Cybersecurity Requirements for IACS Service Providers

Learning objectives

Identify security responsibilities for integration and maintenance services.
Specify evidence rather than accepting broad compliance claims.
Include cyber activities in FAT, SAT, handover and support.
Control service-provider remote access and engineering environments.

Introduction

This module examines security across the relationship between asset owners and service providers.

Planned video lesson

Module 14 video lesson

Video lesson coming soon. The written module can be completed without the video.

Planned recording: 10-12 minutes reviewing a weak “IEC 62443 compliant integrator” tender response and replacing it with evidence-based requirements.

Transcript will be added with the video.

Main lesson

Service providers shape the achieved system

IEC 62443-2-4 addresses security programme requirements for IACS service providers. System integrators and maintenance providers influence:

Architecture and product selection.
Engineering toolchains.
Accounts and privileges.
Network and security configuration.
Remote-support routes.
Testing and defect closure.
Backups and restoration.
Handover quality.
Changes during operational support.

A secure product can be weakened by default accounts, broad firewall rules, unprotected project files or undocumented maintenance access.

Integration and maintenance have different risks

Integration service	Maintenance service
Converts requirements into architecture and configuration	Preserves the approved baseline during operation
Selects and combines components	Assesses advisories, updates and obsolescence
Builds and tests the solution	Uses controlled access and change processes
Produces system evidence and handover records	Keeps inventory, backups and records current
Closes commissioning access and defects	Supports events, recovery and periodic review

The same organisation may perform both, but the responsibilities and evidence remain distinct.

A supplier security schedule

Include requirements for:

Competent roles and named security responsibility.
Secure project and engineering environments.
Personnel access and joiner / mover / leaver controls.
Protection of project files, credentials, keys and certificates.
Configuration and change management.
Control of subcontractors and externally supplied components.
Product vulnerability and support information.
Secure remote-access method.
Incident and vulnerability notification.
Backup and restoration testing.
Security verification in FAT and SAT.
Defect tracking and closure.
Handover, training and operational support.
Secure disposal of temporary data, accounts and equipment.

Ask for evidence at tender stage

Useful evidence includes:

Scope-specific security plan.
Responsibility and interface matrix.
Competence and training approach.
Secure development or engineering procedures.
Example hardening and configuration records.
Vulnerability-handling process.
Patch and update process.
Remote-access architecture and session records.
Test specifications and representative reports.
Incident-notification route.
Product support and end-of-life policy.

A certificate may support the evaluation, but inspect its scope, edition, assessed site or organisation, maturity level, product version and exclusions.

FAT and SAT should test cyber requirements

Possible FAT activities:

Confirm ports, services and accounts against the approved baseline.
Test role permissions and failed authentication.
Confirm remote access is disabled by default.
Inspect firewall and switch configuration.
Verify security-event generation and time stamps.
Test backup creation and controlled restoration.
Verify update authenticity and rollback method.
Check that default and temporary credentials are removed.

Possible SAT activities:

Confirm installed topology and connectivity match the design.
Test each conduit and intended failure behaviour.
Confirm enterprise, telemetry and remote paths.
Verify site physical and operational dependencies.
Demonstrate isolation and degraded operation.
Reconcile the final asset inventory and drawings.

Handover is a security control

The asset owner needs:

As-built zone-and-conduit and network diagrams.
Data-flow and firewall-rule records.
Asset, software and firmware inventory.
Account, role, certificate and key ownership.
Secure configuration and hardening records.
Backup set and restoration instructions.
Vulnerability, patch and support contacts.
Open defects, deviations and residual risks.
Training and maintenance requirements.

If the operator cannot restore, maintain or understand the delivered system, security has not been handed over.

Planned original figure — M14-F01

Create a responsibility swimlane across asset owner, system integrator, maintenance provider and product supplier from requirements to handover and operation.

Planned asset: /static/training/ot-cyber-security/module-14/figure-01.svg

Engineering example

Riverside application

Riverside depends on integrators, maintainers and vendors whose working practices can strengthen or bypass the approved architecture.

Practical activity

Apply what you learned

Write a ten-line supplier security schedule. Every line should identify:

Required activity.
Responsible provider role.
Deliverable or evidence.
Asset-owner approval point.

Include at least one integration, one maintenance, one incident and one handover requirement.

Your response (optional)

Record your reasoning and project notes here. Your response stays in this browser and is not submitted to the website.

Loading saved response…

0 / 10,000

Do not enter real credentials, confidential network details, sensitive asset information or security-sensitive project data.

Knowledge check

Answer every question correctly to complete this module. If an answer is incorrect, review the explanation and try again. This is not a formal examination.

1. A bidder provides an IEC 62443 certificate for its parent company but no other detail. What should the evaluator do next?

Accept it as proof because group certificates cover every subsidiary, location and service by default.Check the scheme, part, edition, scope, sites, activities and exclusions against the contracted work.Reject it because certificates are irrelevant when the asset owner performs final acceptance testing.

2. Which FAT package provides the strongest cyber security evidence?

A signed supplier declaration, product brochures and a list of security features included in the design.A vulnerability scan of every device, performed without functional tests because cyber and process acceptance are independent.Requirements-based tests of accounts, boundary rules, event logs, remote access, update integrity and controlled restoration against the baseline.

3. A maintainer proposes a new direct remote route after commissioning. What is the correct response?

Treat it as an architectural change: assess the conduit, specify controls, test it and obtain asset-owner approval before use.Permit it temporarily under the maintainer’s corporate VPN policy and review it at the next annual audit.Allow it if the remote gateway is certified, because component assurance preserves the original system assessment.

0 of 3 questions answered correctly.

Key takeaways

Remember these points

Supplier claims must be checked against the contracted scope, version, location and lifecycle activity.
Cyber requirements belong in tendering, FAT, SAT, handover and maintenance arrangements.
Maintenance access must be designed into the architecture rather than added later as an exception.

Relevant standards and guidance

This module uses original explanatory language. Consult the applicable editions and project requirements rather than treating this lesson as normative text.

ISA/IEC 62443-2-4

Last reviewed

15 July 2026.