ISO 8102-20 Cybersecurity for Elevators, Escalators, and Moving Walks
As elevators, escalators, and moving walks become more connected and digital, they also become exposed to cyberattacks. The standard ISO 8102-20 was developed to address this. It sets sector-specific cybersecurity requirements that cover the entire lifecycle of these systems. The standard is based on IEC 62443 and gives the sector a tailored basis for reducing security risks.
Contents
Scope
The standard describes cybersecurity requirements for the following lifecycle phases of the so-called “equipment under control” (EUC):
- Development (including secure development processes)
- Manufacturing
- Installation
- Operation and maintenance
- Decommissioning
It applies to new elevators, escalators, and moving walks designed to the ISO 8100 series or comparable standards that can connect to external systems such as building networks, cloud services, or service tools, even if the connection exists only temporarily through equipment brought on site. It does not apply to EUC installed before the standard was published in August 2022.
The standard is aimed primarily at product suppliers and system integrators. It supports the responsibility of the asset owner indirectly, through appropriate documentation and recommendations.
Structure and content
ISO 8102-20 sets out the following main aspects:
Secure development lifecycle
The requirements of IEC 62443-4-1:2018 for the secure development process apply directly, from security management through threat modeling, secure design, and testing to security guidelines for operation. The standard adds sector-specific provisions: training must also cover safety expertise for the equipment, and the threat model must cover the entire lifecycle of the EUC.
Security requirements for products and systems
The standard assigns the functions of the EUC to four domains: SIL-rated safety functions, essential functions, alarm functions, and other functions. For the first three, it sets a minimum target security level for each of the seven foundational requirements (FRs) of IEC 62443, ranging from SL 1 for alarm functions to SL 3 for identification and authentication of safety functions. Security controls are selected from IEC 62443-3-3 and IEC 62443-4-2. For alarm functions, availability takes precedence over confidentiality.
Verification and validation
The testing requirements of IEC 62443-4-1 apply directly: security requirements testing, threat mitigation testing, vulnerability testing, penetration testing, and independence of testers.
Management of security issues and updates
Processes for receiving, reviewing, assessing, addressing, and disclosing security-related issues, and for qualifying, documenting, and promptly delivering security updates, each based on IEC 62443-4-1.
Provision of information
The information for use is aimed at asset owners, maintenance providers, and other stakeholders. It describes how to integrate, configure, and maintain the security of the EUC, states the target security level, explains all security settings and their defaults, and includes guidance on hardening, secure operation, account management, reporting vulnerabilities, and secure decommissioning.
How ISO 8102-20 relates to IEC 62443
ISO 8102-20 complements IEC 62443 by defining sector-specific requirements for EUC. The standard refers directly to IEC 62443-4-1 (secure development lifecycle) and to IEC 62443-4-2 (technical security requirements). It also uses the security level model of IEC 62443-3-3 and sets specific requirements for alarm, safety, and essential functions.
The main difference lies in the application focus. IEC 62443 targets industrial automation and control systems (IACS) in general. ISO 8102-20 addresses the specific risks and requirements of elevators and escalators, for example their connections to building networks and cloud services.
The close link to IEC 62443 ensures a high degree of compatibility and lets manufacturers use existing certification processes.
What the standard offers manufacturers and integrators
ISO 8102-20 is a useful tool for manufacturers and integrators who want to address the cybersecurity of elevators, escalators, and moving walks systematically. Because it builds on IEC 62443, it applies established security practice consistently. Its sector-specific requirements make it easier to comply with current and future cybersecurity regulation.
ISO 8102-20 does not stand alone. It sits alongside other requirements such as IEC 62443, the Machinery Regulation, the Cyber Resilience Act (CRA), and the Radio Equipment Directive (RED). If you want to clarify what role the standard plays for your products, development processes, or approvals, a no-obligation call can help you sort this out.
