IEC 62443 · Security for industrial automation and control systems
IEC 62443 certification consulting for control systems that stay safe, available and defensible.
Secure your plants, networks and products to the IEC 62443 series and prove it the way the series intends: certification of products, systems and development processes by an IECEE or ISASecure body, and an evidenced security programme, assessed for conformance, for the asset owner who runs the plant. Sterling's expert and experienced consultants build the programme with your engineers and IT team, run the zone-and-conduit risk assessment, prepare the evidence and stay with you through the evaluation and after it, in 60+ countries. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced OT and industrial cybersecurity consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; the scheme's certification or inspection body assesses and decides
8,100+ client engagements in 60+ countries.
IEC 62443 client experience
What it is
What is IEC 62443 and what is it used for?
IEC 62443 is the international series of standards for the security of industrial automation and control systems: the controllers, operator stations, engineering workstations, networks and safety systems that run plants, utilities, pipelines, rail, water treatment and buildings. It is developed by IEC technical committee 65 and published in the US by ISA as ISA/IEC 62443. It is a family, not one document: parts for the asset owner who operates the system, for the service providers who integrate and maintain it, and for the suppliers who build the products in it.
Its logic is different from office IT security. In a control system, safety and availability come first; a device may run for twenty years on software nobody will patch; and the people who understand the process are engineers, not security analysts. The series answers with shared responsibility between the roles, defence in depth, zones and conduits, and security levels that say how capable an attacker each zone must resist. A programme built on those ideas protects production; a firewall installed to satisfy a questionnaire does not.
Current editions. IEC 62443 is a series, and each part carries its own edition. The parts most engagements use are IEC 62443-2-1:2024 (asset owners; published 7 August 2024, replacing the 2010 edition), IEC 62443-2-4:2023 (service providers; published 15 December 2023, replacing the 2015 edition), IEC 62443-3-2:2020 (security risk assessment for system design), IEC 62443-3-3:2013 (system security requirements and security levels), IEC 62443-4-1:2018 (secure product development lifecycle) and IEC 62443-4-2:2019 (technical security requirements for components). There is no transition timetable of the kind ISO management system standards have: the part and edition an evaluation cites are fixed by the scheme and the body, so confirm them at the start.
Who it is for
Who needs IEC 62443 certification?
The first question is not whether you need IEC 62443 but which role you hold in it, because the role decides the parts that apply and whether the outcome is a certificate or a conformance assessment. Asset owners implement part 2-1 and the part 3-2 risk assessment for the systems they operate; integrators and maintenance providers demonstrate part 2-4 to the asset owners they serve; product suppliers develop to part 4-1 and build components to 4-2 and systems to 3-3. Organisations come to Sterling for IEC 62443 from four starting points:
- A customer, regulator or insurer has asked how your OT is secured. You operate the plant, the grid, the pipeline or the building. The answer is an IEC 62443-2-1 programme with a zone-and-conduit risk assessment behind it, evidenced by a conformance assessment; a certificate of the deployed system is a newer, narrower option.
- You integrate or maintain control systems and tenders now ask for IEC 62443-2-4. Asset owners are writing the service-provider part into contracts; a documented service security programme, with evidence per project, is what they assess.
- You build controllers, devices, software or systems and your customers want certified products. Part 4-1 for the development process and parts 4-2 and 3-3 for the product are what ISASecure and IECEE bodies evaluate, and the EU Cyber Resilience Act is sharpening the question.
- Your ISO/IEC 27001 certificate stops at the plant gate. The ISMS covers the offices, an incident or an audit finding has shown the control network was never in scope, and engineering and IT disagree about who owns it. The programme needs one owner and rules that respect the plant.
Be explicit about the outcome you are asking for: certification for products, systems and development processes; a conformance assessment, or ACSSA inspection or certification, for a deployed system. Results depend on the programme running, not on the document that describes it.
Business benefits
How IEC 62443 protects production and answers your customers
An OT security programme should protect the process, not slow it down. We start where a lost controller, an uncontrolled remote connection or an unknown device on the control network would cost production, safety or a contract, and build the programme around them.
- Safety and availability protectedMeasures chosen for their effect on the process, so a control failure or a ransomware event does not become a shutdown or a safety incident.
- A defensible answer to customers and regulatorsA zone-and-conduit model, target levels and evidence that the measures run, in the vocabulary the questionnaire, the regulator and the insurer use.
- A supply chain you can qualifyPart 2-4 requirements in integrator and maintenance contracts, and certified products preferred where risk justifies it, so security arrives with the equipment.
