GLOBAL

CYBERSECURITY
ALLIANCE

Security of Industrial Automation

and Control Systems
An Overview of ISA/IEC 62443 Standards

www.isagca.org
 Quick Start Guide:
An Overview of ISA/IEC 62443 Standards
Security of Industrial Automation
and Control Systems
Executive Summary organization. Finally, the means, resources,
skills and motivation of cyber-attackers have
This document is intended to provide the reader significantly increased. The combination of
with a detailed overview of the ISA/IEC 62443 these trends has made IACS more vulnerable to
series of standards (series) and technical reports. cyberattack. Figure 1 shows some of the notable
The ISA/IEC 62443 series addresses the security cyberattacks that have impacted IACS.
of industrial automation and control systems
(IACS) throughout their lifecycle. These standards Initially, the ISA99 committee considered IT
and technical reports were initially developed for standards and practices for use in the IACS.
the industrial process sector but have since been However, it was soon found that this was not
applied to building automation, medical devices sufficient to ensure the safety, integrity, reliability
and transportation sectors. and security of an IACS. This is because the
consequences of a successful cyberattack on
There are several trends that have made an IACS are fundamentally different. While
cybersecurity an essential property of IACS, along the primary consequences of a successful
with safety, integrity and reliability. First, over cyberattack on IT systems is financial and
the last two decades, IACS technologies have privacy loss due to information disclosure, the
migrated from vendor-proprietary to commercial consequences for an IACS may additionally
off-the-shelf technologies such as Microsoft include loss of life or health, damage to the
Windows™ and TCP/IP networking. Second, the environment or loss of product integrity. There
value of data residing in the IACS for the business are several other differences between IT and
has significantly increased the interconnectivity IACS such as performance requirements,
of IACS both internal and external to the availability requirements, change management,
the time between maintenance windows and
Date Target Method
equipment lifetime. [1]
2010 Iran Uranium Enrichment Stuxnet
2013 ICS Supply Chain attack Havex The International Society of Automation (ISA) and
2015 Ukraine Power Grid BlackEnergy, KillDisk the International Electrotechnical Commission
(IEC) have joined forces to address the need to
2016 Ukraine Substation CrashOverride
improve the cybersecurity of IACS. The ISA99
2017 Global shipping company NotPetya
committee and the IEC Technical Committee 65/
2017 IoT DDos attack BrickerBot Working Group 10 develop and publish the ISA/
2017 Health care, Automotive, WannaCry IEC 62443 series. These documents describe a
many others methodical engineered approach to addressing
2017 Saudi Arabia Petrochemical TRITON/TRISIS the cybersecurity of IACS. They can be purchased
2017 Multinational Confectionary, Food NotPetya from either organization; the technical content
& Beverage Company is identical. The benefits of using a standards-
2019 Norwegian Aluminum Company LockerGaga based approach include reducing the likelihood
of a successful cyberattack, the use of a common
2021 Critical Infrastructure: Pipeline Ransomware
set of requirements among stakeholders,
2023 Asian National Power Grid Chinese malware
security throughout the lifecycle and a reduction
Table 1: Some notable cyberattacks impacting IACS in overall lifecycle cost.

Source: https://www.csis.org/programs/strategic-technologies-program/significant-cyber-incidents

2
 Table of Contents
Executive Summary...............................................................2

Introduction...........................................................................3
Scope and Purpose.......................................................................... 3
ISA/IEC 62443 Series of Standards Development
Introduction Organizations.................................................................................... 4
Summary of ISA/IEC 62443 Series of Standards and
This document provides an overview of the ISA/IEC
Technical Reports............................................................................. 4
62443 series and technical reports which specifies
requirements for the security of IACS. The goal of Fundamental Concepts.........................................................6
the ISA/IEC 62443 series is to improve the safety, Security Program.............................................................................. 6
reliability, integrity and security of IACS using a risk- Risk Management............................................................................. 7
based, methodical and complete process throughout Risk Assessment.......................................................................... 7
the entire lifecycle. The ISA/IEC 62443 series Zones and Conduits................................................................... 7
describes a set of common terms and requirements
Cybersecurity Requirements Specification............................. 7
that can be used by asset owners, product suppliers
Threat Modeling.......................................................................... 8
and service providers to secure their control systems
Foundational Requirements........................................................... 8
and the Equipment Under Control (EUC).
Security Levels................................................................................... 8
Scope and Purpose Maturity Model.................................................................................. 9
The scope of the ISA/IEC 62443 series is the Design Principles............................................................................... 9
security of IACS. An IACS is defined as a collection of Secure by Design........................................................................ 9
personnel, hardware, software and policies involved Reduce Attack Surface............................................................... 9
in the operation of the industrial process and that Defense in Depth........................................................................ 9
can affect or influence its safe, secure and reliable
Essential Functions..................................................................... 9
operation.
Roadmap for the ISA/IEC 62443 Series...............................10
Note that an IACS includes more than the technology
Principal Roles................................................................................. 10
that comprises a control system; it includes the
Component, System, Automation Solution and IACS............... 10
people and work processes needed to ensure the
Hierarchical View............................................................................ 11
safety, integrity, reliability and security of the control
system. Without people who are sufficiently trained, Lifecycle View................................................................................... 12
risk-appropriate technologies, countermeasures and ISA/IEC 62443 Series for Asset Owners...................................... 12
work processes throughout ISA/IEC 62443 Series for Product Suppliers.............................. 12
the security lifecycle, an IACS ISA/IEC 62443 Series for Service Providers................................ 12
could be more vulnerable Integration Service Providers.................................................. 12
to cyberattack. Maintenance Service Providers.............................................. 12

