Implementation walkthrough
How to implement IEC 62443: video walkthrough
A walkthrough of applying IEC 62443 to industrial automation and control systems, starting from your role as asset owner, service provider or product supplier.
Key takeaways
- IEC 62443 is a series with parts for asset owners, service providers and product suppliers.
- Safety and availability come first in control systems.
- Systems are divided into zones and conduits with target security levels.
- Seven foundational requirements run through the technical parts.
- Products and processes can be certified; deployed systems are usually assessed for conformance.
Security for systems that run plants and utilities
IEC 62443 is the international series of standards for the security of industrial automation and control systems: the controllers, operator stations, engineering workstations, networks and safety systems that run plants, utilities, pipelines, rail, water treatment and buildings. It is developed by IEC technical committee 65 and published in the United States by ISA as ISA/IEC 62443. It is a family, not one document, with parts for the asset owner who operates the system, the service providers who integrate and maintain it, and the suppliers who build the products in it.
Its logic differs from office IT security. In a control system, safety and availability come first, and a device may run for many years on software nobody will patch. This short film walks through how the series is applied.
Start from your role
The first step is to establish the role: asset owner, service provider, product supplier, or more than one. That decides which parts apply. An asset owner builds a security programme for control systems in operation, with policies, roles across engineering and IT, an asset inventory, access and remote-access rules, change and patch procedures and compensating measures for legacy equipment. A service provider meets the requirements for the integration and maintenance services it delivers. A product supplier applies the secure development lifecycle and the technical requirements for components.
For systems, a risk assessment partitions the system into zones and conduits and sets a target security level for each, and the system requirements, organised under the seven foundational requirements that run through the technical parts, are then met at the level chosen. Evidence is kept as the work is done. The route to assurance also depends on role: products, systems and development processes can be certified under ISASecure or IECEE schemes, while an asset owner's deployed system and programme are usually evidenced by an independent conformance assessment.
Sterling's expert and experienced consultants support the programme with your engineering and IT teams under Sterling OS™. Certification and assessment decisions belong to the independent bodies.
IEC 62443 at a glance
- Purpose
- Security for industrial automation and control systems (IACS): a series that shares responsibility between the asset owner, the service providers and the product suppliers, built on zones, conduits and security levels
- Relevant to
- Operators of plants, utilities, pipelines, rail, water and buildings; the integrators and maintenance providers who serve them; makers of controllers, devices, software and systems; anyone asked for IEC 62443 by a customer, regulator or insurer
- Edition
- A series, each part with its own edition: 2-1:2024 (asset owners), 2-4:2023 (service providers), 3-2:2020 (risk assessment), 3-3:2013 (system requirements and security levels), 4-1:2018 and 4-2:2019 (products)
- Certification
- Products, systems and development processes are certified under IECEE's Industrial Cyber Security Programme and by ISASecure certification bodies; an asset owner's deployed system is usually evidenced by a conformance assessment, with ISASecure ACSSA inspection or certification available since February 2026
- Sterling's role
- Programme, risk assessment and evidence built with your team, Effivity, training, internal audit and evaluation readiness, then Sustain™
- Cost and timing
- Total investment for an IEC 62443 security programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
IEC 62443: questions people ask
Can a plant, a company or a site be "IEC 62443 certified"?
Products, systems and development processes are certified under ISASecure and IECEE. For an asset owner, the usual output is an evidenced security programme confirmed by an independent conformance assessment; since 17 February 2026 the ISASecure ACSSA scheme has also offered an inspection of a deployed control system (a report and a letter) and a certification (a three-year certificate).
What are the IEC 62443 security levels?
Security levels 1 to 4 describe the attacker a zone, system or component is protected against: SL 1 casual or coincidental violation; SL 2 intentional violation using simple means, low resources, generic skills and low motivation; SL 3 sophisticated means, moderate resources, IACS-specific skills and moderate motivation; SL 4 sophisticated means, extended resources, IACS-specific skills and high motivation. The risk assessment sets a target level per zone and conduit; systems and components declare the capability level they provide.
Which part of IEC 62443 applies to us?
Asset owners implement part 2-1 and use parts 3-2 and 3-3 to assess and specify their systems. Integrators and maintenance providers demonstrate part 2-4. Product suppliers develop under part 4-1 and build components to 4-2 and systems to 3-3. Many organisations hold two roles; the scope is agreed at the start.
Does Sterling issue IEC 62443 certificates or conformance reports?
No. Sterling provides consulting and hands-on support. Certification and inspection bodies listed by ISASecure or operating in the IECEE programme evaluate and decide, and the ISASecure scheme bars its bodies from giving consulting or remediation advice. A provider that offers to prepare you and certify you is offering paper.
Who issues IEC 62443 certificates?
ISASecure certifications are issued by certification bodies accredited to ISO/IEC 17065 and listed on isasecure.org, which in September 2026 include exida, TÜV Rheinland, TÜV SÜD PSB and UL Solutions among others; ACSSA inspections are performed by inspection bodies accredited to ISO/IEC 17020. IECEE certificates are issued by the national certification bodies of its CB Scheme. Verify the body on the scheme's site, not on a logo in a quotation.
Keep exploring
Related to this video
The complete guide
Everything on IEC 62443
Start with the IEC 62443 page, or go straight to the guide you need.
On the IEC 62443 page
More videos: Information security, cyber and cloud
- How to implement ISO/IEC 27018Implementation walkthrough · 3 min 15 s
- ISO/IEC 27018 requirements explainedTwo-minute brief · 2 min
- How to comply with the NCA Essential Cybersecurity Controls (Saudi Arabia)Compliance walkthrough · 3 min 15 s
- NCA Essential Cybersecurity Controls (ECC) requirements explainedTwo-minute brief · 2 min
- How to comply with the NIS2 DirectiveCompliance walkthrough · 3 min 15 s
- NIS2 Directive requirements explainedTwo-minute brief · 2 min
- How to implement NIST CSF 2.0Implementation walkthrough · 3 min 15 s
- NIST CSF 2.0 explainedTwo-minute brief · 2 min
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your IEC 62443 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice