TeleTrusT Industrial Firewall Profile for IEC 62443-4-2

Industrial security standards such as IEC 62443 set important frameworks, but they often remain too abstract for practical implementation. Different parties interpret identical requirements differently, which leads to inconsistent assessments and certificates that are hard to compare. The new Industrial Firewall Profile from TeleTrusT shows a way to close this interpretation gap systematically.

Contents

1. Concrete security requirements create a common basis for assessment
2. The problem with abstract requirements in industrial cybersecurity
3. Turning the standard into concrete criteria
4. Transfer to other product categories and domains
5. Regulatory relevance under the Cyber Resilience Act
6. Conformity with the IEC TS 62443-1-5 profile scheme
7. Effects on conformity assessment and the market
8. Outlook

Concrete security requirements create a common basis for assessment

TeleTrusT, the German IT Security Association (Bundesverband IT-Sicherheit e.V.), has revised its Industrial Firewall Profile and published it as a proposal for the upcoming IEC 62443-5 series of standards. The document turns the abstract requirements of IEC 62443-4-2 into concrete requirements for industrial firewalls with router functionality. It creates a common basis for developing, testing, and certifying these critical security components.

The problem with abstract requirements in industrial cybersecurity

IEC 62443 is becoming the central series of standards for cybersecurity in industrial automation and control systems (IACS). Part 4-2 defines technical security requirements for IACS components, but its generic approach leaves room for interpretation in many areas. The component types defined in it do not reach the level of detail needed for consistent conformity assessments.

This level of abstraction leads different stakeholders to interpret identical requirements differently. Test laboratories, manufacturers, and system integrators assess the same security requirements in different ways. This makes products and certificates much harder to compare and creates uncertainty in procurement decisions.

Turning the standard into concrete criteria

The TeleTrusT Industrial Firewall Profile (in English) addresses this problem by detailing the requirements of IEC 62443-4-2 methodically. It specifies industrial firewalls for use in OT networks according to the zones and conduits concept. It also defines precise acceptance criteria for security levels 2 and 3.

The work goes through all seven foundational requirements and interprets each in context. It defines which component requirements apply and explains how to implement them in the specific context of industrial firewalls. The profile considers typical application scenarios, identifies potential risks, and defines matching protective measures.

Transfer to other product categories and domains

The method behind the TeleTrusT profile can be applied to other product categories and industries. Manufacturers of control components, sensors, drive systems, or other industrial components can develop similar profiles that reflect their specific technical characteristics and operating conditions.

Industry sectors with different regulatory frameworks could benefit from specialized profiles. Each of these sectors has its own security priorities and threat scenarios. Examples are the pharmaceutical industry with its validation requirements, energy supply with the requirements of critical infrastructure, and automotive production with its specific production processes and quality standards. Matching profiles could address these systematically.

Regulatory relevance under the Cyber Resilience Act

The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, gives the TeleTrusT profile particular relevance. The CRA requires manufacturers of products with digital elements to meet cybersecurity requirements. Applying harmonized European standards is recognized as an important way to demonstrate conformity.

The profile itself assigns industrial firewalls to the CRA category “firewall,” not “router,” and targets security level 2 for the CRA. Under Annex III of the CRA, firewalls are important products of class II (point 2), while routers are in class I (point 12). Under Article 7(1), what counts is the core functionality of the product. For class II products, Article 32(3) requires third-party conformity assessment: EU-type examination (module B) followed by internal production control (module C), full quality assurance (module H), or, where available, a European cybersecurity certification scheme at assurance level at least “substantial.” Self-assessment by the manufacturer alone is not possible for firewalls, even when harmonized standards are applied.

Standardization committees can take up the profile when they develop harmonized standards relevant to the CRA. Until specific harmonized standards are available, it serves as practical guidance for manufacturers of industrial firewalls. Making security requirements concrete in a systematic way makes it easier to develop conforming products and to assess them. It gives small and mid-sized companies without dedicated standards expertise a structured basis for implementation in particular.

Conformity with the IEC TS 62443-1-5 profile scheme

The document consistently follows IEC TS 62443-1-5, which defines the normative scheme for IEC 62443 security profiles. This technical specification sets out nine profile requirements, ranging from the content structure and the selection of requirements to risk evaluation and validation.

The TeleTrusT profile meets all criteria defined in IEC TS 62443-1-5 and can serve as a reference implementation for future profiles. Because it follows the scheme consistently, it fits into the wider IEC 62443 system of standards. It can also be combined with other profiles into coherent security architectures.

Effects on conformity assessment and the market

Making the requirements concrete creates a uniform and objective basis for assessing industrial firewalls. Test laboratories get standardized, traceable assessment criteria, which makes certifications much more consistent and comparable. Users can assess different products objectively against uniform security criteria and get a more reliable basis for their procurement decisions.

This standardization also has a lasting effect on the market. Manufacturers can align their development processes with clearly defined, uniform requirements. This gives them more planning certainty and more efficient development cycles. Competition also becomes fairer, because all market participants are assessed against identical criteria. The focus shifts from interpreting the standard to the quality of the technical implementation.

Outlook

TeleTrusT is submitting the Industrial Firewall Profile to the IEC as an official proposal for an IEC 62443-5 profile. The profile is available free of charge on the TeleTrusT website.

The method for making abstract security standards concrete can serve as a blueprint for other product categories. Profiles like this one can be taken up in standardization committees as input for harmonized standards relevant to the CRA. They can also serve as practical guidance until specific standards are available.

In an increasingly regulated environment, closing the interpretation gap between abstract requirements and practical implementation is becoming a deciding success factor for manufacturers, test laboratories, and users.