IEC 62443 Certification
An IEC 62443 certification confirms that a product, system, or process meets the security requirements of the IEC 62443 series for industrial automation and control systems (IACS). It is relevant for product suppliers, system integrators, and asset owners. The series itself defines no certification scheme, so testing organizations offer their own programs based on its parts.
Industrial automation and control systems are increasingly networked, which makes them more exposed to cyberattacks. IEC 62443 gives a structured, internationally recognized framework for testing and assessing their security. With a certification, you can show that your products, systems, or processes meet the requirements of the standard.
Certification is more than a quality seal. The preparation helps you find and fix weaknesses, and the series covers everything from secure component development to the integration of complex systems. This page explains why companies get certified, which certification schemes exist, what each certificate actually says, how the process works, and what it costs.
Contents
Why get IEC 62443 certified
Where no regulation requires it, a certification is first of all a marketing and sales tool. Companies use it to stand out from competitors and in their promotion.
In some industries, such as the railway industry, many operators of automation systems now require certified suppliers, components, and systems. There, a certification is a condition for market access.
Implementing the requirements of an internationally recognized standard, and having compliance checked during certification, also reduces many cybersecurity risks.
The individual reasons vary and often depend on the company's situation. The following points are further arguments for certification.
Improve cybersecurity
- Meet security requirements: IEC 62443 defines specific security requirements for different areas, from organizational processes to technical components. Certification confirms that these requirements are met.
- Reduce cybersecurity risks: By implementing the security measures set out in the standard, companies can identify and fix weaknesses before attackers exploit them.
- Continuous improvement: Certification encourages a culture of continuously improving security processes and technologies.
Build reputation, trust, and credibility
- Win and keep customers: An IEC 62443 certification tells customers that a company meets high security standards, which helps to win new customers and keep existing ones.
- Brand reputation: An IEC 62443 certification strengthens the brand and shows that the company can work securely and reliably.
- Global recognition: Companies certified to IEC 62443 are recognized worldwide for their security standards, which makes market access easier in different regions.
- Competitive advantage: Companies with an IEC 62443 certification can set themselves apart from competitors and strengthen their market position.
Avoid legal and financial consequences
- Regulatory compliance: An IEC 62443 certification helps companies meet the requirements of the Cyber Resilience Act and other regulatory frameworks. This can protect companies from legal consequences and high penalties.
- Legal certainty: Implementing IEC 62443 covers large parts of the Cyber Resilience Act and other regulatory requirements, which helps companies avoid legal consequences and possible fines.
- Financial security: You avoid costs that security incidents can cause, including data loss, production downtime, and damage to your reputation.
- No presumption of conformity: An IEC 62443 certificate does not give a presumption of conformity with the CRA as long as IEC 62443 is not listed as a harmonized standard. For details, see CRA conformity assessment.
IEC 62443 certification schemes
There are many certification schemes for IEC 62443. The series itself does not define any. It provides a framework that testing organizations use to develop their own programs, which are based on the different parts of IEC 62443.
Schemes of certification bodies
Several testing organizations, such as the TÜV companies in Germany, have developed their own certification schemes for IEC 62443 and had them accredited. These schemes offer separate certifications for the individual parts of IEC 62443 and confirm that companies and products meet the requirements of the standard.
Some of the best-known testing and certification organizations are:
These organizations are usually accredited. Accreditation subjects them to strict quality controls, which protect the integrity and reliability of their certifications.
ISASecure certification
ISASecure is a certification program based on IEC 62443 and developed by the ISA Security Compliance Institute (ISCI). Its main goals are to reduce security risks and to increase trust in industrial automation systems through strict testing and certification procedures.
