Two-minute brief
IEC 62443 requirements explained: video brief
A two-minute brief on how the IEC 62443 series is organised and which parts apply to which role.
Key takeaways
- The series has four groups: concepts, policies, system and component requirements.
- Part 2-1 covers asset owners; Part 2-4 covers service providers.
- Part 3-2 sets zones, conduits and target security levels.
- Parts 4-1 and 4-2 cover product development and components.
- Each part has its own edition.
Four groups of standards
The IEC 62443 series is organised in four groups: general concepts, with terminology and models; policies and procedures; system requirements; and component requirements. Which parts an organisation must meet depends on its role, and the seven foundational requirements run through the technical parts, giving every control a name and a level. This short film maps the parts most often used.
Part 2-1 sets security programme requirements for asset owners: a programme of policies and procedures for control systems in operation, organised in security programme elements, with a maturity model and compensating measures for legacy equipment. In practice that means an OT security policy, roles across engineering and IT, an asset inventory, access and remote-access rules and change and patch procedures. Part 2-4 sets requirements for service providers that integrate and maintain systems.
Risk, systems and products
Part 3-2 covers security risk assessment for system design: the system under consideration is partitioned into zones and conduits, risks are assessed and a target security level is set for each zone and conduit. Part 3-3 sets the system security requirements and security levels, the technical capabilities a system needs to reach each level. Part 4-1 sets secure product development lifecycle requirements for suppliers, and Part 4-2 the technical security requirements for components such as controllers, devices and software.
Each part has its own edition, for example 2-1:2024 for asset owners and 2-4:2023 for service providers. Products, systems and development processes are certified under IECEE's industrial cyber security programme and by ISASecure certification bodies; an asset owner's deployed system and programme are usually evidenced by independent conformance assessment. The series is relevant to operators of plants, utilities, pipelines, rail, water and buildings, their integrators and maintenance providers, and makers of control products.
Security levels 1 to 4 describe the attacker a zone, system or component is protected against, from casual or coincidental violation to sophisticated, well-resourced attack. An ISO/IEC 27001 system gives governance and a risk method, but not zones and conduits or target security levels.
IEC 62443 at a glance
- Purpose
- Security for industrial automation and control systems (IACS): a series that shares responsibility between the asset owner, the service providers and the product suppliers, built on zones, conduits and security levels
- Relevant to
- Operators of plants, utilities, pipelines, rail, water and buildings; the integrators and maintenance providers who serve them; makers of controllers, devices, software and systems; anyone asked for IEC 62443 by a customer, regulator or insurer
- Edition
- A series, each part with its own edition: 2-1:2024 (asset owners), 2-4:2023 (service providers), 3-2:2020 (risk assessment), 3-3:2013 (system requirements and security levels), 4-1:2018 and 4-2:2019 (products)
- Certification
- Products, systems and development processes are certified under IECEE's Industrial Cyber Security Programme and by ISASecure certification bodies; an asset owner's deployed system is usually evidenced by a conformance assessment, with ISASecure ACSSA inspection or certification available since February 2026
- Sterling's role
- Programme, risk assessment and evidence built with your team, Effivity, training, internal audit and evaluation readiness, then Sustain™
- Cost and timing
- Total investment for an IEC 62443 security programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
IEC 62443: questions people ask
Can a plant, a company or a site be "IEC 62443 certified"?
Products, systems and development processes are certified under ISASecure and IECEE. For an asset owner, the usual output is an evidenced security programme confirmed by an independent conformance assessment; since 17 February 2026 the ISASecure ACSSA scheme has also offered an inspection of a deployed control system (a report and a letter) and a certification (a three-year certificate).
What are the IEC 62443 security levels?
Security levels 1 to 4 describe the attacker a zone, system or component is protected against: SL 1 casual or coincidental violation; SL 2 intentional violation using simple means, low resources, generic skills and low motivation; SL 3 sophisticated means, moderate resources, IACS-specific skills and moderate motivation; SL 4 sophisticated means, extended resources, IACS-specific skills and high motivation. The risk assessment sets a target level per zone and conduit; systems and components declare the capability level they provide.
Which part of IEC 62443 applies to us?
Asset owners implement part 2-1 and use parts 3-2 and 3-3 to assess and specify their systems. Integrators and maintenance providers demonstrate part 2-4. Product suppliers develop under part 4-1 and build components to 4-2 and systems to 3-3. Many organisations hold two roles; the scope is agreed at the start.
Does Sterling issue IEC 62443 certificates or conformance reports?
No. Sterling provides consulting and hands-on support. Certification and inspection bodies listed by ISASecure or operating in the IECEE programme evaluate and decide, and the ISASecure scheme bars its bodies from giving consulting or remediation advice. A provider that offers to prepare you and certify you is offering paper.
Who issues IEC 62443 certificates?
ISASecure certifications are issued by certification bodies accredited to ISO/IEC 17065 and listed on isasecure.org, which in September 2026 include exida, TÜV Rheinland, TÜV SÜD PSB and UL Solutions among others; ACSSA inspections are performed by inspection bodies accredited to ISO/IEC 17020. IECEE certificates are issued by the national certification bodies of its CB Scheme. Verify the body on the scheme's site, not on a logo in a quotation.
Keep exploring
Related to this video
The complete guide
Everything on IEC 62443
Start with the IEC 62443 page, or go straight to the guide you need.
On the IEC 62443 page
More videos: Information security, cyber and cloud
- How to implement ISO/IEC 27018Implementation walkthrough · 3 min 15 s
- ISO/IEC 27018 requirements explainedTwo-minute brief · 2 min
- How to comply with the NCA Essential Cybersecurity Controls (Saudi Arabia)Compliance walkthrough · 3 min 15 s
- NCA Essential Cybersecurity Controls (ECC) requirements explainedTwo-minute brief · 2 min
- How to comply with the NIS2 DirectiveCompliance walkthrough · 3 min 15 s
- NIS2 Directive requirements explainedTwo-minute brief · 2 min
- How to implement NIST CSF 2.0Implementation walkthrough · 3 min 15 s
- NIST CSF 2.0 explainedTwo-minute brief · 2 min
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your IEC 62443 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice