What is IEC 62443 and why is it necessary?

IEC 62443 is an international family of standards addressing the cybersecurity of industrial automation and control systems (IACS). It provides a risk-based framework for protecting control systems against cyber threats in facilities operating operational technology (OT) components such as SCADA, PLC, and DCS.

The increasing digitalization of industry, and the connection of factory networks to enterprise IT networks and the internet, has made production lines vulnerable to new cyber threats. An attack on a control system can have physical consequences such as production stoppages, deterioration of product quality, environmental damage, or endangerment of employee safety. IEC 62443 provides a common language and methodology for systematically assessing and mitigating these risks.

The information on this page is intended as general information to introduce Turkish industrialists and exporters to the rationale behind the standard.

  • It offers a risk-based and tiered approach.
  • It defines different responsibilities for system operators, integrators, and product manufacturers.
  • It is directly related to production continuity and facility safety.

Structure of the Standard Family: Four Layers

IEC 62443 is not a single document, but a family of complementary sections. These sections are divided into four main layers: general concepts, policies and procedures, system-level requirements, and component-level requirements. The sections most frequently cited in practice are summarized below.

  • IEC 62443-2-1: Defines the IACS cybersecurity management program (policies, processes, and organizational requirements) that the organization operating the system must establish.
  • IEC 62443-3-2 addresses risk assessment and the division of the system into safety zones and communication channels (conduits).
  • IEC 62443-3-3 defines system-level technical safety requirements (System Requirements – SR) and their relationship to safety levels (SL).
  • IEC 62443-4-1: Specifies the requirements for a secure development lifecycle of products.
  • IEC 62443-4-2: Defines the technical requirements that control system components (devices, software, network components) must meet.

Seven Fundamental Requirements

The technical requirements of IEC 62443 are grouped under seven fundamental requirements (FR). Both system-level requirements (3-3) and component requirements (4-2) are based on these seven headings. The security level of a region or communication channel is expressed as a vector defined separately for each of these seven requirements.

  • FR1 – Identification and Authentication Control
  • FR2 – Use Control
  • FR3 – System Integrity
  • FR4 – Data Confidentiality
  • FR5 – Restricted Data Flow
  • FR6 – Timely Response to Events
  • FR7 – Resource Availability

The Concept of Security Levels (SL 1-4)

IEC 62443 scales the depth of protection using four security levels (SL). Each level is defined according to the nature of the threat to the system; SL1 represents the lowest level of protection, and SL4 the highest. The aim is to determine a level of protection appropriate to the risk, neither too little nor too much, for each zone.

The standard also distinguishes between different concepts: the targeted safety level (SL-Target), the level of capability a component or system can provide (SL-Capability), and the level actually achieved in the field (SL-Achieved). The difference between the target level determined as a result of the risk assessment and the current capability reveals the measures that need to be taken.

  • SL 1: Protection against accidental or incidental breaches (e.g., incorrect configuration of a device)
  • SL 2: Protection against deliberate breaches carried out with simple tools, low resources, and general skills.
  • SL 3: Protection against deliberate breaches committed with advanced tools, mid-level resources, and IACS-specific skills.
  • SL 4: Protection against advanced attackers with sophisticated tools, substantial resources, and strong motivation.

Zone and Conduit Model

The core architectural concepts of IEC 62443 include zones and conduits. A zone is a grouping of functionally, logically, or physically related entities that share common security requirements. A conduit is a logical or physical grouping of communication channels between two or more zones, carrying data flow between them.

IEC 62443-3-2 addresses the division of the system into zones and channels through a risk assessment process. The system is first placed under consideration, a high-level risk assessment is conducted, and then the system is divided into zones and channels. A detailed risk assessment is performed for each zone and channel; the probability and impact of an attack are evaluated, and a target security level (SL-Target) is determined for each. This approach aims to isolate critical zones, limiting the spread of a breach in one zone to the entire system.

  • Determining the scope of the review and the level of high risk.
  • The system is divided into zones and communication channels (conduits).
  • Detailed risk assessment and assignment of target security level for each region/channel.

The Difference Between IT Security and OT Security

In enterprise information (IT) security, the priority is generally data confidentiality; protecting email, databases, and file systems is paramount. On the operational technology (OT) side, however, the order of priority changes: continuous operability and the integrity of physical processes often take precedence over confidentiality. An unexpected production line shutdown can have far greater and more immediate consequences than a data breach.

OT environments feature long-lasting equipment, controllers that operate for years without updates, and real-time operational requirements. Therefore, routine tasks like patching or rebooting, common in the IT world, must be carefully planned in OT. IEC 62443 takes these differences into account, offering a security framework specific to OT/ICS environments; it acknowledges that simply copying general approaches developed for IT is insufficient.

  • In OT, the priority is mostly accessibility and process integrity.
  • Long-lasting equipment and real-time operation require a special approach.
  • IEC 62443 is based on the risks and constraints specific to OT/ICS.

The EU Machinery Regulation and its Relationship with the Cyber Resilience Act (CRA)

The European Union's new regulations are making cybersecurity a part of product and machine legislation. EU Machinery Regulation (EU) 2023/1230 contains provisions requiring that safety control systems on machines be protected against malicious external interference. This means that machine security can no longer be considered separately from cybersecurity.

The Cyber Resilience Act (CRA) 2024/2847, also known as the Cyber Resilience Act, introduces cybersecurity requirements for products with digital components; it mandates obligations such as secure product design, vulnerability management, and updates throughout the product lifecycle. Sections (4-1) and (4-2) of IEC 62443 concerning secure product development and component requirements can serve as a guiding reference framework for manufacturers in implementing the engineering practices expected by these regulations. The specific scope of this relationship should be addressed through competent engineering assessment, tailored to the product and market.

  • EU Machinery Regulation (EU) 2023/1230: Protection of machine control systems against malicious tampering.
  • CRA (EU) 2024/2847: Cybersecurity obligations for products containing digital elements.
  • IEC 62443 provides a reference framework for the engineering practices expected by these regulations.

Who Needs It? (Roles and Scope)

IEC 62443 treats cybersecurity as a shared responsibility and assigns different tasks to different parties in the supply chain. Factories operating SCADA, PLC or DCS systems, energy and infrastructure facilities, process industries, and organizations providing automation solutions are directly subject to this standard.

The standard defines three key roles: the asset owner, the system integrator who designs and implements the automation solution, and the product supplier who manufactures the control components. Each role has different responsibilities; for example, the asset owner is responsible for risk assessment and determining target safety levels, while the product supplier is responsible for safe design.

  • The organization operating the system (asset owner): risk assessment, target security levels, and operational security.
  • System integrator: design, installation, configuration, testing and commissioning.
  • Product supplier: development of securely designed components and software.

AES Scope and Information Note

AES is a TÜRKAK-accredited Type A inspection body, and its accreditation scope is limited solely to the "6.1 Electrical Installation" area. The IEC 62443 content on this page is intended to create general awareness regarding topics outside the scope of this accreditation.

AES is NOT a Notified Body or certification body; it does not issue IEC 62443 conformity/certification. The content on this page is for informational purposes only and is subject to technical assessment by an authorized engineer. Your organization's IEC 62443 requirements must be assessed by an authorized engineer according to the specific conditions of your facility.

  • AES is accredited only under “6.1 Electrical Installation”.
  • AES does not perform IEC 62443 certification or conformity assessment.
  • The information provided does not replace an assessment by a qualified engineer.

Related Services

Frequently Asked Questions

Which systems does IEC 62443 cover?

The standard covers industrial automation and control systems (IACS). In practice, this includes manufacturing plants, energy and infrastructure systems, and process industries that utilize components such as SCADA, PLC, and DCS.

What do security levels (SL 1-4) represent?

SL 1 to SL 4 represents an increasing level of protection. SL 1 protects against accidental breaches, SL 2 against intentional breaches using simple tools, SL 3 against attacks using advanced and IACS-specific skills, and SL 4 against high-resource and sophisticated attackers.

What do zone and conduit mean?

A zone is a grouping of entities with shared security requirements. A conduit is a grouping of channels that carry communication between two or more zones. This model aims to limit the spread of a breach throughout the entire system by isolating critical zones.

Are IEC 62443 and IT cybersecurity the same thing?

No. In IT security, data confidentiality is generally the priority; in OT/ICS environments, however, continuous availability and physical process integrity take precedence in most cases. IEC 62443 is designed based on these OT-specific priorities and constraints.

What is the relationship between IEC 62443 and the EU Machinery Regulation and CRA?

EU Machinery Regulation (EU) 2023/1230 addresses the protection of machine control systems against malicious tampering, while CRA (EU) 2024/2847 imposes cybersecurity obligations for products containing digital elements. IEC 62443 can be considered a widely accepted reference framework for the engineering practices expected by these regulations.

Does AES issue IEC 62443 certificates?

No. AES is not a Notified Body or certification body and does not issue IEC 62443 conformity/certification. AES is only accredited by TÜRKAK under “6.1 Electrical Installations”. The content on this page is for informational purposes only and is subject to technical assessment by authorized engineers.