IEC 62443 Industrial Cybersecurity Standards
IEC 62443 is the international series of standards for the security of industrial automation and control systems (IACS). It sets requirements for the organizations that develop, integrate, maintain, and operate these systems. Attacks on industrial control systems are becoming more sophisticated, so manufacturers and integrators need a reliable way to secure critical infrastructure and industrial plants.
This page explains how the series is organized, what its individual parts cover, and which concepts matter most for manufacturers and integrators.
Contents
Structure of IEC 62443
The series is divided into six groups:
- General: concepts, terminology, and models
- Policies & Procedures
- System: requirements at system level
- Component: requirements at component level
- Profiles
- Evaluation
Each group contains several parts that cover different aspects of network and system security. Together, they range from terminology and risk assessment to technical security requirements and evaluation methods.
The parts marked green in the figure are published and form the foundation of the series. They cover basic concepts and terminology as well as specific technical requirements and evaluation methods. They give organizations concrete guidance and requirements for implementing and maintaining secure industrial automation and control systems.
The parts marked red are planned or under development. They show how IEC 62443 is evolving to address new technologies, threats, and good practices for industrial automation and control systems.
Published parts
These parts of IEC 62443 are already published:
| Standard | Title | Description |
|---|---|---|
| IEC TS 62443-1-1 (Edition 1, 2009) | Industrial communication networks – Network and system security – Part 1-1: Terminology, concepts and models | This technical specification defines the basic concepts, terms, and models for the entire IEC 62443 series. It establishes a common understanding of central topics such as the foundational requirements, zone models, roles, and principles of industrial cybersecurity in IACS. All other parts build on it. It gives everyone who develops, integrates, or operates industrial equipment a reliable frame of reference for all security requirements. |
| IEC TS 62443-1-5 (Edition 1, 2023) | Security for industrial automation and control systems – Part 1-5: Scheme for IEC 62443 security profiles | This technical specification sets out a scheme for creating cybersecurity profiles within the IEC 62443 series. The profiles define specific cybersecurity requirements tailored to particular industries or fields of application. They make it easier to use standardized terminology and ensure that cybersecurity measures are interpreted consistently across industries. |
| IEC PAS 62443-1-6 (Edition 1, 2025) | Security for industrial automation and control systems – Part 1-6: Application of the 62443 series to the Industrial Internet of Things (IIoT) | This specification explains how to apply the IEC 62443 series to IIoT systems. It addresses the challenges of the IIoT, such as additional communication channels, new ways of distributing functions, and growing cyber risks. It gives practical guidance on which parts of the series are relevant for IIoT scenarios and how to derive the right requirements. Its main goal is to help asset owners and service providers implement IIoT solutions securely in line with IEC 62443, or to define the corresponding security requirements for manufacturers. |
| IEC 62443-2-1 (Edition 2, 2024) | Security for industrial automation and control systems – Part 2-1: Security program requirements for IACS asset owners | This standard describes the requirements an IACS asset owner must meet in its security program (formerly cyber security management system, CSMS). It specifies which policies, processes, and organizational measures an asset owner should introduce to ensure the secure operation of industrial automation and control systems. |
| IEC PAS 62443-2-2 (Edition 1, 2025) | Security for industrial automation and control systems – Part 2-2: IACS security protection scheme | This specification describes how to design, verify, implement, and maintain a security protection scheme (SPS). An SPS combines technical, physical, and organizational protection measures to manage cyber risks during the operation of an IACS. It helps asset owners establish effective procedures and mechanisms to keep their IACS secure in day-to-day operation. |
| IEC TR 62443-2-3 (Edition 1, 2015) | Security for industrial automation and control systems – Part 2-3: Patch management in the IACS environment | This technical report describes how patch management in industrial automation and control systems should work so that updates reduce risk without disrupting operations. It is intended for asset owners, system integrators, maintenance service providers, and manufacturers that provide or install patches. |
| IEC 62443-2-4 (Edition 2, 2023) | Security for industrial automation and control systems – Part 2-4: Security program requirements for IACS service providers | This standard sets requirements for the security-related processes that IACS service providers can offer asset owners during the integration and maintenance of an automation solution. |
| IEC TR 62443-3-1 (Edition 1, 2009) | Industrial communication networks – Network and system security – Part 3-1: Security technologies for industrial automation and control systems | This technical report assesses various cybersecurity tools, measures, and technologies for industrial automation and control systems. |
| IEC 62443-3-2 (Edition 1, 2020) | Security for industrial automation and control systems – Part 3-2: Security risk assessment for system design | This standard sets out the method for system design and risk assessment of an IACS as the system under consideration (SUC). It helps you define security zones and communication paths and select suitable protection measures. |
| IEC 62443-3-3 (Edition 1, 2013) | Industrial communication networks – Network and system security – Part 3-3: System security requirements and security levels | This standard defines technical security requirements for industrial automation and control systems, based on the foundational requirements. |
| IEC 62443-4-1 (Edition 1, 2018) | Security for industrial automation and control systems – Part 4-1: Secure product development lifecycle requirements | This standard defines the process requirements for the secure development of products used in industrial automation and control systems. For more on this standard, see our article IEC 62443-4-1 Secure Product Development Lifecycle. |
| IEC 62443-4-2 (Edition 1, 2019) | Security for industrial automation and control systems – Part 4-2: Technical security requirements for IACS components | This standard defines technical security requirements for products used in industrial automation and control systems, based on the foundational requirements. |
| IEC TS 62443-6-1 (Edition 1, 2024) | Security for industrial automation and control systems – Part 6-1: Security evaluation methodology for IEC 62443-2-4 | This technical specification defines an evaluation methodology that supports repeatable and reproducible evaluation results against the requirements of IEC 62443-2-4. It provides a uniform method for security and conformity assessments and is relevant for asset owners, service providers, manufacturers, and independent testing organizations. |
| IEC TS 62443-6-2 (Edition 1, 2025) | Security for industrial automation and control systems – Part 6-2: Security evaluation methodology for IEC 62443-4-2 | This technical specification describes how to evaluate the security of IACS components against IEC 62443-4-2 in a uniform and reproducible way. It is intended for manufacturers, service providers, asset owners, and testing and certification bodies. It describes the evaluation methodology and assumes that the component under evaluation has already been developed in a secure development lifecycle in line with IEC 62443-4-1. |
Parts in development or revision
IEC 62443 is under continuous development to keep pace with the changing requirements of industrial cybersecurity. These parts are currently being drafted or planned:
| Standard | Title | Description |
|---|---|---|
| IEC 62443-1-2 (new) | Master glossary of terms and abbreviations | This part is to collect the terms and abbreviations of the entire series in one place. |
| IEC 62443-1-3 (new) | System security conformance metrics | This part is to define metrics for measuring how well a system meets the security requirements. |
| IEC 62443-1-4 (new) | IACS security lifecycle and use cases | This part is to describe the security lifecycle of an IACS and illustrate it with use cases. |
| IEC 62443-2-5 (new) | Implementation guidance for IACS asset owners | This part is to give asset owners guidance on implementing a security program for their IACS. |
| IEC 62443-5-x (new) | Profiles for IEC 62443 | The parts of the IEC 62443-5-x series will contain the cybersecurity profiles defined according to IEC 62443-1-5. They describe detailed cybersecurity requirements for specific industries or fields of application and give a structured approach to implementing cybersecurity measures based on the standardized profiles of IEC 62443-1-5. |
Core concepts of IEC 62443
IEC 62443 is built on a set of fundamental concepts for securing industrial automation and control systems. They run through all parts of the series and include risk management, defense in depth, zones and conduits, and a lifecycle approach to security.
Understanding and applying these concepts helps organizations build a security architecture that addresses both current and future threats. This section explains the concepts and what they mean for implementing IEC 62443 in practice.
Roles
IEC 62443 distinguishes several roles in industrial automation and control: the asset owner, the maintenance service provider, the integration service provider, and the product supplier. Their responsibilities can be clearly defined. Each role contributes to systems that meet current technical requirements and remain secure and resilient over time.
Asset owner
The asset owner is responsible for operating the IACS environment. It must operate the system efficiently and securely according to defined policies and procedures. This role also includes managing the system lifecycle and overseeing maintenance and integration activities to ensure continuous operation.
Maintenance service provider
The maintenance service provider is responsible for the ongoing maintenance of the IACS. This includes regular checks, updates, and repairs as needed to preserve the integrity and performance of the system. The maintenance service provider must follow the specific policies and procedures for system maintenance.
Integration service provider
The integration service provider designs and implements new systems or upgrades to existing systems within the IACS environment. It is responsible for commissioning and validating these systems and must ensure that they meet all operational requirements and standards.
Product supplier
The product supplier develops and supports the components that make up the control systems, including software applications, embedded devices, network devices, and host devices. It must ensure that its products can be integrated effectively into the IACS environment and are supported throughout their lifecycle.
In practice, it is often unclear which IEC 62443 requirements apply to which role. This is especially true for manufacturers with several roles, for example product supplier and integrator. If you want to clarify this for your company, a short call can help.
Coverage of the entire lifecycle
IEC 62443 covers the entire lifecycle of an industrial automation and control system, from development through integration to operation.
This approach ensures that cybersecurity is addressed in every phase of the IACS lifecycle, from product development and system integration to long-term operation and maintenance.
Defense in depth
Defense in depth plays a central role in IEC 62443 and supports the protection of industrial control systems against a wide range of threats. The concept recognizes that a single protection measure is often not enough to reach a security objective. Instead, several layered security measures should be implemented at the same time.
The series therefore requires security mechanisms at different levels of the network architecture: physical security, network security, host security, and application security. Each layer addresses specific weaknesses and adds protection if an outer layer is breached.
For example, an intrusion detection system can detect that an attacker has got past a firewall and trigger further protection mechanisms. If a component cannot meet certain security requirements on its own, IEC 62443 requires suitable compensating countermeasures to be listed in the component documentation. This ensures that the security requirements are met once the component is integrated into an overall system.
Maturity levels and security levels
IEC 62443 defines two concepts for evaluating industrial automation and control systems: maturity levels (ML) and security levels (SL).
Maturity levels rate the quality of a product supplier's processes and range from ML 1 to ML 4:
| Level | Name | Definition |
|---|---|---|
| ML 1 | Initial | The manufacturer usually develops products ad hoc and often without sufficient documentation. This can affect project continuity and the repeatability of the process. |
| ML 2 | Managed | The manufacturer can manage product development according to written policies and can show that its staff are qualified to carry out the process. However, it lacks the experience to apply all written policies in product development. |
| ML 3 | Defined (practiced) | The manufacturer's processes are demonstrably consistent and repeatable across the organization. The processes have been carried out successfully, and verifiable evidence of this exists. |
| ML 4 | Improving | The manufacturer uses suitable metrics such as key performance indicators (KPIs) to control effectiveness and performance and to demonstrate continuous improvement. |
Security levels rate resilience against threats and range from SL 0 to SL 4:
| Level | Definition |
|---|---|
| SL 0 | Security level 0 is defined implicitly and means that no security requirements or protection are necessary. |
| SL 1 | Protection against casual or coincidental violation. |
| SL 2 | Protection against intentional violation using simple means with low resources, generic skills, and low motivation. |
| SL 3 | Protection against intentional violation using sophisticated means with moderate resources, IACS-specific skills, and moderate motivation. |
| SL 4 | Protection against intentional violation using sophisticated means with extended resources, IACS-specific skills, and high motivation. |
Maturity levels and security levels are central to IEC 62443, but they are often misunderstood or misapplied. We are happy to clarify what they mean for your organization and your products in a no-obligation call.
IEC 62443 certification
IEC 62443 certification gives a structured way to demonstrate cybersecurity in industrial automation and control systems. It covers organizational processes, systems, and components. Certification helps companies improve their cybersecurity, reduce risks, and strengthen their reputation.
There are several certification schemes, including the schemes of accredited testing and certification companies such as the TÜV organizations (German technical inspection associations), ISASecure, and the IECEE CB Scheme. Each scheme has its own focus and requirements. The certification process typically includes document reviews and on-site audits, followed by regular surveillance.
For details on the certification options and what they mean, see our article on IEC 62443 certification.
IEC 62443 training
Dedicated IEC 62443 training courses help companies implement the series. They teach the knowledge needed to apply the standards and to secure industrial control systems, from the basics to advanced topics. For an overview of available courses and their content, see our article IEC 62443 training courses compared.
Frequently asked questions about IEC 62443
What is the difference between IEC 62443-4-2 and IEC 62443-4-1?
IEC 62443-4-1 and IEC 62443-4-2 complement each other but focus on different aspects of cybersecurity in industrial automation and control systems (IACS).
IEC 62443-4-1 focuses on the secure development process and the entire product lifecycle. It defines requirements for the processes, methods, and techniques used to develop IACS products securely. These include security management, specification of security requirements, secure design and implementation, verification and validation, defect management, patch management, and product end of life.
IEC 62443-4-2, by contrast, specifies technical security requirements for IACS components. It divides them into four categories: embedded devices, network devices, host devices, and software applications. The standard defines common component security constraints (CCSC) that apply to all conforming products. One of them, CCSC 4, explicitly requires a development process that conforms to IEC 62443-4-1.
The two standards therefore work together: IEC 62443-4-1 governs the secure development process, and IEC 62443-4-2 defines the concrete technical security capabilities a product must have.
What is the difference between ISASecure and IEC 62443?
ISASecure and IEC 62443 are closely related but different things. IEC 62443 is an international series of standards that defines requirements and processes for IT security in industrial automation. ISASecure is a specific certification program developed by the ISA Security Compliance Institute (ISCI).
ISASecure is based on the requirements of IEC 62443 but goes beyond them in some areas. It defines specific test procedures and criteria that certification bodies use to assess whether products and systems conform with IEC 62443. In this respect, ISASecure is comparable to the testing programs of individual certification bodies such as the TÜV organizations.
Is it ISA 62443 or IEC 62443?
Both names reflect the international cooperation behind the series and its history. The International Society of Automation (ISA), based in the United States, played a central role in developing the standards. It works closely with the International Electrotechnical Commission (IEC), which is responsible for international standardization in electrical engineering and electronics.
The name ISA/IEC 62443 is common especially in North America and the United Kingdom and reflects the contribution of both organizations. In Europe, the parts are adopted as European standards (EN IEC 62443), and national standards bodies publish them with their own prefix, for example DIN EN IEC 62443-4-1 in Germany.
Internationally, the short form IEC 62443 has become established. Most countries and the global industry use it because the IEC is the international standards organization. Using IEC 62443 ensures that the standards are referenced and recognized uniformly worldwide, regardless of national or regional conventions.
How do ISO/IEC 27001 and IEC 62443 relate?
ISO/IEC 27001 and IEC 62443 complement each other in information security but have different focuses and scopes.
ISO/IEC 27001 is the standard for information security management systems (ISMS). It focuses primarily on the operational side of information security in organizations of all kinds. IEC 62443 is specific to cybersecurity in industrial automation and control systems (IACS) and covers the different roles in the lifecycle of these systems.
IEC 62443-2-1 (Edition 2) extends the principles of ISO/IEC 27001 to the specific context of operating automation solutions. Manufacturers and system integrators can use ISO/IEC 27001 alongside standards such as IEC 62443-4-1 (secure product development) and IEC 62443-2-4 (system integration). This helps them secure their development environments and manage information security across the organization.
How do IEC 62443-3-3 and IEC 62443-4-2 relate, and which one do I need?
IEC 62443-3-3 and IEC 62443-4-2 are closely linked but address different levels of cybersecurity in industrial automation and control systems.
IEC 62443-3-3 defines security requirements at system level. It specifies which security capabilities an IACS as a whole must provide and gives an overarching framework for system security. IEC 62443-4-2 breaks these requirements down to the level of individual components. It specifies detailed security requirements for different types of IACS components: embedded devices, network devices, host devices, and software applications.
Which standard you need depends on your use case. If you design or evaluate an entire IACS, IEC 62443-3-3 is probably more relevant. If you develop or select individual components, IEC 62443-4-2 gives you more detailed requirements. In many cases, you should consider both, because they complement each other and together cover security at both levels.
In practice, the line between the two is often blurred. IEC 62443-4-2 refines the requirements of IEC 62443-3-3 at component level and so allows a more detailed implementation of the system requirements.
IEC 62443 is extensive and deliberately modular. In a no-obligation call, we can work out which parts are relevant for your company. We can also look at how they fit together with regulatory requirements such as the Cyber Resilience Act (CRA), the Radio Equipment Directive (RED), or the Machinery Regulation.