What Changed with IEC TS 63074
IEC 63074, “Safety of machinery – Security aspects related to functional safety of safety-related control systems”, deals with security aspects of functional safety in machinery. It has changed significantly. It was first published as a technical report (IEC TR 63074:2019) and has now been converted into a technical specification (IEC TS 63074:2023).
The change marks a shift from a purely informative document to a normative specification. It sets clear requirements for manufacturers, integrators, and users of safety-related control systems (SCS) in industrial automation.
Contents
From technical report (TR) to technical specification (TS)
A technical report (TR) provides general guidance and background information but contains no normative requirements. A technical specification (TS), by contrast, defines concrete requirements and good practices that are relevant for compliance and implementation.
The decision to convert IEC 63074 into a technical specification was driven by the growing importance of cybersecurity in functional safety. As industrial automation systems become more connected, cyberattacks pose a serious threat to safety-related control systems.
By converting it into a TS, the IEC ensures that safety and cybersecurity are integrated more systematically, with clear requirements for risk assessment, security measures, and verification processes.
With the move to a technical specification, many manufacturers ask which parts of IEC TS 63074 they actually have to implement. If you want to clarify this for your machinery or control systems, a short call is a good place to start.
What is new in IEC TS 63074
The new technical specification brings several significant changes that the technical report did not contain.
Cybersecurity and functional safety (new clause 6)
One of the most important additions is clause 6, which deals with cybersecurity risks in safety systems for machinery. This clause:
- defines security risks related to functional safety
- describes possible cyber threats and attack vectors
- introduces protective measures, including:
- multi-factor authentication
- network segmentation
- data encryption
- protection against tampering
Structured security risk management
The TS introduces a detailed risk assessment process and defines strategies for responding to security risks to reduce threats. This includes:
- triggers for security risk assessments (Annex B): events that require security risks to be reassessed
- approaches to threat modeling (Annex A): identifying possible attack points and vulnerabilities
- mitigation strategies, including protective measures for software, remote access control, and system integrity checks
Concrete security measures
Unlike the TR, which gave general recommendations, the TS contains specific security measures to ensure the secure use of safety-related control systems (SCS). These include:
- authentication and access control measures to prevent unauthorized changes
- measures to preserve data confidentiality, protecting safety-critical data against cyberattacks
- response mechanisms for security breaches, such as logging security incidents and notifying system administrators
Information flow between the parties involved
The TS adds a new example (C.3) that describes how information should be exchanged between:
- device manufacturers
- machine manufacturers
- system integrators
- end users of machinery
This ensures that security updates, patches, and vulnerability information are passed on efficiently.
Main differences between IEC TR 63074 and IEC TS 63074
The following table summarizes the main differences:
| Aspect | Technical report (TR 63074:2019) | Technical specification (TS 63074:2023) |
|---|---|---|
| Purpose | Informative guidance on security risks in functional safety | Normative technical specification with concrete requirements |
| Structure | Conceptual discussion of security risks | More structured requirements with specific protective measures |
| Cybersecurity | Cyber risks mentioned briefly | Separate clause (clause 6) on cybersecurity and functional safety |
| Risk assessment | General discussion of security risks | More detailed approach to assessing and responding to security risks |
| Protective measures | General recommendations | More concrete protective measures (authentication, encryption, access control) |
| Annexes | Conceptual explanations | Threat modeling, risk assessment triggers, and use cases |
| Alignment with IEC standards | Limited reference to IEC 62443 | Direct alignment with IEC 62443 and ISO/IEC 27001 |
| Use cases | Descriptive scenarios | Detailed examples for the design and operation phases |
Why the update matters
The new TS gives machine manufacturers clear guidance on how to develop and implement security measures for safety-related control systems (SCS). It also helps companies comply with the IEC 62443 series for cybersecurity and integrate security systematically into functional safety.
System integrators now have a structured approach to assessing security risks in machine automation. The defined protective measures ensure that safety functions are not impaired.
As connectivity increases, machine operators in particular are more exposed to cyberattacks. The new TS gives operators clear security guidelines. These include verifying security measures, handling security updates and patches, and protecting industrial automation against cyber threats.
What the change means overall
The move from IEC TR 63074 (technical report) to IEC TS 63074 (technical specification) is a significant step forward for the security of functional safety control systems in industry.
With its clear security requirements, the new technical specification provides a structured and practical framework for protecting safety-related control systems (SCS) against cyber threats.
IEC TS 63074 noticeably changes what is expected of manufacturers, integrators, and operators of safety-related control systems. If you want to understand what this means in concrete terms for your products or projects and how to proceed in a structured way, a no-obligation call is a good way to work this out.