ISASecure certifications are recognized worldwide and give companies and their customers an additional level of assurance. Each certification demonstrates compliance with the relevant parts of IEC 62443:
- Component Security Assurance (CSA)
Based on IEC 62443-4-2. It assesses the security of components used in industrial automation and control systems. - System Security Assurance (SSA)
Based on IEC 62443-3-3. It focuses on the security of complete automation systems and ensures that the entire system, including all components and communication paths, meets the requirements of IEC 62443. - Security Development Lifecycle Assurance (SDLA)
Based on IEC 62443-4-1. It examines the security processes and practices that manufacturers apply when developing automation products. The goal is to make sure that security is considered throughout the development lifecycle.
By testing against the requirements of IEC 62443, ISASecure checks that products and systems resist cyberattacks and that security risks are reduced.
IECEE CB Scheme
The IECEE CB Scheme is an international system for the mutual recognition of test reports and certificates for electrotechnical equipment and components. Its goal is to facilitate international trade by simplifying national certification and approval.
IECEE has developed an Industrial Cyber Security Program for the CB Scheme. It provides a framework for assessment against IEC 62443 and leads to an IECEE certificate of conformity for industrial cybersecurity capabilities.
IEC 62443 supplies the requirements for processes and technical capabilities. Under the Industrial Cyber Security Program, the certification body assesses the capabilities that the applicant uses to develop, integrate, and/or maintain specific products or solutions.
Integrating IEC 62443 into the established CB Scheme makes a globally recognized assessment and certification of industrial cybersecurity capabilities possible.
Comparison of IEC 62443 certification schemes
| What is certified | IECEE CB Scheme | ISASecure | TÜV SÜD Mark |
|---|---|---|---|
| Management system for operation (IEC 62443-2-1 / ISO/IEC 27001) | No | Since 2026 (ISASecure ACSSA) 2) | Yes |
| Integration processes (IEC 62443-2-4) | Yes | No 2) | Yes |
| Reference architectures / blueprints (IEC 62443-2-4 and -3-3) | Yes 1) | No 2) | Yes |
| Development processes (IEC 62443-4-1) | Yes | Yes (ISASecure SDLA) | Yes |
| (Control) systems (IEC 62443-4-1 and -3-3) | Yes 1) | Yes (ISASecure SSA) | Yes |
| Products / components (IEC 62443-4-1 and -4-2) | Yes | Yes (ISASecure CSA) | Yes |
1) Both standards can be certified separately. Combining them with processes is not mandatory.
2) ISASecure does not certify the integration and maintenance processes of service providers. Since February 17, 2026, the ISASecure ACSSA scheme (version 1.0.0) certifies asset owners. It evaluates a deployed automation and control system and the asset owner's policies and procedures against IEC 62443-2-1, 2-4, 3-2, and 3-3.
The schemes differ in more than their names: scope, required evidence, and process vary. If you want to clarify which scheme fits your product portfolio and your role (manufacturer, integrator, or asset owner), we can work through this in a short call.
Types of IEC 62443 certification
The certifications on offer can be grouped by the part of the standard they are based on. Depending on the scheme, there are dependencies between them. For example, most schemes require conformity with IEC 62443-4-1 for an IEC 62443-4-2 certification.
Each certification has its own requirements and goals:
Management systems for OT (IEC 62443-2-1)
- Focuses on implementing an information security management system (ISMS) for industrial automation and control systems (IACS).
- Assesses whether an organization can establish and maintain an effective ISMS.
- Reviews risk management processes and security policies.
- Particularly relevant for asset owners of IACS and for organizations that manage critical infrastructure.
Integration and maintenance processes (IEC 62443-2-4)
- Focuses on organizational security processes.
- Checks how security management systems are implemented and maintained.
- Aimed at organizations that design, develop, implement, and maintain industrial automation and control systems (IACS).
- Assesses the organization's security processes and practices, including patch management, configuration management, and incident response.
- Particularly relevant for system integrators and service providers in industrial automation.
Systems and reference architectures (IEC 62443-3-3)
- Assesses systems against security requirements.
- Looks at the whole system, including how security measures are integrated.
- Aimed at complete systems and checks whether they meet the security requirements.
- Particularly relevant for asset owners selecting secure automation solutions.
- Considers aspects such as zones and conduits and system hardening.
Development processes (IEC 62443-4-1)
- Covers the development process for security-relevant components.
- Assesses security practices throughout the product lifecycle, including design, development, testing, and maintenance.
- Focuses on integrating security into the software development process (secure development lifecycle).
- Reviews practices such as threat modeling, secure design, secure coding, and vulnerability management.
- Particularly relevant for manufacturers of IACS components and software.
Components (IEC 62443-4-2)
- Assesses the security features of individual components.
- Aimed at individual components such as controllers, network devices, and software.
- Assesses whether the components meet the specific security requirements, including functions such as authentication, encryption, and logging.
- Distinguishes between component types: software applications, embedded devices, host devices, and network devices.
- Particularly relevant for manufacturers of IACS components and for end users selecting secure products.
What each IEC 62443 certification means
It is often unclear what a given certification actually says. Comparing the certification statements of the different certifications helps.
Certification statements confirm conformity with the specific requirements of the IEC 62443 standards. Their exact meaning can usually be found in the documents of the certification scheme, and it often differs in detail between schemes.
The following table gives a simplified overview of what each certification means:
| What is certified | Standards | Simplified meaning |
|---|---|---|
| Development process | IEC 62443-4-1 at maturity level 2 | “We can develop securely.” The company is able to develop secure components and systems. |
| Development process | IEC 62443-4-1 at maturity level 3 or 4 | “We develop securely.” The company develops components and systems securely. |
| Component / product | IEC 62443-4-2 (requires IEC 62443-4-1 at maturity level 3 or 4) | “Our product is secure / was developed securely.” The component was developed securely and provides certain security functions. |
| System | IEC 62443-3-3 with IEC 62443-4-1 at maturity level 3 or 4 | “Our system is secure / was developed securely.” The system was designed securely and provides certain security functions. |
| System | IEC 62443-3-3 (without process) | “Our system has security features.” The system provides certain security functions. |
| Integration processes | IEC 62443-2-4 at maturity level 2 | “We can integrate securely.” The company is able to integrate and maintain automation solutions securely. |
| Integration processes | IEC 62443-2-4 at maturity level 3 or 4 | “We integrate securely.” The company integrates and maintains automation solutions securely. |
| Reference architectures | IEC 62443-2-4 with IEC 62443-3-3 | “Our solution is secure and we can integrate it securely.” The system provides certain security functions, and the company is able to integrate and build it securely. |
| Management system | IEC 62443-2-1 | “We manage our security risks.” The organization has suitable responsibilities and processes to manage security risks in OT. |
For process certifications, make sure that all departments and sites involved in delivering the service (for example, development or integration) are within the scope of the certification.
Certifications of security functions (IEC 62443-3-3 and IEC 62443-4-2) without a link to processes (such as IEC 62443-4-1 or IEC 62443-2-4) have limited value. Without verified processes, these certificates only confirm that certain security functions exist. Contrary to a common assumption, they do not confirm that the product is secure or that the functions make sense.
“Process versus product” and maturity levels are where misunderstandings about what a certificate actually says arise most often. If you want to define your target statement and the right certification path clearly, we can sort this out with you in a no-obligation call.
The IEC 62443 certification process
IEC 62443 certification is a multi-stage process. It usually starts with an inquiry or an order from the company. A preparation phase follows, which typically includes a pre-assessment or pre-audit. It determines the company's current state and whether it is ready for the different certification levels (ML 2, ML 3).
Based on the results, the company can aim for IEC 62443-4-1 certification at ML 2 or ML 3. If it does not yet meet the requirements, it defines and implements the necessary policies and processes, either on its own or with suitable consultants. Another essential step is checking product conformity, which makes sure the product meets the requirements. Additional security features may have to be implemented before certification is possible.
The certification itself usually consists of a document review followed by an on-site audit. Based on these reviews, the auditors prepare a detailed report and submit it to the responsible certification body, which decides whether to issue the certificate. After successful certification, the company receives an official certificate and a detailed report.
