ISA/IEC 62443: Why Industrial Cybersecurity Needs Dedicated Standards

What is ISA/IEC 62443?

ISA/IEC 62443 is a family of cybersecurity standards developed for industrial automation and control systems (IACS). It addresses systems that help manage real-world industrial processes, not only conventional IT applications. The International Society of Automation (ISA) explains that the series connects operational technology, information technology, process safety and the responsibilities of different organizations across a system’s lifecycle.

Manufacturing plants can benefit from the series because protecting industrial equipment often involves constraints that differ from office IT. A controller may run a continuous process, vendor support may be required before an update, and an unnecessary restart can affect output or safety. Cybersecurity requirements must therefore be based on credible risks and coordinated with plant operations.

The standards form a family, not one checklist

Different parts address different responsibilities. ISA/IEC 62443-2-1 concerns cybersecurity program requirements for asset owners. Part 2-4 addresses service providers. Part 3-2 deals with risk assessment for system design, while Part 3-3 describes system security requirements and security levels. Part 4-1 concerns the secure development lifecycle of industrial products, and Part 4-2 describes technical requirements for components. ISA maintains a published list of the parts and their editions.

These distinctions matter when a plant buys a new PLC, hires a system integrator or reviews its own procedures. A secure product is useful, but it does not by itself create a secure operating environment. Equally, an organization may have policies on paper without verifying that components and networks can support the technical controls those policies require.

Shared responsibility is central

Asset owners decide what must be protected and how operational risks will be accepted and managed. Product suppliers are responsible for relevant security properties of their products and development practices. Integrators design and implement systems, while service providers may maintain them or connect remotely. The standard family recognizes that no one group can carry all these responsibilities alone.

For example, a machine supplier may provide a controller with authentication features. The plant must still manage access rights, integrate the machine into an appropriate network design, and agree on the support procedure. If a service provider needs remote access, the conditions for granting, supervising and removing that access should be clear.

Zones and conduits: organizing the environment

One prominent concept in ISA/IEC 62443 is the security zone. A zone groups assets with sufficiently similar security requirements. A conduit describes a communication path between zones and its required protections. These are logical engineering concepts, not simply labels on a network diagram.

A plant might separate its enterprise network, engineering workstations, control systems and safety-related systems based on their functions and risks. The relevant communications would then be assessed and controlled. The objective is not to disconnect everything, but to understand necessary information flows and avoid unnecessary exposure.

Part 3-2 addresses risk assessment and the design of such zones and conduits. A detailed risk assessment remains necessary; merely drawing zone boundaries does not demonstrate sufficient security.

Security levels and technical requirements

ISA/IEC 62443 uses security-level concepts to express intended protection and system capabilities. A target level follows from risk assessment; it is not automatically the same for every machine or department. Part 3-3 organizes security requirements around seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

The engineering challenge is to translate these objectives into a realistic architecture. Older controllers may not support modern authentication or encryption. The answer is not to assert that the standard cannot apply, but to evaluate feasible architecture, protections and risk treatment with qualified personnel.

How a manufacturer can begin

Start with the processes and equipment whose failure could have the most serious operational consequences. Build an accurate asset inventory and diagram important communication dependencies. Identify the relevant business and safety objectives, then conduct a risk assessment. Define zones and conduits, establish responsibilities and determine which security requirements apply.

Next, review supplier and service-provider arrangements. Ask how secure maintenance, controller updates, backup restoration, access management and incident response are handled. Keep evidence of assessments and improvement decisions. The standard is most valuable as a lifecycle discipline, not as a one-off certification exercise.

How risk and vulnerability tools contribute

A tool that lists factory assets, associates relevant CVEs, highlights potential attack paths and suggests remediation can support parts of an assessment. It may help identify issues that deserve attention or document supporting evidence. But a vulnerability dashboard does not itself implement network separation, establish a full security management program or certify conformity to ISA/IEC 62443.

For manufacturers, the practical value of ISA/IEC 62443 is that it provides a common language for safer industrial security design. It connects technical protections with operational risks and makes the responsibilities of asset owners, suppliers and service partners easier to discuss and verify.

Official sources and further reading

The resources below support the technical information discussed. Review current vendor advisories and applicable national law before making operational or compliance decisions.

• NIST — SP 800-82 Rev. 3, Guide to Operational Technology (OT) Securityhttps://csrc.nist.gov/pubs/sp/800/82/r3/final
• ENISA — Zoning and Conduits for Railways (applies the IEC 62443 zone/conduit model)https://www.enisa.europa.eu/publications/zoning-and-conduits-for-railways
• ISA — Official ISA/IEC 62443 Series overview and published partshttps://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards