ISO/IEC 27001 and IEC 62443 for Product Manufacturers
ISO/IEC 27001 and IEC 62443 are central standards for product manufacturers and for operators of IT and OT environments. They take different approaches to information security and product security, and they overlap in certain areas. This article explains how the two standards work together and where their focus differs.
Contents
Differences between ISO/IEC 27001 and IEC 62443
ISO/IEC 27001 is an internationally recognized standard for information security management systems (ISMS). It aims to protect information, whether it is processed in IT, OT, or cloud environments. The standard ensures that companies understand, reduce, and monitor their information security risks. One relevant part is its requirement for a secure development lifecycle (SDLC) for applications that the company deploys. This covers applications developed and operated in IT and cloud environments, but not products.
IEC 62443, by contrast, focuses specifically on the security of industrial automation and control systems (OT). It concentrates on protecting OT environments and on secure product development. Parts IEC 62443-4-1 and IEC 62443-4-2 in particular deal with the secure development of products sold to customers, such as industrial automation solutions. For manufacturers of industrial products that also use cloud services, IEC 62443-4-1 applies if the cloud applications are to fall within the scope of an IEC 62443 certification.
Where ISO/IEC 27001 and IEC 62443 overlap
ISO/IEC 27001 and IEC 62443 overlap in certain areas, especially in application development.
ISO/IEC 27001 requires a secure development lifecycle (SDLC) for all applications that a company deploys (control 8.25). This necessarily includes cloud applications, because ISO/IEC 27001 covers information security across all areas, whether the application runs in IT, OT, or cloud environments. However, ISO/IEC 27001 does not cover the development of industrial products.
IEC 62443-4-1 also sets requirements for a secure development lifecycle, but it focuses on the secure development of products that are sold. This matters especially for manufacturers of industrial products that also use cloud services. If a cloud application falls within the scope of an IEC 62443 certification, you should develop that application under IEC 62443-4-1.
Some applications are not industrial products or do not fall under an IEC 62443 certification. For these, ISO/IEC 27034 or another method that meets the requirements of ISO/IEC 27001 is often sufficient. ISO/IEC 27034 is designed specifically for secure application development and therefore fits better into the framework of ISO/IEC 27001. The similar numbering of the two standards reflects this.
IEC 62443-4-1 requires a secure development environment for products (SM-7) and the protection of private keys used in product development (SM-8). You can meet both requirements by implementing ISO/IEC 27001, provided the development environment is part of the ISMS scope. Here the two standards complement each other well, because the secure development environment and the protection of cryptographic keys play a central role in both ISO/IEC 27001 and IEC 62443-4-1.
These overlaps show that companies must decide which standard to apply to the development of applications and products, depending on their specific requirements and the certification scope they aim for.
ISO/IEC 27001 and IEC 62443-4-1 requirements compared
The following table compares the relevant controls of ISO/IEC 27001 with the requirements of IEC 62443-4-1 for developing secure applications and products:
| ISO/IEC 27001 | IEC 62443-4-1 |
|---|---|
| 8.24: Use of cryptography | SM-8: Controls for private keys |
| 8.25: Secure development life cycle | SM-1: Development process |
| 8.26: Application security requirements | Practice 2: Specification of security requirements |
| 8.27: Secure system architecture and engineering principles | Practice 3: Secure by design |
| 8.28: Secure coding | Practice 4: Secure implementation |
| 8.29: Security testing in development and acceptance | Practice 5: Security verification and validation testing |
| 8.31: Separation of development, test and production environments | SM-7: Development environment security |
What this means for manufacturers
ISO/IEC 27001 and IEC 62443 give manufacturers of industrial products and application developers a solid basis for securing their IT and OT environments and for developing secure products and applications.
ISO/IEC 27001 deals with information security in IT, OT, and cloud environments, while IEC 62443-4-1 specifically addresses product security, that is, the secure development of industrial products. At certain points, such as the development environment and the protection of private keys, the two standards complement each other very well. Here companies benefit from implementing ISO/IEC 27001, because these controls also cover the corresponding requirements of IEC 62443-4-1.
Companies that develop both industrial products and cloud applications should be aware of these overlaps and combine the standards deliberately, so that they meet both regulatory requirements and security requirements.