Because IACS are Certification and Training...................................................13

physical-cyber ISASecure® Certification................................................................. 13
systems, the impact ISA Cybersecurity Training............................................................ 13
of a cyberattack Security ISA Cybersecurity Certificates....................................................... 14
could be
severe. The Published Standards and Technical Reports.....................14
consequences
References............................................................................15
of a
Figure 1:
cyberattack on
The Security Triad
an IACS include, but
are not limited to:
WWW.ISA.ORG/ISAGCA 3
 • Endangerment of public or employee safety ISA/IEC 62443 series of standards and technical
or health reports:
• Damage to the environment • International Society of Automation – ISA99
• Damage to the EUC Committee

• Loss of product integrity • International Electrotechnical Commission –

IEC TC65/WG10 Committee
• Loss of public confidence or company
reputation There is a formal liaison agreement between
• Violation of legal or regulatory requirements these two standards development organizations.
The ISA/IEC 62443 series of standards and
• Loss of proprietary or confidential technical reports are developed primarily by
information the ISA99 Committee with input, review, and
• Financial loss simultaneous adoption by both the ISA and IEC.
The one exception is ISA/IEC 62443-2-4, which
• Impact on entity, local, state or national
was developed by the IEC TC65/WG10 Committee
security
and adopted by ISA. As a result, whether an
The first four consequences in the above list ISA/IEC 62443 document is published by ISA or
are unique to physical-cyber systems and are IEC, the content is identical except for the non-
not typically present in traditional IT systems. normative preface and foreword.
Indeed, it is this difference that fundamentally
The United Nations Economic Commission
results in the need for different approaches to
for Europe (UNECE) confirmed at its annual
securing physical-cyber systems and caused
meeting in late 2018 that it will integrate the
standards development organizations to identify
widely used ISA/IEC 62443 Series into its
the need for standards that are unique to IACS.
forthcoming Common Regulatory Framework
Some other characteristics of IACS that are not
on Cybersecurity (CRF). The CRF will serve as
typical in IT systems include: [1]
an official UN policy position statement for
• more predictable failure modes Europe, establishing a common legislative basis
• tighter time-criticality and determinism for cybersecurity practices within the European
Union trade markets. [2]
• higher availability
• more rigorous management of change Refer to the Published Standards and Technical
Reports section at the end of this document for
• longer time periods between maintenance
a complete list of ISA and IEC cybersecurity-
• significantly longer component lifetimes related documents currently available.
• Safety, integrity, availability and
Summary of ISA/IEC 62443 Series of
confidentiality (SIAC) instead of CIA
Standards and Technical Reports
Cyber threat actors include but are not limited These documents are arranged in four groups,
to insiders (accidental or intentional), hacktivists, corresponding to the primary focus and
cybercriminals, organized crime and state- intended audience. [4]
sponsored attackers. Types of cyberattacks
1. General—This group includes documents
include but are not limited to ransomware,
that address topics that are common to the
destructive malware, directed remote access
entire series.
attacks and coordinated attacks on control
systems and associated support infrastructure. • Part 1-1: Terminology, concepts, and
Table 1 lists several noteworthy directed and models introduces the concepts and
non-directed cyberattacks impacting IACS. models used throughout the series.
The intended audience includes anyone
ISA/IEC 62443 Series of Standards wishing to become familiar with the
Development Organizations fundamental concepts that form the
There are two standards development organizations basis for the series
involved in the development of the

