ISA/IEC 62443 Consulting Service

IEC 62443 Compliance Consulting for Industrial Control Systems and OT Cyber Security

Manufacturing plants, energy infrastructure, factories, critical infrastructure and industrial automation systems no longer consist of physical processes alone. PLCs, SCADA, DCS, HMIs, RTUs, industrial network devices, engineering workstations, historians, IIoT devices, remote access infrastructure and central management systems are increasingly connected to one another and to corporate IT.

While this transformation delivers operational efficiency, it also significantly increases OT cyber security risk.

SecureSys provides end-to-end ISA/IEC 62443 consulting to help organisations achieve compliance with the ISA/IEC 62443 family of standards, determine their current OT security level, expose their gaps and build a sustainable industrial control systems cyber security management model.

Our IEC 62443 consulting approach does not focus on preparing documentation. The existing OT architecture, industrial assets, network segmentation, remote access methods, user and permission structure, security policies, supplier access, patch and vulnerability management, incident response processes, backup infrastructure and OT security controls are all assessed together.

The aim is to build an IEC 62443 security architecture that does not disrupt production continuity, takes operational requirements into account and matches the organisation's real risks.

What Is ISA/IEC 62443?

ISA/IEC 62443 is the international family of standards for securing the industrial automation and control systems defined as IACS.

The standard family does not treat deploying a firewall, using antivirus or separating the OT network from IT as sufficient on its own.

In the IEC 62443 approach, security is addressed across dimensions including:

• People,
• Process,
• Technology,
• System architecture,
• Product development,
• Risk management,
• Supplier management,
• Operations,
• Maintenance,
• The secure development lifecycle

Unlike classic information security standards, IEC 62443 therefore offers a comprehensive approach developed specifically for the security of industrial automation systems and operational technology environments.

The standard can be applied across the many different sectors that use IACS — from energy generation and distribution to factories, from oil and gas facilities to transport systems, and from building automation to industrial production lines.

What Is IEC 62443 Consulting?

IEC 62443 consulting is the process of assessing an organisation's existing industrial automation and control system infrastructure against the IEC 62443 requirements, identifying the risks, defining the appropriate security levels and establishing the necessary technical and organisational controls.

SecureSys IEC 62443 consulting begins by focusing on understanding the organisation's current position.

No two OT environments are the same.

The risks of a manufacturing plant can differ from those of an energy generation facility, a water treatment plant, a logistics automation infrastructure or a defence industry production line.

Rather than applying a standard checklist, a risk-based OT security approach should therefore be adopted in IEC 62443 compliance work.

Why IEC 62443?

OT systems historically ran on closed, isolated networks.

Today, however, production systems increasingly communicate with ERP systems, MES platforms, central data centres, cloud services, remote maintenance systems, vendor support infrastructure, IoT and IIoT devices and third-party service providers.

This is changing the boundary between IT and OT.

If a cyber attack reaches the OT environment, the consequence may not be data loss alone.

The attack can cause production to stop, physical processes to be affected, product quality to degrade, equipment to be damaged, occupational health and safety risks, environmental impact and serious financial loss.

This is exactly where IEC 62443 comes in.

The standard helps organisations manage OT security systematically and on a risk basis.

Who Needs ISA/IEC 62443?

IEC 62443 is not a standard written for large factories alone.

It can be applied by many organisations that use industrial automation or control systems, or that develop products and services for them.

IEC 62443 is an important cyber security framework in particular for:

manufacturing plants, energy companies, electricity generation and distribution organisations, oil and gas companies, petrochemical facilities, defence industry organisations, automotive manufacturers, food production facilities, pharmaceutical manufacturers, mining companies, water and wastewater facilities, transport infrastructure, logistics centres, building automation systems, machinery manufacturers, industrial software developers, automation vendors and system integrators

The product and secure development requirements of IEC 62443 are also particularly important for manufacturers developing PLCs, HMIs, industrial gateways, industrial switches, SCADA software, IIoT platforms and similar products for their customers.

The IEC 62443 Standard Family

ISA/IEC 62443 does not consist of a single document.

The standard family comprises several parts addressing the responsibilities of different stakeholders and the different layers of IACS security.

The general approach can be considered in four main groups:

IEC 62443-1 – General concepts

Covering terminology, concepts, models and the underlying structure of the IEC 62443 approach.

IEC 62443-2 – Security management

Focusing on the processes by which asset owners and service providers should manage IACS cyber security.

IEC 62443-3 – System security

Covering risk assessment, system design, security levels, zone and conduit architecture and system security requirements.

IEC 62443-4 – Product and component security

Covering the secure development lifecycle for industrial products and the technical security requirements of IACS components.

This structure means IEC 62443 covers not only the facility operator but also the product manufacturer, the system integrator, the service provider and other stakeholders in the OT ecosystem.

IEC 62443-2-1 Consulting

IEC 62443-2-1 is one of the important parts, focusing on IACS asset owners establishing a cyber security management programme for their industrial automation and control systems.

SecureSys IEC 62443-2-1 consulting assesses the organisation's existing OT security management structure.

The work examines OT cyber security policies, roles and responsibilities, asset management, risk management, user management, access control, remote access, incident management, change management, backup, business continuity, supplier security, security awareness, security monitoring and continuous improvement processes.

The aim is to establish a sustainable OT cyber security management system within the organisation.

IEC 62443-3-2 Risk Assessment

One of the most important stages of OT security is a sound risk assessment.

IEC 62443-3-2 is critical for carrying out a security risk assessment in system design and for dividing the system into security zones.

The SecureSys consulting methodology begins by defining the System under Consideration – SuC to be assessed.

The critical assets within the system, the communication relationships, trust zones, external connections and potential threat scenarios are then assessed.

The risk assessment establishes which systems need a higher level of protection.

Security investment can therefore be planned on a risk-priority basis rather than at random.

What Is Zone and Conduit Architecture?

One of the most important concepts in IEC 62443 is the zones and conduits approach.

In many OT environments, having all devices on the same network creates serious security risk.

For example, allowing PLCs, HMI systems, engineering workstations, historian servers, operator computers, CCTV systems and corporate IT systems to reach one another without control makes it easier for attackers to move laterally through the network.

In the IEC 62443 approach, systems with similar security requirements are grouped within a zone.

The controlled communication paths between zones are treated as conduits.

This forms the basis of OT network segmentation.

SecureSys consulting analyses the existing network architecture and can prepare an appropriate zone and conduit design.

Security layers can be built, for example, as:

Enterprise IT Zone → OT DMZ → Manufacturing Operations Zone → Control Zone → Cell/Area Zone → Safety Systems

The final architecture must nonetheless be determined according to the facility's real structure, its production processes and its risk level.

What Is an IEC 62443 Security Level?

The concept of security level – SL plays an important role in assessing security requirements under IEC 62443.

The security level approach helps determine what level of security a system or component needs to provide against particular threat capabilities.

Security levels generally increase from SL1 to SL4.

SL 1

Basic protection against casual or accidental security breaches.

SL 2

Protection against attackers with simple tools and limited resources.

SL 3

A higher security level against more sophisticated attackers with knowledge of and capability in OT systems.

SL 4

The highest level of protection against attackers with high motivation, advanced capability and significant resources.

Not every system needs to be SL4.

This is one of the important advantages of IEC 62443.

The target security level should be determined as an outcome of the risk assessment.

An unnecessarily high security level creates operational complexity and cost, while a level set too low leaves critical risks open.

IEC 62443-3-3 System Security

IEC 62443-3-3 is one of the important parts of the standard covering the technical security requirements and security levels for industrial automation and control systems.

In the IEC 62443 approach, system security is addressed through seven foundational requirement areas:

FR 1 – Identification and Authentication Control

Reliable identification and authentication of users, devices and software processes.

FR 2 – Use Control

Keeping authorisation and access rights under control.

FR 3 – System Integrity

Protecting systems and data against unauthorised modification.

FR 4 – Data Confidentiality

Ensuring the confidentiality of data that needs to be protected.

FR 5 – Restricted Data Flow

Network segmentation and control of data flows.

FR 6 – Timely Response to Events

Detecting and recording security events and being able to carry out the necessary response.

FR 7 – Resource Availability

Preserving the availability of critical systems and resources.

SecureSys IEC 62443 consulting can map these foundational requirements to the organisation's existing OT environment and build a technical control matrix.

IEC 62443-4-1 Secure Product Development

One of the most important parts for companies developing industrial software, devices or automation products is IEC 62443-4-1.

IEC 62443-4-1 addresses how security is managed across the product development lifecycle.

This is particularly important for PLC manufacturers, HMI manufacturers, SCADA software developers, IIoT product manufacturers, industrial gateway manufacturers, OT security product developers and industrial software firms.

SecureSys IEC 62443-4-1 consulting supports the establishment of a secure development lifecycle.

The work assesses the definition of security requirements, threat modelling, secure design, secure coding, code review, security testing, vulnerability management, update management, security documentation and product lifecycle processes.

Security then ceases to be a feature added after the product is finished and becomes a natural part of the development process.

IEC 62443-4-2 Component Security

IEC 62443-4-2 addresses the technical security requirements of the components used in IACS environments.

Different component types can be assessed:

• Software applications,
• Embedded devices,
• Host devices,
• Network devices

Security features such as authentication, access control, integrity, data confidentiality, communication security, event logging, secure updating and availability are examined at product level.

IEC 62443-4-2 can therefore be particularly important for manufacturers bringing industrial products to international markets.

IEC 62443 Gap Analysis

One of the first steps on the IEC 62443 compliance journey is carrying out an IEC 62443 gap analysis.

The SecureSys IEC 62443 gap analysis establishes the difference between the organisation's existing security maturity and the target IEC 62443 requirements.

The gap analysis is not a documentation check.

The technical and operational structure of the OT infrastructure is assessed alongside it.

The work can examine existing policies, procedures, network topologies, the OT inventory, user accounts, access methods, firewall rules, remote connections, backup infrastructure, log management, security monitoring systems, patch processes, vulnerability management and supplier access.

The analysis produces a prioritised IEC 62443 compliance roadmap for the organisation.

How Does the IEC 62443 Compliance Process Work?

SecureSys IEC 62443 consulting projects are tailored to the organisation's scope but generally consist of the following stages.

1. Scope definition

The facilities, systems, production lines and critical OT assets to be assessed are identified.

2. OT asset inventory

PLCs, SCADA, DCS, HMIs, RTUs, engineering workstations, industrial switches, historians and other OT assets are assessed.

3. Current-state analysis

The existing technical and organisational security controls are examined.

4. IEC 62443 gap analysis

The current state is compared against the relevant IEC 62443 requirements.

5. Risk assessment

Critical systems, threat scenarios and possible impacts are assessed.

6. Zone and conduit design

A target architecture is prepared for dividing the OT network into security zones and controlling communication between them.

7. Security level determination

Target security levels are assessed on the basis of the risk results.

8. Development of policies and procedures

Policies, procedures, instructions and record structures specific to OT security are prepared.

9. Technical improvement plan

An action plan is prepared for network segmentation, firewalls, OT DMZ, PAM, NAC, secure remote access, log management, SIEM, OT monitoring, backup and other controls.

10. Implementation support

Technical consulting is provided while the defined controls are applied.

11. Verification

Whether the controls applied meet the target requirements is assessed.

12. Audit / certification readiness

The necessary preparation is carried out according to the conformity or certification model the organisation is targeting.

Why Does the OT Asset Inventory Matter?

You cannot protect a system you cannot see.

One of the fundamental problems in OT security is that many organisations do not know precisely which devices are present on their industrial network.

PLCs added over the years, engineering computers, legacy Windows systems, maintenance laptops, vendor modems, unmanaged switches or temporary remote access connections can all become permanent over time.

An accurate OT inventory is therefore critical in IEC 62443 consulting work.

Wherever possible, the inventory assesses device type, manufacturer, model, firmware, IP address, MAC address, operating system, protocol, location, criticality, owner, network segment and support status.

The Difference Between IT and OT Security

IT security and OT security are not the same.

In the IT world, confidentiality is often an important security objective.

In the OT world, availability, operational continuity and physical process safety can be extremely critical.

A corporate computer can be restarted for a security update.

A PLC or SCADA server running production, however, may not be restartable without planning.

Applying classic IT security practices directly to an OT environment can therefore create risk for production continuity.

This is where the strength of the IEC 62443 approach lies.

Security controls are designed taking operational requirements and the real working conditions of industrial systems into account.

OT Network Segmentation

One of the fundamental principles of industrial network security is sound network segmentation.

Flat network architectures make it easier for an attacker to reach other critical systems from one compromised system.

SecureSys IEC 62443 consulting assesses the existing OT network topology and develops secure architecture recommendations for IT/OT separation, the OT DMZ, production zones, security zones, cell/area segments, management networks, separation of safety instrumented systems, vendor access and external system connections.

The aim here is not simply to create VLANs.

Genuine segmentation has to be addressed together with:

network access rules + firewall policies + trust relationships + user permissions + data flow control + monitoring

Secure OT Remote Access

One of the most critical attack surfaces in OT environments is remote access infrastructure.

Maintenance companies, system integrators and vendor support teams may from time to time need remote access to PLCs, SCADA or other control systems.

Uncontrolled VPN accounts, shared users, direct RDP access or permanently open vendor connections create serious security risk.

In the SecureSys approach, remote access is assessed through controls such as MFA, VPN, PAM, jump servers, time-limited access, session recording, approval workflows, least privilege and central logging.

OT Vulnerability Management

Vulnerability management in OT systems has to be approached differently from IT.

It may not be possible to patch every vulnerable device immediately.

Some systems cannot be stopped because of production, vendor support may have ended, or new firmware may create risk for the process.

OT vulnerability management should therefore be run through the cycle:

discover → assess → rate the risk → prioritise → test → plan → apply → verify

Compensating controls can be established for systems that cannot be patched.

Network segmentation, access restrictions, IPS rules, application allowlisting and monitoring are examples.

The OT Incident Response Process

Responding to an OT security incident can differ from classic IT incident response.

Shutting down a system believed to have been attacked in a production environment can affect the physical process.

Establishing an incident response plan specific to the OT environment is therefore important in IEC 62443 compliance work.

The plan can define incident classification, responsibilities, communication methods, isolation procedures, evidence collection, coordination with production teams, third-party communication, recovery processes and post-incident review.

OT Log Management and Security Monitoring

Preventive controls alone are not enough for IEC 62443 compliance to be sustainable.

The security events occurring in the OT environment have to be made visible.

Firewall logs, Windows event logs, authentication records, remote access logs, OT network monitoring records, critical configuration changes and other available security events can therefore be monitored centrally.

SIEM, SOC and OT network detection technologies can play an important role here.

The aim is not simply to collect logs but:

to establish normal behaviour, detect anomalous activity and respond quickly to security events.

What Is the Difference Between IEC 62443 and ISO 27001?

ISO/IEC 27001 and IEC 62443 are not alternatives to one another.

ISO 27001 provides a comprehensive framework for a corporate information security management system, whereas IEC 62443 focuses specifically on the security of industrial automation and control systems.

A manufacturing company may hold ISO 27001 certification, but that does not mean the PLCs, SCADA, HMIs, engineering workstations and industrial network architecture in its OT environment are secure according to the IEC 62443 approach.

In organisations with critical OT infrastructure, ISO 27001 and IEC 62443 can therefore be treated as complementary approaches.

IEC 62443 Certification Readiness

The phrase "IEC 62443 certificate" should not be taken to refer to a single certificate.

The scope of conformity assessment varies according to the organisation's role, the product, the system and the target standard.

Different assessment routes may apply, for example, for a product development lifecycle, an IACS component, a control system or an asset owner organisation.

SecureSys therefore establishes the organisation's objective at the start of the consulting process.

Are you an asset owner?

Are you a system integrator?

Are you a service provider?

Are you a product supplier?

Are you developing industrial software or devices?

The relevant IEC 62443 parts and the conformity objective are determined from the answers to these questions.

IEC 62443 Consulting Deliverables

Depending on project scope, SecureSys can produce the following deliverables:

• IEC 62443 Gap Analysis Report
• OT Cyber Security Current-State Report
• OT Asset Inventory
• Risk Assessment Report
• Risk Treatment Plan
• Zone and Conduit Design
• Network Segmentation Recommendations
• Target Security Level Assessment
• OT Cyber Security Policy
• Access Control Policy
• Remote Access Procedure
• Vulnerability Management Procedure
• Patch Management Procedure
• Backup and Recovery Procedure
• Incident Response Plan
• Supplier Security Requirements
• Secure Configuration Standard
• Log Management Requirements
• OT Monitoring Requirements
• Secure Development Lifecycle documentation
• IEC 62443 Compliance Matrix
• Action and Improvement Plan
• Executive Gap Analysis Summary
• Audit Readiness Report

The deliverables are tailored to the organisation's role and the target IEC 62443 scope.

How Long Does IEC 62443 Consulting Take?

The duration of an IEC 62443 consulting project depends on the organisation's size, the number of facilities, the number of OT assets, the target parts of the standard and the existing security maturity.

Assessing a single production line is not the same size of project as assessing a corporate structure with several factories.

A scoping exercise is therefore carried out at the start of the project, assessing the number of facilities, the number of production lines, the critical systems, the network structure, the existing documentation and the target IEC 62443 parts.

The project plan and resourcing are then determined.

What Happens After the IEC 62443 Gap Analysis?

A gap analysis should not be carried out simply to produce a list of shortcomings.

The real value lies in turning the gaps identified into an applicable transformation programme.

After the gap analysis, SecureSys can therefore classify the findings by risk level as:

critical, high, medium and low priority

The actions can also be planned as:

quick win, short term, medium term and strategic

Management can then assess more easily which security investment should be made first.

IEC 62443 and OT Security Testing

An IEC 62443 compliance programme can be supported by technical validation.

Depending on the consulting scope, SecureSys can carry out OT/ICS security assessment, network security analysis, configuration analysis, segmentation checks, firewall rulebase analysis, vulnerability analysis, secure architecture review and controlled OT/ICS penetration testing.

OT penetration testing should not be carried out in the same way as classic IT penetration testing, however.

The availability of production systems and process safety always take priority.

Active security testing must therefore be carried out with a controlled scope, within a maintenance window and following a risk assessment.

Why Does IEC 62443 Consulting Matter?

IEC 62443 compliance should not be seen merely as an audit requirement.

Applied correctly, it is a transformation programme that raises the organisation's real OT cyber security level.

It can deliver better OT visibility, stronger network segmentation, controlled remote access, better supplier management, more systematic vulnerability management, faster incident response, secure product development and sustainable OT security management.

Most importantly, it makes cyber security part of production continuity.

Why SecureSys for IEC 62443 Consulting?

IEC 62443 consulting is not a matter of interpreting the clauses of the standard.

In a successful OT cyber security project, the consulting team has to hold both a governance and a technical security perspective.

SecureSys assesses IEC 62443 compliance requirements together with real OT/ICS security controls.

Our approach is based on the model:

See the Current State → Identify the Risk → Design the Target Architecture → Apply the Controls → Verify Technically → Improve Continuously

The aim is for the policies and procedures produced to be consistent with the OT architecture in the field.

From PLC to SCADA, from OT firewalls to remote access, and from zone and conduit design to security level assessment, the process is addressed as a whole.

Frequently Asked Questions

What is IEC 62443?

IEC 62443 is the international family of standards for the cyber security of industrial automation and control systems. It addresses the security of OT and IACS environments across the people, process and technology dimensions.

Are ISA/IEC 62443 and IEC 62443 the same?

The term ISA/IEC 62443 refers to the development and publication structure of the standard family across ISA and IEC. The terms "IEC 62443", "ISA 62443" and "ISA/IEC 62443" are all used widely in searches.

Who is IEC 62443 suitable for?

It can be applied by manufacturing plants, energy companies, critical infrastructure operators, industrial product manufacturers, automation firms, system integrators and OT service providers.

What is the difference between IEC 62443 and ISO 27001?

ISO 27001 focuses on the information security management system, whereas IEC 62443 specifically addresses industrial automation and control systems and OT security.

What is an IEC 62443 gap analysis?

It is the comparison of an organisation's existing OT security controls against the relevant IEC 62443 requirements and the identification of the gaps.

What is IEC 62443-3-2?

It is one of the important parts of the standard for security risk assessment in IACS environments, defining the system under consideration and applying the zone and conduit approach.

What is IEC 62443-3-3?

It addresses the system security requirements and security levels for industrial automation and control systems.

What is IEC 62443-4-1?

It addresses the secure product development lifecycle requirements for manufacturers developing industrial control system products.

What is IEC 62443-4-2?

It addresses the technical security requirements of the components used within IACS, such as software applications, embedded devices, host devices and network devices.

What are zones and conduits?

It is the approach of grouping assets with similar security requirements into security zones and carrying out communication between those zones through controlled channels.

What is an IEC 62443 security level?

It is the approach used to express the level of security a system or component needs to provide. IEC 62443 defines increasing security levels from SL1 to SL4.

What does IEC 62443 consulting cover?

It can cover scope definition, gap analysis, risk assessment, OT inventory, zone and conduit design, security level assessment, policy and procedure development, technical improvement, implementation support and conformity readiness.

Strengthen Your OT Security With ISA/IEC 62443 Consulting

OT cyber security is not simply deploying a firewall, disconnecting the PLC network from the internet or running a vulnerability scan once a year.

Genuine OT security begins with knowing your assets, understanding your risks, dividing your systems into the right zones, controlling access, monitoring security events, managing suppliers and making all of these processes sustainable.

Through its ISA/IEC 62443 consulting, IEC 62443 gap analysis, OT cyber security, ICS/SCADA security, zone and conduit design, security level assessment and IEC 62443 compliance consulting services, SecureSys helps organisations make their industrial systems more secure and more sustainable.

Strengthen your security without stopping production.

Let's assess the IEC 62443 compliance level of your OT infrastructure together.

Request an IEC 62443 Gap Analysis and Consulting Proposal

To establish how ready your existing OT/ICS infrastructure is for the IEC 62443 requirements, see the critical gaps and build a compliance roadmap tailored to your organisation, get in touch with the SecureSys team.

Start your IEC 62443 journey with a gap analysis.