The following diagram shows the path to product certification under IEC 62443-4-1 and IEC 62443-4-2.
To keep the certificate valid, regular surveillance audits take place during the recertification cycle. This structured process ensures continued compliance with the security requirements and supports the ongoing improvement of cybersecurity in industrial automation and control systems.
The role of surveillance audits
After a certificate has been issued, the certified organization or system must keep meeting the requirements. Regular surveillance audits, also called surveillances, check this.
How often they take place depends on the certification scheme, but they are usually annual. As a rule, annual surveillance audits take place while the certificate is valid. When that period ends, the certificate is renewed or extended, which requires a full recertification.
During these regular audits, the certifier checks that the security measures are still in place and effective. This ensures continued compliance with IEC 62443 and a high level of security over time.
Cost of IEC 62443 certification
The cost of an IEC 62443 certification varies widely and depends on many factors. The main ones are:
- the specific standards to be certified
- the certification scheme (such as TÜV, ISASecure, or the CB Scheme)
- the target maturity level of the processes
- the size and complexity of the company or product
Company structure matters too, especially the number of sites and employees. So does the complexity of the development processes, for example whether development is distributed globally or takes place at one site. The type of product or system also has a major effect on cost: a simple sensor takes less effort than a complex distributed control system (DCS) or SCADA system. Optional services from the certifier, such as workshops or pre-assessments, can add to the total.
Based on our experience, rough estimates are possible:
- Process certifications (IEC 62443-4-1 or IEC 62443-2-4) at maturity level 2 can cost between €15,000 and €35,000. Higher maturity levels (3 or 4) cost more, but the effort is lower if an ML 2 certification is already in place.
- Product certifications under IEC 62443-4-2, based on an already certified IEC 62443-4-1 process, typically cost between €25,000 and €50,000.
- System or blueprint certifications under IEC 62443-2-4 or -3-3 should be budgeted at between €30,000 and €50,000.
These figures are only rough guidelines and can differ considerably in individual cases.
On top of the initial certification come the costs of annual surveillance audits and recertifications in the following years while the certificate remains valid. They depend heavily on the certification scheme, the scope of the certificate (for example, the number of sites), the validity period, and the certifier. In our experience, they range from a few thousand euros per year for simple surveillance audits to almost the full cost of the initial certification.
Are you planning an IEC 62443 certification and unsure about the expected costs, the budget, or the choice of certifier? We are happy to share our experience.
Certified companies, products, and systems
Transparency about issued certificates varies considerably between certification schemes and testing organizations. Both testing organizations and certificate holders often see information about certifications as competitively sensitive. As a result, they often publish the results (the certificates) only to a limited extent.
Still, most testing organizations let you verify individual certificates, usually through an online interface or database.
You can verify certificates with these resources:
- TÜV SÜD: certificate finder
- TÜV Rheinland: Certipedia
When using these databases, search for the specific standard (for example, IEC 62443-4-1).
Certificates issued under the CB Scheme are listed in the IECEE certificate database.
ISASecure publishes an overview of its certificates, organized by certification type (SDLA, CSA, and SSA): ISASecure certified organizations and products.
These resources let you check the validity and authenticity of certificates and find out about certified companies, products, and systems. For specific questions or doubts, contact the certification body or the certified company directly to get more detailed information.
IEC 62443 certification FAQ
What role do TÜV companies and other testing organizations play?
Independent testing and certification organizations carry out IEC 62443 certifications. In Germany, the TÜV organizations play a central role. TÜV stands for Technischer Überwachungsverein (technical inspection association), and the companies include TÜV SÜD, TÜV Rheinland, TÜV NORD, SGS-TÜV Saar, TÜV Hessen, TÜV Thüringen, and TÜV AUSTRIA. They compete with each other but share the well-known TÜV brand.
As independent bodies, they check and confirm that the process or product meets the requirements of IEC 62443. Each develops its own certification schemes, which are accredited by a national accreditation body, in Germany the DAkkS (Deutsche Akkreditierungsstelle). Accreditation ensures the competence and independence of the testing organization.
Some TÜV companies have also obtained recognition from specialized organizations such as ISASecure or IECEE. This allows them to issue certificates under these specific schemes, which improves international recognition and comparability. Besides certification itself, they often offer related services such as training, pre-audits, or preparation support. Their role therefore ranges from neutral assessment to supporting companies through the certification process, while the independence and integrity of the assessment must always be preserved.
Why do some certificates state a security level and others do not?
The question of security levels in IEC 62443 certificates is complex. It reflects the different scopes and intentions of the parts of the standard. Security levels express resistance against threats and refer primarily to systems. Certifications under IEC 62443-3-3, which applies at system level, therefore usually state a security level.
For product certifications under IEC 62443-4-2, the situation is more complicated. A blanket security level for a single component can distort the intention of IEC 62443. The security of a complete system does not depend only on the security properties of its components. The standard provides that missing security requirements at component level can be offset by compensating countermeasures at system level.
Still, product management and marketing teams often want comparable levels for their components, similar to safety integrity levels (SIL) in functional safety. IEC 62443-4-2 does not directly provide for such levels. Many testing organizations nevertheless state a security level for a component if all applicable requirements of that level are met.
This practice is disputed because it may oversimplify system security. It can, however, help users judge whether a component may be suitable for a system with certain security requirements. A component security level must always be seen in the context of the whole system and does not guarantee the security of the end product.
Is certification at maturity level 1 possible?
No. Certification at maturity level 1 (ML 1) is not possible under IEC 62443, and it would not make sense. ML 1 describes a state in which product development is ad hoc and not sufficiently documented. Structured, repeatable processes, which certification requires, are missing at this stage.
At ML 1, development activities and decisions are not documented in a traceable way, so an external certifier cannot review and assess them objectively. Certifications usually start at ML 2, where defined and documented processes allow security practices to be applied consistently. ML 2 ensures that basic management practices are established and that processes can be planned, traced, and repeated. This is the minimum for a credible and meaningful certification under IEC 62443.
How can you compare IEC 62443 certificates?
Comparing IEC 62443 certificates from different certifiers and schemes is complex and requires a careful look at the details. Without additional explanations and documentation, certificates are often not directly comparable.
For a sound assessment, request and review all available annexes, attachments, and, where possible, the test reports behind the certificates. The certified scope must be clearly defined and visible. You also need a detailed overview of which specific requirements were met at which level.
A meaningful comparison is only possible if you know both the scope and the foundational requirements or component requirements that were met. If this essential information is missing, question the credibility of the certificate or the certifier. Transparent and detailed evidence of the requirements met is an indicator of the quality and trustworthiness of the certification process.
Which certification scheme (ISASecure, TÜV, CB Scheme) do I need?
The right scheme depends on several factors, above all the target market and the industry. In Europe and large parts of Asia, the TÜV certificates have the highest acceptance and recognition. They are widely known and valued as a mark of quality in many industries.
The CB Scheme (Certification Body Scheme) has some acceptance and recognition in Asia but is less common in Europe. It can be useful if you sell a product in several Asian markets, because it facilitates the mutual recognition of test results between participating countries.
ISASecure is established mainly in the process industry. The oil and gas industry has driven it and has been heavily involved in its development and implementation. If your company works mainly in this sector or serves customers in the process industry, ISASecure may be the preferred choice.
Base your decision on a careful analysis of the requirements of your target markets, the relevant industry standards, and your long-term business goals. In some cases, a combination of schemes makes sense to achieve broad market coverage and acceptance.
An IEC 62443 certification is rarely a purely technical decision. Scope, sites, role model, evidence, and the chosen scheme determine effort and outcome. If you need guidance on how to plan a certification realistically and set it up correctly, we can clarify this in a no-obligation call.