Compliance / ISA/IEC 62443
Industrial control system security, built on ISA/IEC 62443.
ISA/IEC 62443 is the international series of standards for securing industrial automation and control systems. It is used across oil and gas, power, water, chemicals and manufacturing, and it is increasingly written into supplier contracts.
The series covers everyone involved: the asset owners who run plants, the integrators and service providers who build and maintain them, and the companies that make control products. We help each of them apply the parts that matter.
At a glance
- Developed by
- The ISA99 committee, published as international standards by the IEC
- Core idea
- Zones, conduits and target security levels
- Security levels
- SL 1 to SL 4, based on the attacker a system must withstand
- Product certification
- Available through schemes such as ISASecure
ISA/IEC 62443
Zones, conduits and security levels
The series is built around zones and conduits. Assets with similar security needs are grouped into zones, the connections between them are treated as conduits, and each zone gets a target security level based on the threats it has to withstand. That makes it practical to protect a plant without hardening every device to the same degree.
Testing and changes in live plants have to be planned around safety and uptime. We work with operations and engineering staff from the start, and we use labs and digital twins where active testing would be risky.
How we help
Asset owners
A security program for operating sites.
- 62443-2-1 security program requirements
- 62443-3-2 risk assessment, zones and conduits
- Target security level selection
- Remote and vendor access controls
- Patch and backup management for OT
Integrators and service providers
Security built into how plants are delivered and maintained.
- 62443-2-4 requirements for service providers
- Secure integration and commissioning
- Hardening baselines and documentation
- Security handover to asset owners
System security requirements
Measure a control system against its target security level.
- 62443-3-3 system requirements by security level
- Gap assessment of control system architecture
- Segmentation and conduit design
- Monitoring and detection for OT networks
Product suppliers
Secure development and component requirements.
- 62443-4-1 secure product development lifecycle
- 62443-4-2 component security requirements
- Threat modeling and security testing of products
- Preparation for product and process certification
Who issues the certification
Product and process certifications under ISA/IEC 62443 are issued by accredited certification bodies, for example through the ISASecure scheme. We help you prepare; the certification decision belongs to them.
Services that support this work
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
- Managed Detection & ResponseSecurity monitoring, detection engineering and threat hunting focused on real threats rather than alert volume.
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
FAQ
Frequently asked questions
How does ISA/IEC 62443 relate to NIST SP 800-82?
They cover similar ground. NIST SP 800-82 is US guidance for operational technology security and refers to ISA/IEC 62443 throughout. Many US organizations use both: 800-82 for overall guidance and 62443 for its structure of zones, conduits and security levels.
Is ISA/IEC 62443 mandatory?
Not by law in most US sectors, but customers, insurers and supplier contracts increasingly require it, especially for product suppliers and integrators.
Find out where you stand on ISA/IEC 62443.
A readiness review shows what an assessor would find today and what it will take to close the gaps.