IEC 62443

Defines the Foundational Requirements (FRs) for an IACS, mapping directly to the seven core security capabilities. This part specifies System Requirements (SRs) that a system integrator must implement.

• FR1 – Identification and Authentication Control: Enforces unique user accounts and multi-factor authentication on engineering workstations.
• FR2 – Use Control: Implements role-based access control (RBAC) to restrict which operators can issue critical Modbus write commands.
• FR5 – Restricted Data Flow: Mandates segmentation via firewalls and unidirectional gateways to prevent lateral movement from IT to OT.

Specifies process requirements for the product supplier to ensure security is embedded during the development of control system components. This is a maturity-based certification.

• Security Requirements Definition: Mandates a formal threat model before coding begins for a PLC firmware update.
• Secure Coding Practices: Requires static analysis and fuzz testing to eliminate buffer overflow vulnerabilities in embedded devices.
• Patch Management: Establishes a documented process for notifying asset owners of vulnerabilities and distributing validated security patches without breaking real-time control loops.

Derives technical security requirements for individual IACS components—embedded devices, network switches, host applications. This is the hardware-level counterpart to the system-level 3-3.

• Embedded Device Hardening: Requires disabling unused physical ports and services on a Remote Terminal Unit (RTU) to minimize the attack surface.
• Cryptographic Key Protection: Mandates hardware-backed secure storage for private keys used in DNP3 Secure Authentication.
• Security Event Logging: Requires the component to generate syslog entries for failed authentication attempts, feeding directly into the SIEM for anomaly detection.

Establishes the governance framework for the asset owner to create and maintain an IACS security management system. This bridges the gap between IT security policy and OT operational reality.

• Risk Assessment: Mandates a periodic, process-based risk analysis that accounts for safety and environmental consequences, not just data loss.
• Zone and Conduit Model: Requires the asset owner to partition the plant floor into logical security zones and document the conduits connecting them.
• Training and Awareness: Specifies role-based training for control engineers on recognizing social engineering attacks targeting remote maintenance connections.

The complementary NIST guidance document that provides an overview of ICS security challenges and maps directly to the NIST Cybersecurity Framework. It is often used alongside IEC 62443 in North American utilities.

• Overlay Mapping: Provides a direct mapping of NIST 800-53 controls to the unique constraints of an OT environment, such as the need for 24/7 uptime.
• Incident Response: Details specific forensic techniques for SCADA networks, emphasizing passive capture via Network TAPs to preserve evidence without disrupting operations.
• Vulnerability Management: Recommends a risk-based approach to patching, acknowledging that taking a safety-instrumented system offline for updates may introduce greater operational risk than the vulnerability itself.

The ISA Global Cybersecurity Alliance (ISAGCA) manages a conformity assessment program that certifies individuals, products, and systems against the 62443 standards.

• IC33/IC34 Certificates: Individual certifications for control system cybersecurity design and maintenance, validating an engineer's ability to conduct a zone and conduit risk assessment.
• ISASecure Certification: A third-party certification for embedded devices and control systems, verifying that a PLC meets the component-level requirements of 4-2.
• Site Certification: An emerging program to certify an entire operating facility's security posture against the 2-1 and 3-3 requirements, providing regulatory-grade assurance for critical infrastructure.