IEC 62443 Explained: Parts, Security Levels, and Certification

ISA/IEC 62443 is the international series of standards for securing industrial automation and control systems (IACS), developed by ISA's ISA99 committee with IEC Technical Committee 65. It divides the work by role. Asset owners run a security program under IEC 62443-2-1 and set risk-based targets with 62443-3-2, service providers that integrate and maintain systems follow 62443-2-4, and product suppliers develop under the secure lifecycle in 62443-4-1 and build components to 62443-4-2, while integrated systems meet 62443-3-3. Every requirement traces to seven foundational requirements measured at security levels 1 to 4, and plants are partitioned into zones and conduits. Accredited bodies certify against the series under ISASecure and the IECEE scheme. For the EU Cyber Resilience Act, 62443 is strong evidence, though a 62443 certificate does not by itself create a presumption of conformity.

What is ISA/IEC 62443?

ISA formed its ISA99 committee in 2002 to write security standards for industrial control systems, and the committee develops the series with IEC Technical Committee 65, Working Group 10, so the same documents appear as ANSI/ISA-62443 and IEC 62443 standards. ISA's series page states that the ISA and IEC editions of each document are identical and released as concurrently as possible, but the two catalogs do not always carry the same edition. ISA's current 62443-2-4, for example, is its 2018 adoption of IEC's first edition, while IEC published a second edition in December 2023.

IEC describes four groups of documents. The general group (1-x) sets terminology, concepts, and models. The policies and procedures group (2-x) covers the security programs of asset owners and service providers and patch management. The system group (3-x) covers security technologies, risk assessment for system design, and system security requirements. The component group (4-x) covers secure product development and the technical requirements for components. Two newer technical specifications extend the series: IEC TS 62443-1-5:2023 sets a scheme for industry security profiles, and IEC TS 62443-6-1:2024 sets an evaluation methodology for 62443-2-4 designed to give repeatable results in first-, second-, and third-party assessments.

Which IEC 62443 parts apply to asset owners, service providers, and product suppliers?

ISA calls shared responsibility a founding principle of the series, and each role reads a different subset. The mapping below follows the ISA Global Cybersecurity Alliance's quick start guide to the standards. Part 2-2, the IACS security protection scheme, appears in ISA's catalog as a 2025 technical report.

What are the current IEC 62443 parts and editions?

The table lists the IEC publications in the series as the IEC webstore showed them in October 2026.

The 2024 edition of 2-1 restructured the asset owner requirements into security program elements, removed duplication with an information security management system, and added a maturity model for evaluating them. IEC shows a stability date of 2027 for 2-4, 3-2, 3-3, 4-1, and 4-2, meaning the committee expects to leave them unchanged until then. ISA publishes the same parts as ANSI/ISA-62443 standards, with 2-1 dated 2024, 3-2 dated 2020, and 4-1 and 4-2 dated 2018.

What are the foundational requirements and security levels?

Every system and component requirement traces to one of seven foundational requirements (FRs): FR 1 identification and authentication control, FR 2 use control, FR 3 system integrity, FR 4 data confidentiality, FR 5 restricted data flow, FR 6 timely response to events, and FR 7 resource availability. IEC 62443-3-3 turns them into system requirements (SRs), and 62443-4-2 turns them into component requirements (CRs). Higher security levels add requirement enhancements to the base requirements.

Security levels describe the attacker a zone or component can withstand. SL 1 protects against casual or coincidental violation. SL 2 protects against intentional violation using simple means with low resources, generic skills, and low motivation. SL 3 protects against intentional violation using sophisticated means with moderate resources, IACS-specific skills, and moderate motivation. SL 4 protects against sophisticated means with extended resources, IACS-specific skills, and high motivation. The scale is used three ways. The target level (SL-T) is what the asset owner needs for a zone, the capability level (SL-C) is what a system or component provides when properly configured without added countermeasures, and the achieved level (SL-A) is what the commissioned solution delivers in operation. Because 62443-3-3 sets a level for each foundational requirement, a zone's target is a set of seven values.

What are zones and conduits, and how does 62443-3-2 assess risk?

A zone is a grouping of logical or physical assets based on risk or other criteria, and a conduit is a logical grouping of communication channels that connects two or more zones and shares common security requirements. Zones let an asset owner protect a safety instrumented system more strictly than a historian without hardening every device to the same level, and conduits put the controls, such as firewalls and remote access gateways, where traffic crosses from one zone to another.

IEC 62443-3-2:2020 sets the method in seven zone and conduit requirements (ZCRs). The asset owner identifies the system under consideration, performs an initial cybersecurity risk assessment, partitions the system into zones and conduits, and compares the initial risk with its tolerable risk. Where the initial risk is too high, a detailed risk assessment of each zone and conduit identifies threats, vulnerabilities, and consequences, sets the SL-T, and evaluates countermeasures. The asset owner documents the resulting requirements, assumptions, and constraints and approves them. The figure lays out the seven steps and an illustrative set of targets.

The detailed assessment is where threat modeling belongs. MITRE's ATT&CK for ICS matrix, which our MITRE ATT&CK guide describes, gives the team a shared catalog of adversary techniques against industrial systems, so each zone's threats are named consistently. Conduits are also where monitoring pays off, because traffic between zones should match a short list of expected flows, and network security monitoring that alerts on new flows across a conduit tests the zone model every day.

What do IEC 62443-4-1 and 4-2 require of product suppliers?

IEC 62443-4-1:2018 specifies process requirements for developing and maintaining secure products, and IEC states that they apply only to the developer and maintainer of a product, with no duties for integrators or users. The requirements fall into eight practices: security management, specification of security requirements, secure by design, secure implementation, security verification and validation testing, management of security-related issues, security update management, and security guidelines. Together they cover the lifecycle from requirements through design, coding, testing, defect handling, patching, and end of life, and the standard grades process maturity from level 1, initial, to level 4, improving.

Three practices reach beyond the development team. Verification and validation testing includes vulnerability testing and penetration testing of the product, which is where independent penetration testing of the component and its interfaces fits. Security update management covers timely delivery of security patches. The security guidelines practice requires documentation that tells integrators and asset owners how to deploy and harden the product, including the defense-in-depth measures it expects around it.

IEC 62443-4-2:2019 sets technical requirements for four component types: software applications, embedded devices, host devices, and network devices. Each component requirement maps to a foundational requirement, and a component is rated at a capability level, so a controller can claim SL-C 2 or SL-C 3 against a defined set of requirements. Integrators then build systems that meet 62443-3-3 from components whose ratings are known.

How does IEC 62443 certification work?

Accredited third parties issue IEC 62443 certificates, mainly under two schemes. ISASecure, operated by the ISA Security Compliance Institute, runs five certification programs, listed on its certification page.

ISASecure works with certification bodies accredited to ISO/IEC 17065, and ACSSA also uses inspection bodies accredited to ISO/IEC 17020 under a specification that took effect February 17, 2026. Each product program examines four things: the supplier's development process, the security artifacts that process produced for the product, the product's security functions at the claimed level, and a scan for known vulnerabilities. Passing the process assessment also grants SDLA certification. IECEE, the IEC's conformity assessment system for electrotechnical equipment, runs an Industrial Cyber Security Programme that tests and certifies against the series, and its CB Scheme lists cyber security as a product category.

Read a certificate for its scope. ISASecure listings name the model and version certified, so a later release needs its own certification or the scheme's maintenance procedure, and a component's capability level says nothing about the achieved level of the plant it sits in. A 62443 certificate is also separate from CRA conformity assessment. BD Emerson is not a certification body: ISASecure and IECEE certification bodies issue certificates, and we prepare organizations for those assessments.

How does IEC 62443 relate to the EU Cyber Resilience Act?

The CRA sets essential cybersecurity requirements for products with digital elements sold in the EU, and most of its duties apply from December 11, 2027; our Cyber Resilience Act guide covers the regulation. Under Article 27(1) of Regulation (EU) 2024/2847, products and manufacturer processes that conform to harmonized standards whose references are published in the Official Journal are presumed to meet the Annex I requirements those standards cover. The Commission's standardization request M/606, accepted by CEN, CENELEC, and ETSI in 2025, is the route by which CRA harmonized standards are being written. An IEC 62443 certificate is evidence a manufacturer can place in its technical documentation, but it does not create a presumption of conformity: under Article 27, that comes from harmonized standards cited in the Official Journal, common specifications, or certificates under European cybersecurity certification schemes adopted under Regulation (EU) 2019/881.

For industrial products, the overlap is large. A 2024 JRC and ENISA analysis mapping CRA requirements to existing standards found that 62443-4-1 addresses secure development, security testing, security updates, and disclosure of fixed vulnerabilities, and that 62443-4-2 addresses authentication, confidentiality, integrity, availability, and updates. It recorded the same limitation for both: they apply only to industrial automation and control systems. It also found that 62443-3-2 covers risk assessment for system design without covering security by design. A supplier with SDLA and CSA certificates has evidence for many Annex I requirements and still needs the CRA's own deliverables: the cybersecurity risk assessment in the technical documentation, a software bill of materials as our SBOM requirements guide describes, a support period, and Article 14 reporting.

Neighboring rules show how the pieces fit. Radio equipment has carried cybersecurity requirements under Delegated Regulation (EU) 2022/30 since August 2025, and Implementing Decision (EU) 2025/138 cited EN 18031-1, -2, and -3:2024 in the Official Journal on January 30, 2025, with restrictions, which gives conforming equipment a presumption of conformity for the covered requirements. Delegated Regulation (EU) 2026/339 repeals the radio equipment act with effect from December 11, 2027, when the CRA takes over. For operators, Article 21 of the NIS2 Directive requires essential and important entities to take risk-management measures, including supply chain security and security in acquisition, development, and maintenance, that take into account, where applicable, relevant European and international standards, and 62443-2-1, 2-4, and 3-2 give an industrial operator a recognized way to show it. In the United States, NIST SP 800-82 Rev. 3, the Guide to Operational Technology Security of September 2023, draws on ISA/IEC 62443 and describes ISA99 and ISASecure.

How should a product supplier or asset owner start with IEC 62443?

A product supplier should start with the development process, because every ISASecure product program assesses it. The work runs in five steps.

1. Assess your development process against the eight 4-1 practices and each product line against the 4-2 requirements for its component type.
2. Build or refresh a threat model for each product, since 4-1's design practice depends on it and the CRA risk assessment can reuse it.
3. Set a capability level target for each product from the zones your customers place it in, and record it as a security requirement.
4. Write a test plan that covers security requirements, threat mitigations, known vulnerabilities, and penetration testing.
5. Close the gaps, then choose between SDLA alone and SDLA with CSA or SSA, and engage an ISASecure or IECEE certification body.

An asset owner should start with the plant. Confirm the asset inventory, draw the zones and conduits, and run the 62443-3-2 risk assessment to set a target for each zone and conduit. Then write 62443-2-4 requirements into integrator and maintenance contracts so service providers deliver to those targets, and build the 62443-2-1 program that keeps them true in operation. Systems that cannot restart on demand need the patch approach in IEC TR 62443-2-3, and our patch management guide covers the emergency path and the exceptions for equipment you cannot patch.

How BD Emerson helps with IEC 62443

We run gap assessments and implementation programs against the parts that apply to you. For product suppliers, we assess development processes against 62443-4-1 and products against 4-2 or 3-3, build threat models, set capability targets, and test products and their interfaces. For asset owners, we facilitate the 62443-3-2 risk assessment, draft zone and conduit models, and write 2-4 requirements for integrators. Where you also sell into the EU, our CRA compliance team maps the same evidence to Annex I so one program serves both. BD Emerson is not a certification body or a notified body. ISASecure and IECEE certification bodies certify, notified bodies perform third-party CRA conformity assessment where the regulation requires it, and our role is to prepare you for both.

Frequently asked questions

What is the difference between IEC 62443-3-3 and IEC 62443-4-2? IEC 62443-3-3 sets security requirements for a control system as a whole, which integrators and system suppliers use to meet each zone's target security level. IEC 62443-4-2 sets requirements for the components inside that system: software applications, embedded devices, host devices, and network devices. Both derive from the same seven foundational requirements, and both rate capability at security levels 1 to 4.

What are the security levels in IEC 62443? Security levels run from SL 1, protection against casual or coincidental violation, to SL 4, protection against intentional attack using sophisticated means with extended resources, IACS-specific skills, and high motivation. The asset owner sets a target level (SL-T) for each zone and conduit, products carry a capability level (SL-C), and the commissioned system has an achieved level (SL-A). Each is set per foundational requirement.

Who issues IEC 62443 certification? Accredited certification bodies issue it, mainly under ISASecure, run by the ISA Security Compliance Institute, and the IECEE Industrial Cyber Security Programme. ISASecure's programs are SDLA for development processes, CSA for components, SSA for systems, ICSA for industrial IoT devices, and ACSSA for asset owner sites. Consultants that prepare you, including BD Emerson, do not issue certificates.

Is IEC 62443 mandatory? IEC 62443 is a voluntary standard. It becomes binding when a customer or asset owner writes it into a contract, and regulators use it as a reference: the NIS2 Directive requires measures that take into account, where applicable, relevant European and international standards, and NIST SP 800-82 Rev. 3 draws on it. Under the EU Cyber Resilience Act, a 62443 certificate does not create a presumption of conformity; harmonized standards cited in the Official Journal do.

Does IEC 62443 certification mean CRA compliance? A certificate does not by itself show CRA compliance. An IEC 62443 certificate is evidence a manufacturer can include in its CRA technical documentation, and a 2024 JRC and ENISA analysis found that 62443-4-1 and 4-2 address many CRA requirements for industrial products. The CRA still requires its own cybersecurity risk assessment, a software bill of materials, a support period, vulnerability reporting, and the conformity assessment route for the product's class.

What is the difference between ISA 62443 and IEC 62443? They are the same documents published by two organizations. ISA's ISA99 committee and IEC Technical Committee 65 develop the series together, and ISA states that the ISA and IEC editions of each document are identical. Publication timing differs: ISA's current 62443-2-4 adopts IEC's first edition, while IEC published a second edition in December 2023, so check which edition a contract or certificate cites.

If you build industrial products or run an industrial site and want to know where you stand against 62443-4-1, 4-2, 3-3, or 3-2 before a certification body or a CRA assessment does, our Cyber Resilience Act compliance team can run the gap assessment, build the threat models, and test the products, so one set of evidence serves both.