4
 • Part 1-2: Master glossary of terms by an operational IACS against the
and definitions is a list of terms and requirements in the ISA/IEC 62443 series
abbreviations used throughout the series of standards
• Part 1-3: System security conformance • Part 2-3: Patch management in the
metrics describes a methodology to IACS environment provides guidance
develop quantitative metrics derived from on patch management for IACS. The
the process and technical requirements intended audience includes anyone who
in the standards has responsibility for the design and
• Part 1-4: IACS security lifecycle and implementation of a patch management
use cases provides a more detailed program
description of the underlying lifecycle for • Part 2-4: Security program
IACS security, as well as several use cases requirements for IACS service
that illustrate various applications providers specifies requirements for
IACS service providers such as system
2. Policies and procedures—Documents in this integrators or maintenance providers.
group focus on the policies and procedures This standard was developed by IEC
associated with IACS security. TC65/WG10
• Part 2-1: Establishing an IACS security • Part 2-5: Implementation guidance for
program describes what is required to IACS asset owners provides guidance on
define and implement an effective IACS what is required to operate an effective
cybersecurity management system. The IACS cybersecurity program. The intended
intended audience includes asset owners audience includes asset owners who have
who have responsibility for the design responsibility for the operation of such a
and implementation of such a program program
• Part 2-2: IACS security program ratings
provides a methodology for evaluating 3. System Requirements—The documents in
the level of protection provided the third group address requirements at the
system level.

ISA/IEC 62443 Series of Standards

Figure 2: The ISA/IEC 62443 Series

ISAGCA.ORG 5
 • Part 3-1: Security technologies for Lifecycle (SDL). The principal audience
IACS describes the application of include suppliers of control systems and
various security technologies to an IACS component products
environment. The intended audience • Part 4-2: Technical security
includes anyone who wishes to learn requirement for IACS components
more about the applicability of specific describes the requirements for IACS
technologies in a control systems components based on security level.
environment Components include embedded devices,
• Part 3-2: Security risk assessment for host devices, network devices and
system design addresses cybersecurity software applications. The principal
risk assessment and system design for audience include suppliers of component
IACS. The output of this standard is a products that are used in control systems
zone and conduit model, and associated
risk assessments and target security Table 2 shows the complete list of ISA/IEC 62443
levels. These are documented in the CRS. standards and technical reports. The “Part” can
This standard is primarily directed to be derived from the document number, for
asset owners and system integrators example ISA/IEC 62443-2-1 is referred to as Part
2-1 in this document.
• Part 3-3: System security requirements
and security levels describes the The document types are:
requirements for an IACS system based • IS–International standard
on security level. The principal audience
include suppliers of control systems, • TR–Technical report
system integrators and asset owners • TS–Technical specification

4. Component Requirements—The fourth and Finally, the publication date is shown for each
final group includes documents that provide document as of the publication date of this
information about the more specific and document. ISA/IEC standards are on a five-
detailed requirements associated with the year update cycle, so many of the published
development of IACS products. documents are currently in revision.
• Part 4-1: Product security
development lifecycle requirements
describes the requirements for a product Fundamental Concepts
developer’s Security Development
Security Program
Part 2-1 specifies asset owner security program
Part Type Title Date
Overview

requirements for the IACS. A security program

1-1 TS Terminology, concepts, and models 2007
consists of the implementation and maintenance
1-2 TR Master glossary of terms and abbreviations
of personnel, policy and procedure, and
1-3 System cybersecurity conformance metrics
technology-based capabilities that reduce the
1-4 IACS security lifecycle and use cases cybersecurity risk of an IACS.
Policies & Procedures

2-1 IS Establishing an IACS security program 2009

2-2 IACS security program ratings In the context of Part 2-1, the asset owner is
2-3 TR Patch management in the IACS environment 2015
also the Operator of the IACS and the EUC. The
security program covers the entire lifecycle of
2-4 IS Security program requirements for IACS service 2018
the IACS. Because the lifetime of an IACS can
providers
be longer than the product supplier support
2-5 TR Implementation guidance for IACS asset owners
timeframe, the standard recognizes that not all
3-1 TR Security technologies for IACS
Systems

requirements can be met by legacy systems, so

3-2 IS Security risk assessment for system design 2020
compensating countermeasures may be needed
3-3 IS System security requirements and security levels 2013 to secure the IACS.
Component

4-1 IS Product security development life-cycle requirements 2018

4-2 IS Technical security requirements for IACS components 2019 Although the asset owner is ultimately
accountable for the secure operation of the
Table 2: ISA/IEC 62443 Series Status IACS, implementation of security capabilities
6
requires the support of product suppliers and Partitioning the SuC into zones and conduits can
service providers. The asset owner must include also reduce overall risk by limiting the scope of
requirements for security throughout the supply a successful cyber-attack. Part 3-2 requires or
chain to meet the overall security program recommends that some assets are partitioned as
requirements. follows should:

The security program for the IACS must be • business and control system assets
coordinated with the overall Information Security • safety related assets
Management System (ISMS) of the organization. • temporarily connected devices
The ISMS sets the overall security governance
and policies for the organization. However, • wireless devices
as mentioned above, the IACS is significantly • devices connected via external networks
different from IT systems, so there are additional
requirements and considerations for its security Cybersecurity Requirements Specification
program. Part 3-2 also requires that required security
countermeasures from the risk assessment as
Risk Management well as security requirements based on company
Risk Assessment
Part 3-2 describes the requirements Start
for addressing the cybersecurity risks
in an IACS, including the use of zones Initial system architecture Updated system architecture
and conduits, and security levels. While diagrams and inventory, ZCR 1 – Identify the diagrams and inventory with
company policies, system under IACS external services and
Part 3-2 includes the requirements for regulations, tolerable risk consideration support identified
guidelines, etc.
the risk assessment process, it does (SUC)

not specify the exact methodology to

be used. The methodology used must Existing PHAs and other
be established by the asset owner and relevant risk assessment ZCR 2 – Perform an Initial evaluation of risk
and corporate risk matrix initial cybersecurity risk
should be consistent with the overall assessment
risk assessment methodology of the
organization. Examples using the risk Standards and best
matrix methodology are included as practices, policies, supplier
ZCR 3 – Partition the Initial or revised zone
guidelines, criticality
informative content. Figure 3 shows the assessments, data flows, SUC into zones and and conduit diagram
functional conduits
risk assessment process. specifications, etc.

Zones and Conduits

A zone is defined as a grouping of logical
ZCR 4 – Initial
or physical assets based upon risk or No
risk exceeds
other criteria such as criticality of assets, tolerable risk?
operational function, physical or logical
location, required access or responsible Yes
organization. Residual cybersecurity risk
ZCR 5 – Perform a and SL-Ts for each zone
detailed cybersecurity
A conduit is defined as a logical grouping risk assessment
and conduit

of communication channels that

share common security requirements
connecting two or more zones.
Company policies, Cybersecurity
A key step in the risk assessment regulations, tolerable risk ZCR 4 – Document requirement
cybersecurity require- specification (CRS)
process is to partition the System Under guidelines, etc.
ments, assumptions, and
Consideration (SuC) into separate zones constraints

and conduits. The intent is to identify

those assets which share common security
ZCR 7 – Asset owner
characteristics in order to establish a set approval
of common security requirements that
Figure 3: Risk Assessment Process
reduce cybersecurity risk.
www.isa.org/ISAGCA ISAGCA.ORG 7
 or facility-specific policies, standards and relevant FRs are used to organize the requirements for
regulations are documented in a CRS. The CRS IACS Systems (Part 3-3) and components
does not have to be a standalone document; it (Part 4-2).
can be included as a section in other relevant
IACS documents. The combination of FR 1 and FR 2 is sometimes
called access control; they were split into two FRs
The CRS includes information such a description to keep the total number of requirements at a
of the SuC, zone and conduit drawings, threat manageable level.
environment(s) and countermeasures from risk
assessments. Security Levels
Security level is defined as the measure of
Threat Modeling confidence that the SuC, zone or conduit is free
Part 4-1 describes the requirements for the from vulnerabilities and functions in the intended
security development lifecycle (SDL) of control manner.
system and component products. One of the key
processes in the product SDL is threat modeling Part 3-3 further defines the security level in terms
which is a systematic process to identify data flows, of the means, resources, skills and motivation of
trust boundaries, attack vectors and potential the threat actor, as shown in Table 3. It is used
threats to the control system. The security issues as a means to discriminate between requirement
identified in the threat model must be addressed enhancements for systems (Part 3-3) and
in the final release of the product and the threat components (Part 4-2).
model itself must be periodically updated during There are three types of security levels that are
the product’s lifecycle. used throughout the ISA/IEC 62443 series:
Foundational Requirements • Capability Security Levels (SL-C) are the
Foundational Requirements (FRs) form the basis security levels that systems (Part 3-3) or
for technical requirements throughout the components (Part 4-2) can provide when
ISA/IEC 62443 series. All aspects associated with properly integrated and configured. These
meeting a desired IACS security level (people, levels state that a particular system or
processes and technology) are derived through component is capable of meeting the SL-T
meeting the requirements associated with the natively without additional compensating
seven following FRs: countermeasures
• FR 1 – Identification and authentication • Target Security Levels (SL-T) are the desired
control (IAC) level of security for a particular automation
• FR 2 – Use control (UC) solution. They are determined as the result
of the risk assessment process (Part 3-2) and
• FR 3 – System integrity (SI) are documented in the CRS. SL-T are used
• FR 4 – Data confidentiality (DC) to select products and design additional
• FR 5 – Restricted data flow (RDF) countermeasures during the integration
phase of the IACS lifecycle
• FR 6 – Timely response to events (TRE)
• Achieved Security Levels (SL-A) are the actual
• FR 7 – Resource availability (RA) levels of security for a particular automation
solution. These are measured after the

Security Level Definition Means Resources Skills Motivation

1 Protection against casual or coincidental violation

2 Protection against intentional violation using simple means with low simple low generic low
resources, generic skills, and low motivation
3 Protection against intentional violation using sophisticated means with sophisticated moderate IACS-specific moderate
moderate resources, IACS-specific skills, and moderate motivation
4 Protection against intentional violation using sophisticated means with sophisticated extended IACS-specific high
extended resources, IACS-specific skills, and high motivation

Table 3: Security Level Definition

8
 automation solution is commissioned and surface includes design principles such as:
in operation. Part 2-2 combines SL-A with • Access control—restricting physical and logical
operational and maintenance policies and access to IACS systems and networks
procedures to form the security program
rating for a particular automation solution • Network segmentation—segmenting IACS
networks and controlling the traffic between
Maturity Model them
While security levels are a measure of the strength • Least function—hardening IACS systems and
of technical requirements, maturity levels are networks by removing unneeded functions
a measure of processes (people, policies and
procedures). Parts 2-1, 2-2, 2-4 and 4-1 use • Least privilege—limiting privileges to the
maturity levels to measure how thoroughly minimum necessary for the role or function
requirements are met. Defense in Depth
As shown in Table 4, the maturity model is based Defense in depth is defined as the provision of
on the Capability Maturity Model Integration multiple security protections, especially in layers, with
(CMMI), with Levels 4 and 5 combined into Level 4. the intent to delay or prevent an attack. Defense
in depth implies layers of security and detection,
Design Principles even on single systems, and requires attackers to
Secure by Design break through or bypass multiple layers without
Secure by design is a design principle where being detected. The IACS is still protected even if a
security measures are implemented early vulnerability in one layer is compromised. Special
in the lifecycle of the IACS. The intent is that attention must be paid to a single vulnerability that
robust security policies, security architectures allows the potential compromise of multiple layers.
and secure practices are established early in
development and implemented throughout Essential Functions
the lifecycle. This design principle applies to Essential functions are defined as functions or
both product development and automation capabilities that are required to maintain health,
solution development. When using a secure by safety, the environment and availability of the EUC.
design philosophy, security measures operate Essential functions include:
natively within the control system or component • the safety instrumented function (SIF)
without requiring the addition of compensating • the control function
countermeasures. • the ability of the operator to view and
manipulate the EUC
Reduce Attack Surface
Reducing the attack surface is a design principle The loss of essential functions is commonly termed:
where the physical and functional interfaces of loss of protection, loss of control and loss of view,
an IACS that can be accessed and exposed to respectively. In some use cases additional functions
potential attack are minimized, making it more such as history may be considered essential.
difficult for an attack to succeed. Reducing attack

Level CMMI 62443 Description

1 Initial Initial • Product development is typically ad-hoc and often undocumented

• Consistency and repeatability may not be possible
2 Managed Managed • Product development managed using written policies
• Personnel have expertise and are trained to follow procedures
• Processes are defined but some may not be in practice
3 Defined Defined (Practiced) • All processes are repeatable across the organization
• All processes are in practice with documented evidence
4 Quantitively Managed Improving • CMMI Levels 4 and 5 are combined
• Process metrics are used control effectiveness and performance
5 Optimizing • Continuous improvement

Table 4: Maturity Level Definition

ISAGCA.ORG 9
 Part 3-3 requires that security measures shall • Maintenance Service Provider is the
not adversely affect essential functions of a high- individual or organization that provides
availability IACS unless it is supported by a risk support activities for an automation solution
assessment. The concept of essential functions • Integration Service Provider is an
places some design constraints on the design of IACS organization that provides integration
security measures: activities for an automation solution including
• access control shall not prevent the operation design, installation, configuration, testing,
of essential functions commissioning and handover to the asset
• essential functions shall be maintained if the owner. The integration service provider may
zone boundary protection (firewall) goes into also facilitate and assist in the activity to
a fail close/island mode partition the SuC into zones and conduits
and perform the risk assessment
• a denial-of-service event on the control
system or Safety Instrumented System • Product Supplier is the organization that
(SIS) network shall not prevent safety manufactures and supports a hardware and/
instrumented functions from acting or software products. Products may include
control systems, embedded devices, host
devices, network devices and/or software
Roadmap for the ISA/IEC 62443 applications
Series Component, System, Automation Solution and IACS
Principal Roles The right-hand side of the figure shows the types
To understand how to use the ISA/IEC 62443 of systems that are identified in the ISA/IEC 62443
series it is first necessary to understand the series::
relationship between roles, control system, • IACS Components are provided by a
automation solution and IACS. Figure 4 visualizes product supplier and include the following
this relationship. The left-hand side of the figure types:
shows the roles that are identified in the ISA/IEC
62443 series: • Embedded device–special purpose
device designed to directly monitor or
• Asset Owner is the organization that is control an industrial process
accountable and responsible for the IACS.
The asset owner is also the operator of the • Host device–general purpose device
IACS and the EUC
Safety
functions running an operating system capable
of hosting one or more software
applications, data stores or functions
Roles Industrial automation and control system (IACS) from one or more suppliers
accountable for
Asset Owner
• Network device–device that facilitates
Operation and routine maintenance according
operates to security policies and procedures data flow between devices, or restricts
the data flow, but may not directly
Maintenance maintains Automation Solution
Service Provider interact with a control process
Essential Functions
commissions
Integration and validates Control Safety Complementary • Software application–one or more software
functions functions functions
Service Provider designs and programs and their dependencies that are
deploys
used to interface with the process or the
IACS environment
Includes configured products
control system itself
(control systems and components)
• The IACS System consists of an integrated
Role Products set of embedded devices (e.g., PLC), Host
Components Control systems
Supporting
(as a combination of Devices, network devices and software
components)
Product Embedded
Supplier
develops software
applications devices applications provided by one or more
and supports Zone Zone

Hosted
product suppliers
Network
devices devices
• Automation Solution is the realization
Independent of IACS environment of a control system at a particular facility.
It includes essential functions such as
Figure 4: Roles, Products, Automation Solution, and IACS safety functions and control functions and
10
 other supporting functions such as Part 2-3
historization and engineering Patch management in
the IACS environment

• The IACS includes the automation Legend

Derived Requirements
solution and the operational and Direct References
All Parts shall reference Part 1-1 Part 2-4
maintenance policies and procedures Security program
requirements for IACS
necessary to support it service providers

Hierarchical View
Part 1-1 Part 2-1 Part 3-2 Part 2-2
Figure 5 shows the hierarchical relationships Terminology, Establishing an IACS Security risk IACS security
concepts, security program assessment for program ratings
among the ISA/IEC 62443 series of standards. and models system design

A hierarchical relationship means that one

standard derives its requirements from Part 3-3 Part 4-2
System security Technical security
the requirements in another standard. The requirements and requirements for
security levels IACS components
arrowhead shows the direction of derivation.

• Part 1-1 introduces the concepts and Part 4-1

Product security
models that are used throughout the ISA/ development lifecycle
requirements
IEC 62443 series. In particular, it describes
the foundational requirements, which are
used to organize technical requirements Figure 5: ISA/IEC 62443 Standards – Hierarchical View
throughout the series
• Part 2-1 sets the requirements for the • Part 4-1 is used by a product supplier to
security program of an asset owner. All of the establish and sustain a SDL, which is used
other standards in the to create control systems and component
ISA/IEC 62443 series derive their products
requirements from Part 2-1 and expand • Part 2-4 sets the requirements for service
upon them in more detail providers that are involved in support of the
• Part 3-2 sets the requirements for the IACS. Integration service providers provide
partitioning of the SuC into zones and integration services for the automation
conduits and their risk assessment. The risk solution, and maintenance service providers
assessment defines the SL-T, which is used provide maintenance services for the IACS.
to procure systems and components that • Part 2-3 sets the requirements for the patch
have the capabilities defined in Part 3-3 and management process, which is used to
Part 4-2, respectively. Part 3-2 also requires a reduce cybersecurity vulnerabilities in the
CRS, which is used to create the automation automation solution
solution

Automation Solution Lifecycle

Product Development Lifecycle
Integration Operation and Maintenance

Part 1-1: Terminology, Concepts, and Models

Part 2-1: Establishing an IACS Security Program
Part 2-2: IACS Security Program Rating
Part 2-3: Patch Management in the IACS Environment
Part 2-4: Security program requirements for IACS service providers
Part 3-2: Security Risk Assessment for System Design
Part 3-3: System security requirements and Security levels
Part 4-1: Product Security Development Lifecycle
Requirements
Part 4-2: Technical security requirements
for IACs components

Figure 6: ISA/IEC 62443 Standards - Lifecycle View

ISAGCA.ORG 11
 Lifecycle View ISA/IEC 62443 Series for Product Suppliers
Another view of the ISA/IEC 62443 series is Product supplier activities:
the lifecycle view. There are two independent • establish and sustain an SDL
lifecycles described in the series: the product
• provide control system products that meet
development lifecycle, and the automation
security level capabilities
solution lifecycle. The automation solution
lifecycle is further divided into an integration • provide component products that meet
phase and an operation and maintenance security level capabilities
phase. Table 6 shows the relationship between • provide ongoing lifecycle support for their
the parts of the ISA/IEC 62443 series and the control system and component products
various lifecycles and phases.
Applicable ISA/IEC 62443 standards:
Note that Part 3-3 spans the product • ISA/IEC 62443-4-1, Product SDL
development lifecycle and the integration requirements
phase of the automation solution lifecycle.
• ISA/IEC 62443-3-3, System security
This is because while the product supplier
requirements and security levels
is the main audience for Part 3-3, the
integration service provider may also combine • ISA/IEC 62443-4-2, Technical security
components to create control systems. An requirements for IACS components
example would be a SCADA system, where • ISA/IEC 62443-3-2, Security risk
the integration service provider integrates the assessment for system design
SCADA system with embedded devices (e.g.,
PLC) to create an automation solution. ISA/IEC 62443 Series for Service Providers
Integration Service Providers
ISA/IEC 62443 Series for Asset Owners Integration service provider activities:
Asset owner activities:
• establish and sustain a security program
• establish and sustain a security program for automation solution integration
that includes IACS-specific requirements
• design and implement automation
• partition zones and conduits and perform solutions that meet the requirements in
associated risk assessments the CRS
• document IACS requirements in the CRS • apply security patches during the
• procure products and services that meet integration phase of the automation
IACS requirements solution lifecycle
• operate and maintain the IACS Applicable ISA/IEC 62443 standards:
• assess the effectiveness of the IACS • ISA/IEC 62443-2-1, Establishing an IACS
security program security program
Applicable ISA/IEC 62443 standards: • ISA/IEC 62443-2-3, Patch management in
the IACS environment
• ISA/IEC 62443-2-1, Establishing an IACS
security program • ISA/IEC 62443-2-4, Requirements for IACS
service providers
• ISA/IEC 62443-2-2, Security Program
ratings • ISA/IEC 62443-3-2, Security risk
assessment for system design
• ISA/IEC 62443-2-3, Patch management in
the IACS environment • ISA/IEC 62443-3-3, System security
requirements and security levels
• ISA/IEC 62443-2-4, Requirements for IACS
service providers Maintenance Service Providers
• ISA/IEC 62443-3-2, Security risk Maintenance service provider activities:
assessment for system design • establish and sustain a security program
• ISA/IEC 62443-3-3, System security for maintenance services
requirements and security levels
12
• provide services and capabilities that meet • ISA/IEC 62443 IACS Security Assurance
the IACS security policies and procedures (IACSSA) (under development) this program
specified by the asset owner aims to offer the world’s first ISA/IEC 62443
OT site assessment certification
Applicable ISA/IEC 62443 standards:
• ISA/IEC 62443-2-3, Patch management in the ISASecure certification programs can be found at
IACS environment ISASecure.org.

• ISA/IEC 62443-2-2, IACS security program ISA Cybersecurity Training

ratings ISA offers the following cybersecurity-related
• ISA/IEC 62443-2-4, Requirements for IACS training courses:
service providers • Cybersecurity Awareness training for Water/
Wastewater Industry Professionals (IC31)
Certification and Training • Using the ISA/IEC 62443 Standards to Secure
Your Control System (IC32, IC32E, IC32M,
ISASecure® Certification IC32V)
The ISA Security Compliance Institute is a non-
profit organization that has developed several • Introduction to Industrial Automation Security
product certification programs for controls and the ISA/IEC 62443 Standards (IC32C)*
systems and components. Currently available • Assessing the Cybersecurity of New or
ISASecure certification programs are: Existing IACS Systems (IC33, IC33E, IC33M,
IC33V)
• Security Development Lifecycle Assurance
(SDLA) / ISA/IEC 62443-4-1 certifies that • IACS Cybersecurity Design and
the SDL of a product supplier meets the Implementation (IC34, IC34M, IC34V)
requirements in Part 4-1 • IACS Cybersecurity Operation and
• IIoT Component Security Assurance (ICSA) Maintenance (IC37, IC37M, IC37V)
/ ISA/IEC 62443-4-2 is a security certification The last letter of the course code designates the
program for IIoT components and IIoT type of course as follows:
gateways
• <none> - Classroom training - Our most
• System Security Assurance (SSA) / robust form of training—many include
ISA/IEC 62443-3-3 certifies that control hands-on labs.
system products have the capability to meet
the requirements in Part 3-3 and have been • C – Custom training - *One-day overview
developed in accordance with an SDLA course available only through our Custom
program Training Solutions

Certified System
• E – Instructor-guided online training -
Learn at your own pace when it’s convenient
ISASecure for you to complete the assignments by the
milestone deadline
• Component Security Assurance (CSA) / • M – Self-paced modular training - Learn at
ISA/IEC 62443-4-2 certifies that component your own pace at a time that is convenient
products have the capability to meet the for you
requirements in Part 4-2 and have been • V – Virtual Classroom training - covers the
developed in accordance with an SDLA same material as the classroom course, but
program. Certified component products can in a virtual setting so you can attend remotely
be embedded devices, host devices, network
devices and software applications Visit our course formats webpage for full details
about each course format.
Certified Component

ISASecure

ISAGCA.ORG 13
 ISA Cybersecurity Certificates course that provides an overview of how the
ISA/IEC 62443 ISA/IEC 62443 ISA/IEC 62443 ISA/IEC 62443 ISA/IEC 62443
ISA/IEC 62443 series of standards can be
FUNDAMENTALS RISK MAINTENANCE used by the supplier to implement a SDL, and
SPECIALIST ASSESSMENT DESIGN
SPECIALIST EXPERT
to develop IACS systems and components
SPECIALIST SPECIALIST

that are secure by design and offer security

Certificate 1 Certificate 2 Certificate 3 Certificate 4 Expert by default. It also covers how to suppliers can
independently certify that these systems and
ISA offers the following cybersecurity certificate components comply with the relevant ISA/IEC
courses for students who have completed the 62443 standards
training courses listed above. Certificates are not • ISASecure for Product Suppliers and
to be confused with product certifications offered Assessors (IC47, IC47V) is intended for
by ISASecure. product suppliers who want to build products
• ISA/IEC 62443 Cybersecurity Fundamentals conforming to 62443 standards that also
Specialist (IC32) provides a detailed look at meet ISASecure certification requirements. It
how the ISA/IEC 62443 standards framework is also intended for conformance/certification
can be used to protect critical control assessors of software development
systems. It also explores the procedural and processes, and system/component products
technical differences between the security who need to understand the ISASecure
for traditional IT environments and those certification programs and the ISA/IEC 62443
solutions appropriate for SCADA or plant standards on which it is based
floor environments
• ISA/IEC 62443 Cybersecurity Risk Assessment
Published Standards and
Specialist (IC33) focuses on information and
skills to assess the cybersecurity of a new or Technical Reports
existing industrial automation and control ISA-62443-1-1-2007 / IEC TS 62443-1-1:2009–
system (IACS); and to develop a cybersecurity Security for Industrial Automation and Control
requirements specification (CRS) that can Systems, Part 1-1: Terminology, Concepts and
be used to document the cybersecurity Models
requirements of the project
ISA-62443-2-1-2009 / IEC 62443-2-1:2010–
• ISA/IEC 62443 Cybersecurity Design Specialist
Security for Industrial Automation and Control
(IC34) focuses on the activities associated
Systems, Part 2-1: Establishing an Industrial
with the design and implementation of
Automation and Control Systems Security
industrial automation control system (IACS)
Program
cybersecurity countermeasures
• ISA/IEC 62443 Cybersecurity Maintenance ANSI/ISA-TR 62443-2-3-2015 / IEC TR 62443-2-
Specialist (IC37) focuses on the activities 3:2015–Security for Industrial Automation and
associated with the ongoing operations Control Systems, Part 2-3: Patch Management in
and maintenance of IACS cybersecurity the IACS Environment
implemented in the Design & Implementation
ANSI/ISA-62443-2-4-2018 / IEC 62443-2-
phase
4:2015+Amd1:2017 CSV–Security for Industrial
• ISA/IEC 62443 cybersecurity expert, which is Automation and Control Systems, Part 2-4:
earned by successful completion of the all Security Program Requirements for IACS Service
four cybersecurity certificates Providers
ISA Training for Product Suppliers IEC TR 62443-3-1:2009-Security for Industrial
and Certifying Bodies Automation and Control Systems, Part 3-1:
ISASecure joined forces with ISA Training to Security Technologies for Industrial Automation
develop the following ISA/IEC 62443 based and Control Systems
courses specifically designed for product
suppliers, accessors, and certifying bodies. ISA-62443-3-2-2020–Security for Industrial
Automation and Control Systems, Part 3-2:
• Overview of ISA/IEC 62443 for Product
Security Risk Assessment for System Design
Suppliers (IC46M) is a self-paced modular
14
ANSI/ISA-62443-3-3-2013 / IEC 62443-4-2:2013– References
Security for Industrial Automation and Control
Systems, Part 3-3: System Security Requirements NIST SP 800-82 Revision 2, Guide To Industrial
and Security Levels Control Systems (ICS) Security

ANSI/ISA-62443-4-1-2018 / IEC 62443-4-1:2018– United Nations Commission to Integrate ISA/IEC

Security for Industrial Automation and Control 62443 Into Cybersecurity Regulatory Framework,
Systems, Part 4-1: Product Security Development ISA InTech magazine, Jan-Feb 2019
Lifecycle Requirements
The 62443 Series of Standards: Industrial
ANSI/ISA-62443-4-2-2018 / IEC 62443-4- Automation and Control Security, ISA99
2:2019–Security for Industrial Automation and committee
Control Systems, Part 4-2: Technical Security
Frequently Asked Questions: The ISA99
Requirements for IACS Components
Committee and 62443 Standards, ISA99
IEC TR 63069:2019–Industrial-Process committee
Measurement, Control and Automation–
Instrumentation And Control Systems
Framework for Functional Safety and Security
Security Explained: the What and the Why,
IEC TR 63074:2019–Safety Of Machinery–Security ISA99 committee
Aspects Related to Functional Safety of Safety-
Related Control Systems

This document contains some information

that is based on ISA99 Committee draft
documents. Please refer to the published
documents for the definitive set of
requirements currently available.

ISAGCA.ORG 15
 GLOBAL
CYBERSECURITY
ALLIANCE
©2024 International Society of Automation
16