- Risk decisions engineers acceptRisk assessed per zone and conduit with the people who run the process, so measures fit maintenance windows, vendor support and the long life of the assets.
- Incidents you can detect and recover fromLogging, backups, restore tests and a response plan that name the OT systems, not the IT plan with "plant" added.
- A programme that survives legacy assetsCompensating measures recorded where a device cannot be patched or authenticated, so the gap is managed and visible rather than found by an attacker.
Choose a few measures that reflect these priorities, such as unmanaged remote connections closed, zones at their target level or the time to restore a controller from backup, and review whether the programme changes what happens on the plant floor. A thicker binder is not a business result.
Requirements
What are the main IEC 62443 requirements?
The series is organised in four groups: general concepts (IEC TS 62443-1-1:2009 defines the terminology and models), policies and procedures, system requirements and component requirements. Which parts you must meet depends on your role; the seven foundational requirements run through the technical parts and give every control a name and a level. The table is a plain-language map of the parts an engagement most often uses; your programme is checked against the applicable part and edition, requirement by requirement.
| Part | What it requires of you | What it looks like in practice |
|---|---|---|
| 2-1 Security programme requirements for asset owners | A programme of policies and procedures for control systems in operation, organised in security programme elements, with a maturity model and compensating measures for legacy equipment | An OT security policy, roles across engineering and IT, an asset inventory, access and remote-access rules, change and patch procedures, incident response, supplier rules and records of the measures in use |
| 2-4 Security programme requirements for service providers | The security capabilities an integrator or maintenance provider delivers during integration and maintenance, with profiles for industries | A documented service security programme: competent staff, hardening, remote access, patching, malware protection, backup, handover documentation and evidence per project |
| 3-2 Security risk assessment for system design | Define the system under consideration, partition it into zones and conduits, assess the risk of each, set its target security level and document the requirements | A zone-and-conduit drawing, a risk register per zone, a target level for every zone and conduit, and a cybersecurity requirements specification an integrator can build to |
| 3-3 System security requirements and security levels | Technical system requirements under the seven foundational requirements, at capability security levels 1 to 4 | Segmentation, authentication, logging, backup and recovery configured to each zone's target level, with gaps and compensating measures recorded |
| 4-1 Secure product development lifecycle requirements | Process requirements for developing products securely: requirements, secure design, implementation, verification, defect management, updates and end of life | A documented, versioned development process and the artefacts that show it was followed: threat models, test results, defect records, update procedures |
| 4-2 Technical security requirements for components | Component requirements for software applications, embedded devices, host devices and network devices, at capability security levels 1 to 4 | Security capabilities designed, implemented and tested into the product, with the evidence the body's functional security assessment and vulnerability testing ask for |
| FR 1 to 7 The seven foundational requirements | Identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability: the spine of 3-3 and 4-2 | Every technical control mapped to a foundational requirement and a security level, so a gap has a name and a target |
What does useful IEC 62443 evidence look like?
A current asset inventory per zone, the zone-and-conduit drawing with its target levels, the risk register and the decisions taken on it, access and remote-access rules with their logs, change and patch records, backup and restore tests, incident exercises, the service provider's per-project evidence and, for a supplier, the development lifecycle artefacts. We help identify the records your programme needs, without creating documents to fill folders, and they live in Effivity from the first workshop so the evaluator sees a programme that runs.
IEC 62443 requirements explained, part by partCertification process
How do you get IEC 62443 certified?
The route depends on your role. Products, systems and development processes are certified: ISASecure certification bodies, accredited to ISO/IEC 17065, evaluate components (CSA), IIoT devices and gateways (ICSA), systems (SSA) and development lifecycles (SDLA), and IECEE, IEC's conformity assessment system, tests and certifies to standards within the series through its CB Scheme's national certification bodies. An asset owner's deployed system and programme are usually evidenced by an independent conformance assessment against parts 2-1, 3-2 and 3-3; since 17 February 2026 the ISASecure ACS Security Assurance (ACSSA) scheme also offers an inspection (a report and a letter) or a three-year certification of a deployed control system. Sterling prepares the programme and the evidence; the body evaluates and decides, and the scheme keeps consulting and evaluation apart.
- 01Decide what is to be evaluated, by whom and against which part.Confirm your role, the system under consideration or the product, the scheme and body, the edition cited and the levels your customers or your risk assessment require.
- 02Gap analysis: review the current state against the applicable parts.The gap analysis inventories what is on the control network, records the measures that work, identifies what is missing against part 2-1, 2-4 or 4-1 and agrees actions, owners, dates and resources.
- 03Assess risk by zone and conduit and design the programme.Partition the system, assess each zone and conduit, set target levels with the engineers and write the policies, procedures and technical requirements the levels demand.
- 04Implement and collect meaningful evidence.Put the measures and compensating measures into use, train operators, engineers and administrators, and keep the records that show the programme operating.
- 05Audit, review and address the findings.Internal audit and management review test the programme against the part it claims; findings are raised by us first and closed with evidence.
- 06Complete the independent evaluation and maintain the programme.The body plans its evaluation, reviews documents and evidence, examines the system or product and decides; monitoring, audits and reviews continue on the surveillance cycle the scheme sets.
Check the credibility of the route, not just the quoted price. Ask which scheme the certificate or report is issued under, which part and edition it cites and which body will evaluate, and verify the body on the scheme's site. Be cautious of "IEC 62443 certified" offered to a plant in a fortnight: a report that fails a customer's check leaves the control network as exposed as before and the money spent. How to choose a credible IEC 62443 provider · The certification buyer's checklist
Cost
How much does IEC 62443 certification cost?
There is no useful universal price for IEC 62443. A single-site water utility with two zones needs a different scope from a multi-plant manufacturer with thirty zones and legacy controllers, and both differ from a supplier preparing a product line for certification. What we can promise is a proposal in which every component is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Your role and the parts in scope, the number of sites, zones and conduits, the state of the inventory, deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Independent evaluation | The certification or inspection body's fees: the scheme, the scope, the levels claimed, laboratory testing for products, site visits and surveillance |
| Technical changes and internal resources | Segmentation equipment, remote-access tooling, monitoring, backup capacity and compensating measures for devices that cannot meet the target level, usually the largest variable; plus engineering and IT time, maintenance windows, management involvement and training |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, programme upkeep, refresher learning, new sites and new editions under Sustain™ |
What moves the price
- Your role: asset owner, service provider or product supplier, and the parts that follow from it
- Number of sites, zones and conduits, and how much of the inventory exists today
- Legacy equipment and the compensating measures it needs
- The target security levels your customers or your risk assessment require
- Whether an ISMS exists to build on, and the deadline your team can carry
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does IEC 62443 certification take?
The realistic timeline depends on your role, the state of your inventory, the maintenance windows in which changes can be made, and the body's schedule. It is measured in months, not days, typically six to twelve: the measures have to operate long enough to produce the evidence an evaluator will ask for, and a plant changes only when production allows. We build the plan around that evidence, with milestones your team can track in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to sites, engineers, network drawings and the existing inventory |
| Risk assessment and design | Workshop time with process and control engineers, agreement on zones and target levels, and vendor information |
| Build and implementation | Maintenance windows, procurement of segmentation and remote-access tooling, approvals and internal capacity |
| Evidence and review | Measures operating long enough to demonstrate effectiveness, followed by internal audit and management review |
| Independent evaluation | The body's availability, the scheme's evaluation plan, laboratory testing for products and the time to address findings |
If you have a tender, a regulatory date or a customer deadline, share it at the start. We will tell you what is achievable and where early decisions are needed, such as which zones to segment first. A certificate date promised before anyone has walked the plant is not a plan; it is a sales tactic.
Challenges
Common IEC 62443 implementation challenges
Most IEC 62443 programmes stall for the same five reasons. Each has a practical answer.
The plant cannot be patched, rebooted or scanned like an office network.
We plan measures around the process: passive discovery for the inventory, changes in maintenance windows, and compensating measures recorded for every device that cannot be patched or authenticated, so residual risk is owned.
Engineering and IT disagree about who owns OT security.
Part 2-1 asks for a programme with roles. We facilitate the governance decision, define the responsibilities of engineering, IT and service providers, and give management one view of risks and actions across both.
Nobody has a complete inventory of what is on the control network.
Zones cannot be drawn around unknown assets. The gap analysis starts with the inventory, reconciled from drawings, vendor documentation and passive monitoring, and it lives in Effivity so it stays current after the project.
Integrators and vendors hold remote access nobody controls.
Remote connections become a conduit with its own requirements and owner. Part 2-4 requirements go into service contracts and each provider's evidence is reviewed per project, so access is granted, logged and closed on your terms.
The ISMS exists but stops at the plant gate.
The 2024 edition of part 2-1 was written to avoid duplicating an ISMS. We extend the scope, reuse the governance, risk method and document control you have, and add only what the control systems need.
Your engagement
What your IEC 62443 engagement includes
Your agreed scope brings together everything a working programme and a prepared team need. Most firms sell a risk assessment or a policy set and leave you to assemble the rest; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis and implementation plan
Your role, the parts in scope, the system under consideration or the product line, with responsibilities, dates and decision owners agreed before work starts.
Zone-and-conduit risk assessment and programme design
The part 3-2 assessment run with your engineers, target levels set and justified, and the policies, procedures and technical requirements written on Sterling's own template sets.
Effivity ISO & GRC software
Your programme, inventory, risk register and evidence run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before the certification or inspection body arrives.
Evaluation readiness and support
Preparation for the body's document review, site or product evaluation and findings, and support until the certificate or conformance report is issued.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your IEC 62443 implementation
Every IEC 62443 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Choose the level of support that matches your capacity; the method, the software and the accountability stay the same.
- 01Design™Guided implementation: your engineers and IT team implement with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed consulting and documentation work with your process owners and service providers.
- 03Sustain™Post-evaluation operation: surveillance readiness, internal audits, inventory and risk reviews, refreshers and new-hire training, year after year.
- 04Automate™The programme running in Effivity: policies, inventory, zones and risks, audits, actions, incidents, KPIs and management review in one workspace.
- 05Revise™New editions of the parts, new sites or product lines, new customer or regulatory requirements, and changes in scope or levels.
At the start we agree the named lead, the weekly working session, the deliverables and the decision owners. During delivery, progress is reviewed against those commitments so that gaps are visible early, not when the evaluator arrives.
How Sterling OS™ worksOften combined with
Standards organisations pair with IEC 62443
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- API Spec Q1API Spec Q1 certification consulting for oil and gas suppliers: contract review, design, purchasing and release controlled, prepared for the APIQR audit.
- AWS StandardAWS water stewardship certification to the Alliance for Water Stewardship Standard: what it is, who asks for it and how Sterling prepares your site for audit.
- CHAS, SafeContractor and AchillesCHAS, SafeContractor and Achilles accreditation for UK contractors: what each scheme is, who asks for it and how Sterling prepares your evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
Effivity · IEC 62443 security programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of IEC 62443-2-1:2024.
Every Sterling IEC 62443 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the programme documents, the inventory by zone, the risk register with target levels, service-provider evaluations, change and patch records, incidents, training and management review live in one place and the evaluator reviews a live programme, not a binder. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Policy, roles and the programme elements
The OT security policy, the responsibilities across engineering, IT and service providers, and each programme element with its owner, procedures and review date, with progress reported from the system rather than a spreadsheet.
Asset inventory by zone and conduit
Every controller, workstation, network device and application recorded against its zone, with vendor, version, support status and the compensating measures that apply.
Zones, conduits and target security levels
A risk register per zone and conduit with the target level, treatments, owners and review dates; open risks and residual decisions brought to management review automatically.
Requirements and gaps under the seven foundational requirements
Each technical requirement mapped to its foundational requirement and level, its status in each zone and the action that closes the gap.
Integrators, vendors and remote access
Service-provider evaluations against the part 2-4 capabilities you require, contract requirements, remote-access approvals and the per-project evidence each provider submits.
Development process and artefacts
For suppliers, the versioned development process, its security activities and the artefacts of each release: threat models, test records and defect handling, filed where the body will look.
Incidents, changes, patches and audits
Incidents raised, investigated and closed with root cause; change and patch decisions recorded per zone; audit programmes, findings and follow-up with evidence attached.
Your own processes, forms and reports
Forms, fields, workflows and reports adapted to how your plants work, without code; customer, regulatory and contractual requirements tracked to the zones they affect.
What this means at the evaluation
The evaluator asks for the inventory, the zone-and-conduit drawing with its target levels, the risk register, the remote-access records, the last internal audit and management review, and the open findings. In Effivity each is a screen, with dates, owners and evidence attached, not a folder assembled the week before the body arrives. After the evaluation, Sustain™ runs in the same workspace, so surveillance finds a programme that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your inventory, drawings, registers and records migrated, not retyped
- Admin and user training for engineering and IT
- Modules for ISMS, QMS, EMS, OHSMS and more when you integrate other standards
IEC 62443 client experience
Client letters on file, available on request.
Signed client letters for IEC 62443 are available on request. The client feedback wall lists every letter by standard.
Programmes with IEC 62443 in scope
How an integrated OT security programme runs.
- 01How integrated programmes run
Energy and manufacturing: IEC 62443 as the OT layer of an ISO/IEC 27001 programme
IEC 62443 is commonly implemented as the operational-technology layer of an integrated programme that also holds ISO/IEC 27001 certification. In such a programme the ISMS supplies governance, the risk method and document control; the plants are partitioned into zones and conduits with target levels; part 2-4 requirements go into integrator and maintenance contracts; one inventory and one evidence base serve both the ISMS auditor and the IEC 62443 evaluator; and one management review covers office and plant.
Sterling Academy · IEC 62443 e-learning
Train every operator and engineer on IEC 62443, not just the security team.
Sterling Academy delivers e-learning for the whole workforce and for the people who run the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- IEC 62443 awareness for operators, engineers, administrators and contractors, with the evidence of competence the programme asks for
- Practitioner courses for zone owners, the OT security lead and those who manage service providers
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by site and department, and a training status report for the evaluator
- New hires and contractors trained as they arrive, so evidence is current at every surveillance
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about IEC 62443
Watch a video on how to implement IEC 62443 here.
Watch a video on IEC 62443 requirements here.
Why Sterling
Want successful IEC 62443 certification? Come to Sterling.
Whether you are securing one plant or aligning sites across countries, Sterling helps you establish one OT security programme with clear local ownership. We work through differences in equipment vintage, vendor support, regulation and site practice, so the programme protects every plant without pretending they are identical.
Security programmes in 60+ countries since 2003
Management systems for manufacturers, utilities, contractors and technology firms across every region we serve, with one engagement team accountable across every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with certification-body fees identified separately. No surprises, ever.
A programme your engineers can run
Less documentation and maximum effectiveness: procedures, training and software connected to shifts, maintenance windows and vendor visits, so the plant adopts the programme rather than tolerating it.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, and who build your OT security programme properly the first time, so the evaluation confirms what already works.
The Sterling Promise
What our IEC 62443 certification success guarantee means
We stay with you until your agreed IEC 62443 outcome is achieved, whether that is a product, system or process certificate, an ACSSA inspection or certification, or a conformance assessment of your programme, supporting implementation, preparation and the resolution of findings. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a report on a shelf.
The engagement identifies the parts, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed measures into use. The independent certification or inspection body evaluates conformity and retains its decision. Our commitment concerns the agreed evaluation support, not a promise of every future tender award or incident-free operation.
After certification
What happens after IEC 62443 certification?
Your programme should keep working as equipment, vendors, remote connections and people change. The inventory is maintained, risks are reviewed when a zone changes, patch and compensating-measure decisions are recorded, incidents are exercised and competence is kept current. The body returns on the cycle its scheme sets: ACSSA certification runs on a three-year cycle with periodic surveillance; product and process certificates carry the maintenance rules of their scheme.
As the plant grows, the programme should evolve with it. Under Sterling OS™ Sustain™ we review new assets, vendor changes, incident lessons and audit results with you alongside the planned internal audits, management reviews and surveillance preparation, so the programme stays alive between evaluations rather than being revived before one.
FAQs
Frequently asked questions about IEC 62443
Can a plant, a company or a site be "IEC 62443 certified"?
Products, systems and development processes are certified under ISASecure and IECEE. For an asset owner, the usual output is an evidenced security programme confirmed by an independent conformance assessment; since 17 February 2026 the ISASecure ACSSA scheme has also offered an inspection of a deployed control system (a report and a letter) and a certification (a three-year certificate).
What are the IEC 62443 security levels?
Security levels 1 to 4 describe the attacker a zone, system or component is protected against: SL 1 casual or coincidental violation; SL 2 intentional violation using simple means, low resources, generic skills and low motivation; SL 3 sophisticated means, moderate resources, IACS-specific skills and moderate motivation; SL 4 sophisticated means, extended resources, IACS-specific skills and high motivation. The risk assessment sets a target level per zone and conduit; systems and components declare the capability level they provide.
Which part of IEC 62443 applies to us?
Asset owners implement part 2-1 and use parts 3-2 and 3-3 to assess and specify their systems. Integrators and maintenance providers demonstrate part 2-4. Product suppliers develop under part 4-1 and build components to 4-2 and systems to 3-3. Many organisations hold two roles; the scope is agreed at the start.
Does Sterling issue IEC 62443 certificates or conformance reports?
No. Sterling provides consulting and hands-on support. Certification and inspection bodies listed by ISASecure or operating in the IECEE programme evaluate and decide, and the ISASecure scheme bars its bodies from giving consulting or remediation advice. A provider that offers to prepare you and certify you is offering paper.
Who issues IEC 62443 certificates?
ISASecure certifications are issued by certification bodies accredited to ISO/IEC 17065 and listed on isasecure.org, which in September 2026 include exida, TÜV Rheinland, TÜV SÜD PSB and UL Solutions among others; ACSSA inspections are performed by inspection bodies accredited to ISO/IEC 17020. IECEE certificates are issued by the national certification bodies of its CB Scheme. Verify the body on the scheme's site, not on a logo in a quotation.
We are certified to ISO/IEC 27001. Do we still need IEC 62443?
Usually yes, if you operate control systems. The ISMS gives you governance, risk method and document control, and the 2024 edition of part 2-1 was written to sit beside it rather than duplicate it; what the ISMS does not give you are zones and conduits, target levels, compensating measures for legacy devices and the part 2-4 requirements for service providers. The practical route is one programme with the plant in scope.
Is IEC 62443 mandatory?
No law requires the series in general, but regulators and customers increasingly point to it: the EU's NIS2 Directive places cybersecurity risk-management duties on entities in energy, transport, water, health and other sectors, the EU Cyber Resilience Act sets requirements for products with digital elements, the NERC CIP standards apply to the North American bulk power system, and asset owners write parts 2-4, 4-1 and 4-2 into procurement. Whether it is mandatory for you depends on your sector and market.
Can Sterling support IEC 62443 across countries or sites?
Yes. A coordinated programme across your plants runs with one engagement team, one Effivity workspace and one set of policies with justified local differences. Site coverage, local regulation and the body's scope are agreed with your team and the body.
What do you need to prepare an IEC 62443 proposal?
Your role, the sites or product lines to be covered, approximate headcount and number of control systems, whether an ISMS or an inventory exists today, any customer, regulatory or tender requirement, and your deadline. That is enough for a scoped, all-inclusive proposal.
Before the first call
Prepare a useful IEC 62443 readiness brief
You do not need a zone drawing or a policy set before the first discussion. Bring a short account of what you operate or build and where the programme should help. Seven questions are enough:
- Which role are you in: asset owner, integrator or maintenance provider, product supplier, or more than one? And who is asking: a customer, a regulator, an insurer or your board?
- Which plants, systems or product lines are in scope, and which control systems do third parties integrate or maintain?
- How complete is your inventory of controllers, workstations, network devices and remote connections today?
- Do you hold an ISO/IEC 27001 certificate, and does its scope include the control networks?
- What do recent incidents, audit findings or customer questionnaires tell you about the starting point?
- Who can decide and contribute time from engineering, IT and management, and when can the plant accept changes?
- Is there a tender, a regulatory date, a product launch or a customer deadline to plan around?
Use these answers to scope the work and prepare a realistic proposal. They are preparation for a discussion, not a scored assessment or a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not IEC 62443 certification.
A certificate or a conformance report is useful when it names the scheme, the part, the edition, the scope and the level, and when the programme behind it can stand up to review. The market is full of paper: "IEC 62443 certified" plaques for whole companies that no scheme issues, risk assessments done from a questionnaire without anyone entering the plant, and product certificates from bodies no scheme lists. They cost less, until a customer's OT security team or a regulator asks what was evaluated, and by whom.
How to choose a credible IEC 62443 provider
- Ask which scheme the certificate or report will be issued under and check the body on isasecure.org or within the IECEE programme, not on a logo in a quotation.
- Ask which part and edition will be cited, and for which role. A "certificate" that does not say whether it covers a product, a development process or a deployed system, and at which level, covers nothing.
- Ask how the risk assessment will be done. Zones, conduits and target levels come from time on the plant with your engineers; a spreadsheet filled in remotely describes what someone hoped was there.
- Identify who carries each task, which evaluation and laboratory costs are separate, and what support exists when findings need correction.
- Ask what your people will learn and what software the programme will run in. No training and no system means nothing survives the consultant leaving.
- Walk away from "IEC 62443 certified in ten days", "we manage everything" and one invoice for consulting and certificate. The schemes keep consulting and evaluation apart; a programme has to operate before it can be evaluated.
Keep exploring
More on IEC 62443 and related standards
More in Construction, energy, oil & gas
Talk to a consultant
Plan your IEC 62443 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice