ISASecure Certification for Industrial Cybersecurity
ISASecure is a global certification program for the cybersecurity of industrial automation and control systems (IACS). It is based on the internationally recognized IEC 62443 series of standards and provides a framework for assessing and certifying cybersecurity in industrial environments. As industrial automation becomes more connected, cybersecurity plays a decisive role, and ISASecure is one way to demonstrate it.
Contents
ISASecure and IEC 62443
ISASecure is built on the standards of the IEC 62443 series, which define internationally recognized good practice for industrial cybersecurity. The ISASecure certifications are designed to cover the requirements of these standards and put them into practice. This allows companies to demonstrate conformity with IEC 62443 through a structured certification process.
ISASecure and the ISA
ISASecure was created by the International Society of Automation (ISA). The ISA is a global non-profit organization that promotes technical competence and excellence in automation. ISASecure is an important part of the ISA's work to establish and promote standards and good practice for industrial cybersecurity.
ISASecure certifications at a glance
ISASecure offers several certifications that cover different aspects of industrial cybersecurity:
- Security Development Lifecycle Assurance (SDLA)
SDLA focuses on the development process for products and systems. It is based on IEC 62443-4-1 and ensures that security is considered throughout the lifecycle. A successful SDLA certification is a prerequisite for a product or system certification under CSA, ICSA, or SSA. - Component Security Assurance (CSA)
This certification covers the security of software applications, embedded devices, host devices, and network devices as defined in IEC 62443-4-2. - IIoT Component Security Assurance (ICSA)
ICSA is a product certification specifically for components of the industrial internet of things (IIoT). It builds on IEC 62443-4-2 and adds IIoT-specific requirements. - System Security Assurance (SSA)
SSA covers all requirements for control systems under IEC 62443-3-3. - ACS Security Assurance (ACSSA)
ACSSA certifies operators of industrial plants (asset owner facilities) against IEC 62443-2-1, 2-4, 3-2, and 3-3. ISASecure developed it as a new program and now lists it among its available certifications.
Which ISASecure certification makes sense depends heavily on the product, the system boundary, and the target market. If you want to clarify whether SDLA, CSA/ICSA, or SSA is relevant for your use case, a short call can help.
Who issues ISASecure certifications
ISASecure certifications are carried out by recognized certification bodies. Well-known providers include:
- TÜV Rheinland
- TÜV SÜD (through TÜV SÜD PSB in Singapore)
The list of recognized certification bodies can change. You can find the complete and current list on the official ISASecure website.
Where ISASecure matters
ISASecure has become particularly important in the oil and gas industry. This is mainly due to the active involvement of large companies such as ExxonMobil, Chevron, and Saudi Aramco. They are represented as asset owners in the ISA Security Compliance Institute (ISCI). Through this strong influence, ISASecure has become established in the oil and gas sector in particular, with a clear focus on the United States.
In this sector, ISASecure certifications have a high reputation and are often regarded as the gold standard. In Europe and Asia, however, certifications based directly on IEC 62443, without the specific ISASecure framework, have mostly prevailed. This regional difference shows that, although the underlying standards are global, implementation and certification vary with the geographic and industrial context.
For companies that operate internationally, the question is when ISASecure makes sense and when a direct IEC 62443 certification is enough. We are happy to discuss in a no-obligation call which strategy fits your markets and customers.
Assessment and outlook
ISASecure has established itself as a leading certification program for industrial cybersecurity, with a particular focus on the oil and gas industry and on North America. Its close alignment with IEC 62443 shows its relevance, although acceptance still varies by region.
The extensions into IIoT and into the certification of operating sites remain interesting to watch. A central challenge will be to keep the balance between industry-specific specialization and broad applicability. Companies that operate globally should include both ISASecure and direct IEC 62443 certification in their strategy so they can respond flexibly to different market requirements.
Frequently asked questions about ISASecure
Which name is correct: ISA 62443, IEC 62443, or ISA/IEC 62443?
The official and internationally recognized name of the series is IEC 62443.
The form ISA/IEC 62443 is also used, especially in North America and by the International Society of Automation (ISA) itself. It reflects the ISA's significant contribution to the original development of the series before the IEC adopted it as an international standard.
The name ISA 62443 on its own is less common and should be avoided, because it does not reflect the international recognition by the IEC.
In the global professional community and in official international contexts, IEC 62443 has become the established name. It emphasizes the status as an international standard and is used worldwide by industry, regulators, and in the technical literature.
Whatever name is used, the content and requirements of the standards are the same. The choice of name can, however, vary with the regional context or the specific field of application.
Is ISASecure certification fully compliant with IEC 62443?
The ISASecure certifications largely conform to the IEC 62443 series and are based directly on its requirements. The current certification programs (CSA, SSA, SDLA) correspond to the relevant parts of IEC 62443. Some newer certifications, such as ICSA (for IIoT components) and ACSSA (for operating sites), add specific aspects to the IEC 62443 requirements. The original standards do not cover these aspects, or not in detail.
The predecessor of the CSA certification, called EDSA (Embedded Device Security Assurance), was developed before IEC 62443-4-2 was published. EDSA did not require a secure development process under IEC 62443-4-1 or SDLA, which conflicted with the later requirements of IEC 62443-4-2. This older certification has been discontinued and is no longer used, so that full conformity with the current IEC 62443 standards is ensured.
Overall, ISASecure aims for close alignment with IEC 62443 while responding to new developments and specific industry needs. This keeps the certifications in line with the international standards and relevant in practice.
Is ISASecure certification mandatory?
No law or regulation makes ISASecure certification mandatory. It has, however, become highly relevant in practice in certain industrial sectors, especially oil and gas. Many operators in these industries require certified components for their automation solutions and plants in their tenders and procurement processes.
In many cases, however, ISASecure certification is not the only option accepted. Certifications based directly on IEC 62443, without the specific ISASecure framework, are often accepted as equivalent. This reflects the global acceptance of IEC 62443 and allows flexibility in choosing suppliers and products.
This practice shows that the focus is on meeting the underlying security standards, whether this is demonstrated through ISASecure or other recognized certification schemes. Companies that operate in these sectors or do business with them should know what their potential customers expect and weigh the benefits of the different certifications carefully.
Is penetration testing required for ISASecure certification?
Yes. Penetration tests play an important role in the ISASecure certification process, in more than one way.
A central part of ISASecure certification is compliance with a secure development lifecycle under SDLA. This requires regular penetration tests of the components or systems. These tests are an integral part of the continuous security process during the development and maintenance of the product.
As part of the certification process itself, ISASecure also requires a thorough vulnerability assessment called the “Vulnerability Identification Test” (VIT). The certification body carries out this assessment as part of the evaluation for certification.
The combination of regular penetration tests by the manufacturer and the independent vulnerability assessment by the certification body ensures a thorough review of the security of the product or system. It helps to identify and fix potential vulnerabilities early, which increases the overall security and reliability of the certified components or systems.
If you are aiming for ISASecure certification, you should therefore plan penetration tests and vulnerability assessments as essential elements of your security strategy and certification preparation.
ISASecure is an established certification model, but it is not necessary in every context. If you want to understand how ISASecure relates to IEC 62443, the CRA, and other regulatory requirements, we can sort this out in a structured, no-obligation call.