with enhancements that raise the security level. A target level is assigned per zone by risk assessment: a safety or quality critical production cell may need a higher level than a break room printer network. Capability level describes what a component can do and achieved level describes the final installed result. Treat the levels as a design language, not a score you can read off a single device.

Common mistakes

Common misreadings include treating the standard as a checklist you can pass, setting one security level for the whole plant, and asking suppliers for 62443 certification without saying which part. Buyers should state part, scope and level, for example component requirements from 4-2 at a named level, or a supplier development process under 4-1. Another mistake is skipping the risk assessment, which is the step that makes security levels meaningful.

Frequently Asked Questions

Which part of IEC 62443 applies to a plant owner?

Mainly 62443-2-1 for the security programme, 2-3 for patch management and 3-2 for risk assessment and zone design. Asset owners also reference 3-3 when specifying system requirements to integrators.

What is the difference between SL-T, SL-C and SL-A?

SL-T is the target level for a zone from risk assessment, SL-C is what components or systems are capable of when properly configured, and SL-A is the level actually achieved in the installed system. The goal is SL-A meeting SL-T.

Can a device be IEC 62443 certified?

Component certifications against 62443-4-2 and supplier process certifications against 4-1 exist through accredited bodies. Check the scope and security level on the certificate. Certification of a device does not make a whole plant compliant.

How does IEC 62443 relate to ISO 27001?

ISO 27001 defines an information security management system, mostly for IT. IEC 62443 addresses industrial automation and control systems, including safety and availability concerns. Many companies use both: 27001 for the organisation, 62443 for the plants.

If you need help turning IEC 62443 references into purchase specifications or an ERP and MES integration design for a plant, Netray can review it with you.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools