Overview of the ISA/IEC 62443 Standards Series

Learning objectives

Navigate the principal document groups.
Identify asset owner, service provider and product supplier responsibilities.
Select the parts relevant to a project activity.
Explain why security depends on information passing between roles.

Introduction

This module provides an orientation to the ISA/IEC 62443 standards series.

Planned video lesson

Module 04 video lesson

Video lesson coming soon. The written module can be completed without the video.

Planned recording: 8-10 minutes navigating the four IEC 62443 groups and showing which role uses each part during Riverside's lifecycle.

Transcript will be added with the video.

Main lesson

One series, several viewpoints

IEC 62443 is a family of documents for industrial automation and control system security. It does not place every duty on one organisation. Different parts address organisational security programmes, service providers, system design, product development, component capabilities and evaluation methods.

Group	Main viewpoint	Typical questions
62443-1-x: General	Shared terminology, concepts, models and applications	What do the terms mean and how can the series be applied?
62443-2-x: Policies, programmes and use	Asset-owner and service-provider security processes	How is security governed, maintained, supported and operated?
62443-3-x: System	System risk, architecture and technical requirements	How should the IACS be divided and what must the system do?
62443-4-x: Component and product	Secure development and component capability	How was the product developed and which security functions can it support?
62443-6-x: Evaluation	Repeatable evaluation methods	How can evidence against selected 2-x or 4-x requirements be evaluated consistently?

The numbering is not a simple four-part hierarchy, and not every possible group or part number is populated. The publication set continues to evolve: IEC TS 62443-6-1:2024 addresses evaluation against IEC 62443-2-4, IEC TS 62443-6-2:2025 addresses evaluation against IEC 62443-4-2, and newer guidance includes IEC PAS 62443-2-2:2025 for an IACS security protection scheme. Use the current IEC or adopted national catalogue and the edition stated in the contract rather than relying on a fixed diagram copied from an old presentation.

The three main roles

Asset owner

The asset owner owns or operates the IACS and remains accountable for the operational risk. It defines the essential function, tolerable risk, operating constraints, security requirements and acceptance authority. It also maintains the security programme throughout operation.

Service provider

A service provider performs activities for the asset owner. This can include system integration, commissioning, maintenance, remote support or managed security. The system integrator selects and configures components into an automation solution, but cannot invent the asset owner's risk appetite or operating requirements.

Product supplier

The product supplier develops and supports hardware or software used within the solution. It should provide security capabilities, secure configuration guidance, update mechanisms, vulnerability information and lifecycle support. A secure component still requires secure integration and operation.

Security depends on role interfaces

Many project failures occur between organisations:

The asset owner asks for “SL 2” without defining the system or SL-T vector.
The integrator assumes the site will provide identity, time or logging services.
The product supplier assumes a firewall or physically secure environment.
The maintainer creates a remote path that was not included in the design assessment.
The operator receives a backup but no tested restoration method.

Make assumptions explicit. A useful role-interface schedule records:

Required input.
Providing party.
Receiving party.
Due date.
Acceptance criteria.
Evidence and document reference.

Choose parts by activity, not by prestige

For a new Riverside design:

Use IEC 62443-3-2 concepts to structure system security risk assessment and design.
Use IEC 62443-3-3 to specify system security requirements and target security levels.
Use IEC 62443-2-4 to set expectations for integration and maintenance service providers.
Use IEC 62443-4-1 evidence when assessing how a product supplier develops and supports products.
Use IEC 62443-4-2 when assessing component security capabilities.
Use IEC 62443-2-1 for the asset owner's operational security programme.
Use the relevant 62443-6-x document when a repeatable evaluation method is required; it supports evaluation and does not by itself create a complete certification scheme.

This is a relationship map, not a conformity declaration. The exact edition, scope and assessment route still need to be defined.

Planned original figure — M04-F01

Create an original series map with the four document groups across the top and asset owner, integrator / maintenance provider and product supplier roles underneath.

Planned asset: /static/training/ot-cyber-security/module-04/figure-01.svg

Engineering example

Riverside application

The Riverside design depends on clear interfaces between the asset owner, service providers and product suppliers; no single role can make the whole system secure alone.

Practical activity

Apply what you learned

Build a responsibility table for these decisions:

Define the essential function and tolerable risk.
Create the zone-and-conduit model.
Select products.
Configure and harden the system.
Approve remote access.
Test security functions.
Issue vulnerability notifications.
Qualify and deploy updates.
Accept residual risk.

Assign one accountable owner for every decision. Several parties may contribute, but shared accountability usually means no accountability.

Your response (optional)

Record your reasoning and project notes here. Your response stays in this browser and is not submitted to the website.

Loading saved response…

0 / 10,000

Do not enter real credentials, confidential network details, sensitive asset information or security-sensitive project data.

Knowledge check

Answer every question correctly to complete this module. If an answer is incorrect, review the explanation and try again. This is not a formal examination.

1. An organisation integrates a new automation solution and will maintain it after handover. Which part most directly addresses its service-provider security programme?

IEC 62443-2-4, covering security programmes for IACS service providers during integration and maintenance.IEC 62443-3-3, covering technical system security requirements and capability security levels.IEC 62443-4-1, covering the supplier’s secure product-development lifecycle.

2. A PLC has an IEC 62443-4-2 SL-C(component) claim. What can the system integrator conclude?

The process-control zone achieves the same security level once the PLC is installed with its default configuration.The component provides scoped capabilities; system achievement still depends on its integration and operation.The product supplier becomes accountable for the operational risk of the zone containing the PLC.

3. What is the purpose of the published IEC 62443-6-x documents?

They add higher security levels for systems and components whose threat exceeds SL 4.They replace the relevant 2-x and 4-x requirements with a common certification checklist.They define evaluation methods intended to improve repeatability against specified source requirements.

0 of 3 questions answered correctly.

Key takeaways

Remember these points

IEC 62443 assigns complementary responsibilities to asset owners, service providers and product suppliers.
A component claim does not establish the security of an integrated and operated system.
Product assumptions and external dependencies must become explicit system design evidence.

Relevant standards and guidance

This module uses original explanatory language. Consult the applicable editions and project requirements rather than treating this lesson as normative text.

ISA/IEC 62443 series

Last reviewed

15 July 2026.