IEC 62443 (ISA-99), industrial control cybersecurity

Hugues Orgitello updated 7 Oct 2026 16 min read

IEC 62443 is the international series on cybersecurity of industrial automation and control systems (IACS). It is written jointly by the ISA99 committee of the International Society of Automation and IEC technical committee 65, working group 10, and it addresses three audiences: asset owners, service providers and integrators, and product suppliers. This guide lists the parts and editions in force on 7 October 2026, the changes since 2023, the security level and foundational requirement model, the requirement lists of 62443-3-2 and 62443-4-1, the ISASecure and IECEE certification schemes, and what the CRA, NIS 2 and the Machinery Regulation actually say about the series.

From ISA99 to IEC 62443

The International Society of Automation established the ISA99 standards committee in 2002 (ISA). ISA99 and IEC TC 65 WG 10 develop the documents together, ISA submits them to the IEC, and the series is published twice: as ANSI/ISA-62443 in the United States and as IEC 62443 internationally. The years do not always match. ANSI/ISA-62443-4-2 is dated 2018, IEC 62443-4-2 is dated 2019; the ISA 2-4 is still the IEC 2015 edition with its 2017 amendment, while the IEC replaced it in December 2023.

ISA states that the IEC recognised the series as a horizontal standard in 2021, and the cover of IEC 62443-2-1:2024 carries the "horizontal publication" label. The general title also changed: early parts were published as "Industrial communication networks, network and system security" (3-3:2013, 1-1:2009), newer ones as "Security for industrial automation and control systems". The 2-1:2024 foreword says older titles will be updated at their next edition.

Parts and editions in force (7 October 2026)

Part	Type, edition, date	Title (abridged)	Main user
1-1	IEC TS, ed. 1.0, July 2009	Terminology, concepts and models	All
1-5	IEC TS, ed. 1.0, September 2023	Scheme for IEC 62443 security profiles	Profile authors, standards bodies
2-1	IS, ed. 2.0, August 2024	Security program requirements for IACS asset owners	Asset owner
2-2	IEC PAS, ed. 1.0, March 2025	IACS security protection scheme	Asset owner, assessor
2-4	IS, ed. 2.0, December 2023	Security program requirements for IACS service providers	Integrator, maintenance provider
3-2	IS, ed. 1.0, June 2020	Security risk assessment for system design	Asset owner, integrator
3-3	IS, ed. 1.0, August 2013 (corrigendum April 2014)	System security requirements and security levels	System supplier, integrator
4-1	IS, ed. 1.0, January 2018	Secure product development lifecycle requirements	Product supplier
4-2	IS, ed. 1.0, February 2019 (corrigendum 2022)	Technical security requirements for IACS components	Product supplier
6-1	IEC TS, ed. 1.0, March 2024	Security evaluation methodology for IEC 62443-2-4	Assessor
6-2	IEC TS, ed. 1.0, January 2025	Security evaluation methodology for IEC 62443-4-2	Assessor

IS = International Standard, TS = Technical Specification, PAS = Publicly Available Specification. The IEC online catalogue gives 3-2, 3-3 and 2-4 a stability date of 2027. A revision in progress is not a publication: on 7 October 2026 there is no second edition of 3-2, 3-3, 4-1 or 4-2.

What changed between 2023 and 2026

Date	Change	Source
September 2023	IEC TS 62443-1-5 publishes the method for defining security profiles (subsets of 62443 requirements for a domain or product type)	IEC, CEN-CENELEC
15 December 2023	IEC 62443-2-4 edition 2 cancels the 2015 edition and Amendment 1:2017; requirements that read as technical capabilities are reworded as use or configuration of capabilities	IEC 62443-2-4:2023 foreword
March 2024	IEC TS 62443-6-1, evaluation methodology for 2-4	IEC
August 2024	IEC 62443-2-1 edition 2 cancels the 2010 edition: requirements regrouped into eight security program elements, duplication of an ISMS removed, maturity model added	IEC 62443-2-1:2024 foreword
21 January 2025	IEC TS 62443-6-2, evaluation methodology for 4-2; an IEC 62443-4-1 lifecycle is a prerequisite	IEC
March 2025	IEC PAS 62443-2-2, IACS security protection scheme	IEC, ISA
17 February 2026	ISASecure ACSSA 1.0.0 takes effect (site-level evaluation of a deployed IACS)	ISASecure
11 September 2026	CRA reporting obligations apply	Regulation (EU) 2024/2847
20 January 2027	Machinery Regulation (EU) 2023/1230 applies, with Annex III points 1.1.9 and 1.2.1	Regulation (EU) 2023/1230
11 December 2027	CRA applies in full	Regulation (EU) 2024/2847

Security levels and foundational requirements

62443-3-3 and 62443-4-2 express technical requirements against seven foundational requirements (FR), each with a level from 1 to 4. The levels describe the attacker the system or component must resist.

Level	Protection against
SL 1	Casual or coincidental violation
SL 2	Intentional violation using simple means with low resources, generic skills and low motivation
SL 3	Intentional violation using sophisticated means with moderate resources, IACS-specific skills and moderate motivation
SL 4	Intentional violation using sophisticated means with extended resources, IACS-specific skills and high motivation

Three kinds of level coexist. SL-T (target) comes out of the 62443-3-2 risk assessment for a zone or conduit. SL-C (capability) is what a component or system can deliver when properly configured, as defined in 3-3 and 4-2. SL-A (achieved) is what the deployed design reaches. 62443-3-3 states that not every component must support every requirement at the target level: compensating countermeasures may provide the function at system level, provided they are documented so that the SL-A reflects them. Because a level is given per FR, a level is in practice a vector of seven values (3-3, Annex A).

FR	Name (IEC 62443-3-3)
FR 1	Identification and authentication control
FR 2	Use control
FR 3	System integrity
FR 4	Data confidentiality
FR 5	Restricted data flow
FR 6	Timely response to events
FR 7	Resource availability

In 3-3, each system requirement (SR) carries requirement enhancements (RE) that are added as the level rises; 4-2 does the same with component requirements (CR). 3-3 assumes the asset owner runs a security program to 62443-2-1 and that patch management follows IEC TR 62443-2-3.

62443-3-2, requirement by requirement

62443-3-2 is organised as seven zone and conduit requirements (ZCR). It is the design-stage deliverable from which SL-T values are derived.

ZCR	Requirement	Sub-requirements
ZCR 1	Identify the system under consideration (SuC)	1.1 perimeter and access points
ZCR 2	Initial cyber security risk assessment	2.1
ZCR 3	Partition the SuC into zones and conduits	3.1 establish zones and conduits; 3.2 separate business and IACS assets; 3.3 separate safety related assets; 3.4 separate temporarily connected devices; 3.5 separate wireless devices; 3.6 separate devices connected via external networks
ZCR 4	Risk comparison	4.1 compare initial risk to tolerable risk
ZCR 5	Detailed cyber security risk assessment	5.1 threats to 5.13 documentation, with 5.6 determine SL-T and 5.10 determine residual risk
ZCR 6	Document cyber security requirements, assumptions and constraints	6.1 requirements specification; 6.2 SuC description, and further items
ZCR 7	Asset owner approval	7.1 attain asset owner approval

The standard does not prescribe the Purdue level model. What it does require are the five separations of ZCR 3.2 to 3.6, and an asset owner sign-off at the end.

62443-4-1, the eight practices and their 47 requirements

Practice	Requirements	Content (requirement titles)
1, Security management (SM)	SM-1 to SM-13	Development process, responsibilities, applicability, expertise, process scoping, file integrity, development environment security, private keys, externally provided components, third-party custom components, assessing security issues, process verification, continuous improvement
2, Specification of security requirements (SR)	SR-1 to SR-5	Product security context, threat model, product security requirements and their content, requirements review
3, Secure by design (SD)	SD-1 to SD-4	Secure design principles, defense in depth design, design review, design best practices
4, Secure implementation (SI)	SI-1, SI-2	Implementation review, secure coding standards
5, Security verification and validation testing (SVV)	SVV-1 to SVV-5	Requirements testing, threat mitigation testing, vulnerability testing, penetration testing, independence of testers
6, Management of security-related issues (DM)	DM-1 to DM-6	Receiving, reviewing, assessing, addressing and disclosing issues, periodic review of the practice
7, Security update management (SUM)	SUM-1 to SUM-5	Update qualification, update documentation, dependent component or OS update documentation, delivery, timely delivery of patches
8, Security guidelines (SG)	SG-1 to SG-7	Product defense in depth, measures expected in the environment, hardening, secure disposal, secure operation, account management, documentation review

Clause 4.2 of 4-1 defines a maturity model (Table 1) used to rate how the process is applied. Practice 6 is "management of security-related issues", not "defect management", even though its requirements carry the DM prefix.

62443-4-2, four component types

4-2 differentiates requirements for four component types: software applications, embedded devices, host devices and network devices. ISASecure quotes the 4-2 definitions of the three device types:

Type	Definition (IEC 62443-4-2)
Embedded device	Special purpose device running embedded software designed to directly monitor, control or actuate an industrial process
Host device	General purpose device running an operating system capable of hosting one or more software applications, data stores or functions from one or more suppliers
Network device	Device that facilitates data flow between devices, or restricts the flow of data, but may not directly interact with a control process

A product claiming SL-C 2 on FR 1 must meet the FR 1 component requirements and the requirement enhancements assigned to level 2 for its component type.

62443-2-1:2024, the eight security program elements

SPE	Topic
SPE 1	Organizational security measures (including ORG 1.1, information security management system)
SPE 2	Configuration management
SPE 3	Network and communications security
SPE 4	Component security
SPE 5	Protection of data
SPE 6	User access control
SPE 7	Event and incident management
SPE 8	System integrity and availability

Certification schemes

ISASecure (ISA Security Compliance Institute)

Scheme	Standard(s)	Current version	Annual registration fee
SDLA, Security Development Lifecycle Assurance	62443-4-1 (development process)	3.0.0, effective 16 June 2020	USD 1,500
CSA, Component Security Assurance	62443-4-2 and 62443-4-1; SL-C 1 to 4	1.0.0, effective 28 August 2019	USD 1,200
ICSA, IIoT Component Security Assurance	62443-4-2 and 4-1; Core tier (SL 2 based), Advanced tier (SL 4 based)	1.0.0	USD 1,200
SSA, System Security Assurance	62443-3-3 and the process requirements of 62443-4-1	4.0.0, effective 28 August 2019	USD 1,200
ACSSA, Automation and Control System Security Assurance	62443-2-1, 2-4, 3-2 and 3-3 (deployed IACS)	1.0.0, effective 17 February 2026	CB registration USD 3,000 (3-year certificate)

Fees are the ISCI registration fees listed on isasecure.org; they do not include the certification body assessment. Every product certification (CSA, ICSA, SSA) requires an SDLA certification of the supplier process, which can be obtained in parallel. CSA 1.0.0 replaced the earlier EDSA program for embedded devices. ISASecure certification bodies are accredited to ISO/IEC 17065; ACSSA also offers an inspection route through ISO/IEC 17020 inspection bodies, which ends in a letter instead of a certificate.

IECEE CB Scheme, CYBR category

The IECEE runs cyber security as one of the categories of its standards list (CYBR, see CB Scheme). IECEE test report forms are published on the IEC online catalogue, for example TRF 62443-4-2B:2023 for IEC 62443-4-2:2019, with others for 2-4, 3-3 and 4-1. The two IEC evaluation methodologies, TS 62443-6-1 (for 2-4) and TS 62443-6-2 (for 4-2), describe how evaluators reach repeatable results; 6-2 states that it does not define a certification scheme.

Other certificates

Test labs and certification bodies also issue their own 62443 certificates outside ISASecure and IECEE, sometimes alongside CE work under the RED delegated act (EN 18031, applicable since 1 August 2025) or CRA preparation. Before relying on one, check which part and which edition it covers, whether the body is accredited for that scope, and whether the certificate concerns a process (4-1), a product capability (4-2, 3-3) or a deployed system (2-1, 3-2).

Regulatory links

EU, Cyber Resilience Act

The Cyber Resilience Act (Regulation (EU) 2024/2847) applies reporting obligations from 11 September 2026 and in full from 11 December 2027. It covers products with digital elements placed on the EU market. Presumption of conformity comes from harmonised standards cited in the OJ, common specifications or EU cybersecurity certification schemes. The Commission request M/606 (C(2025) 618) covers 41 standards (Commission). In the CEN-CENELEC webinar of 9 September 2025, CENELEC TC 65X WG 3 (the European mirror of IEC TC 65 WG 10) set out this plan:

Deliverable	Basis	Purpose	Planned publication (September 2025 plan)
EN IEC 62443-4-1:2018/A11	4-1	CRA Annex I Part I(1) and Part II (process, vulnerability handling)	December 2026
EN IEC 62443-4-2:2019/A11	4-2 with the 6-2 evaluation approach	CRA Annex I Part I(2) (product requirements)	December 2026
Six product standards (prEN 50XXX-1 to -6), built as 1-5 profiles	4-1, 4-2	VPN products, network management systems, SIEM systems, network interfaces, routers, modems and switches (class I); firewalls and intrusion detection or prevention systems including industrial ones (class II)	November 2026

These are plans, not publications. On 7 October 2026 no 62443-based standard is cited under the CRA. For the CRA itself, see Cyber Resilience Act.

EU, Machinery Regulation 2023/1230

Regulation (EU) 2023/1230 applies from 20 January 2027 and repeals Directive 2006/42/EC from that date. Two essential requirements of Annex III deal with cyber threats:

Point	What the text requires
1.1.9, Protection against corruption	Connecting another device, directly or remotely, must not lead to a hazardous situation; hardware relevant to accessing safety-critical software is protected against accidental or intentional corruption; critical software and data are identified and protected; the machine identifies its safety software at all times; evidence of legitimate or illegitimate intervention or modification is collected
1.2.1, Safety and reliability of control systems	Control systems withstand intended and unintended external influences, "including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation"; a tracing log of interventions and safety software versions uploaded after placing on the market is enabled for five years

Article 20(9) presumes conformity with these two points for machinery certified, or covered by a statement of conformity, under a cybersecurity certification scheme adopted under Regulation (EU) 2019/881 and referenced in the OJ. An IEC 62443 certificate is not such a scheme. No harmonised standard is cited yet under Regulation 2023/1230. CENELEC TC 65X WG 3 lists a liaison with CLC/TC 44X WG 2, "protection against corruption". See Machinery Directive and Regulation.

EU, NIS 2

Directive (EU) 2022/2555 entered into force on 16 January 2023; Member States had to transpose it by 17 October 2024 and apply it from 18 October 2024 (Article 41). Energy and drinking water are in Annex I, chemicals and manufacturing in Annex II. Article 21(1) requires measures that take into account "the state-of-the-art and, where applicable, relevant European and international standards"; Article 25 asks Member States to encourage such standards without favouring a particular technology. The Directive does not name IEC 62443; its recitals cite the ISO/IEC 27000 series for physical and environmental security and ISO/IEC 30111 and 29147 for vulnerability handling.

US, NIST SP 800-82 Rev. 3 and NERC CIP

NIST SP 800-82 Rev. 3 (September 2023) maps each step of the NIST Risk Management Framework, as applied to OT, to the Cybersecurity Framework and to IEC 62443 requirements, for example IEC 62443-2-1 ORG 1.3 for risk management roles. The NERC CIP standards are mandatory reliability standards for the North American bulk electric system; a 62443 certificate does not replace CIP compliance evidence.

IT (ISO/IEC 27001) and OT (IEC 62443)

Point	ISO/IEC 27001	IEC 62443
Object	An organisation and its information security management system	An IACS, its asset owner, its service providers and its components
Product requirements	None	3-3 (system) and 4-2 (component), with security levels
Development process	Not specified for products	4-1 secure development lifecycle
Link between them		2-1:2024 includes an ISMS requirement (ORG 1.1) and was revised to remove duplication of an ISMS
Stated design driver		3-3 introduction: adapt business IT requirements and combine them with the "strong availability" IACS need

An ISO/IEC 27001 certificate does not show conformity with any 62443 part, and a 62443-4-2 product certificate says nothing about the corporate IT perimeter.

Steps for a product supplier

1. Classify the product as software application, embedded device, host device or network device (4-2), and write the product security context and threat model (4-1 SR-1, SR-2).
2. Set the target SL-C per FR from the integrator or asset owner SL-T, or from the intended use.
3. Put the 4-1 lifecycle in place: the eight practices and their 47 requirements, with records that show the process is applied.
4. Implement and test: secure design principles and defense in depth (SD-1, SD-2), for example secure boot and a hardware root of trust where the threat model calls for one, secure coding standards (SI-2), threat mitigation, vulnerability and penetration testing (SVV-2 to SVV-4), with tester independence (SVV-5).
5. Organise issue handling and updates: receiving and disclosing issues (DM-1 to DM-5), update qualification and timely delivery (SUM-1 to SUM-5).
6. Write the security guidelines (SG-1 to SG-7): defense in depth, hardening, secure operation, accounts, disposal.
7. Choose the evaluation route: ISASecure SDLA then CSA or ICSA, an IECEE CB test report, or another accredited body.
8. Map to EU law: CRA (vulnerability reporting from 11 September 2026), Machinery Regulation points 1.1.9 and 1.2.1 when the product is a safety-relevant part of a machine.

For planning, see certification timeline.

Claims the texts contradict

Common claim	What the texts say
"IEC 62443-2-4 is the 2015 edition with Amendment 1:2017."	Edition 2.0 of 15 December 2023 cancels and replaces both (IEC 62443-2-4:2023 foreword). Only the ANSI/ISA version still carries the 2015+2017 content.
"62443-1-1 revision expected in 2025."	On 7 October 2026 the IEC online catalogue still lists IEC TS 62443-1-1:2009. No date for a replacement is given.
"Practice 6 of 4-1 is Defect Management."	Its title is "Management of security-related issues"; DM is only the requirement prefix.
"ISASecure SSA covers 62443-3-3 with the 3-2 risk assessment."	SSA covers all 3-3 control system requirements and the process requirements of 4-1. The 3-2 risk assessment belongs to ACSSA, which evaluates a deployed IACS against 2-1, 2-4, 3-2 and 3-3.
"ACSSA ties into 62443-2-1 only."	ACSSA 1.0.0 (effective 17 February 2026) evaluates against 2-1, 2-4, 3-2 and 3-3.
"SL 4 means a state-sponsored attacker."	The standards describe SL 4 by means, resources, skills and motivation (sophisticated, extended, IACS-specific, high); they do not name state actors.
"NIS 2 has been in force since October 2024."	It entered into force on 16 January 2023; 18 October 2024 is the date from which Member States apply their transposition measures (Article 41).
"NIS 2 and the CRA treat 62443 as the first-line reference."	Neither text names IEC 62443. NIS 2 refers to European and international standards in general; the CRA gives presumption only to standards cited under it, and none based on 62443 is cited yet.
"A 62443 certificate covers the Machinery Regulation cyber points."	Article 20(9) gives presumption only to schemes adopted under Regulation (EU) 2019/881. A 62443 assessment can still serve as technical evidence for 1.1.9 and 1.2.1.
"ISO 27001 ranks confidentiality first, 62443 ranks safety, availability, integrity, confidentiality."	Neither standard sets such a ranking. 3-3 speaks of the strong availability IACS need; 2-1:2024 integrates an ISMS rather than opposing it.
"62443 requires the Purdue model."	3-2 requires zones, conduits and five specific separations (ZCR 3.2 to 3.6); it does not prescribe a level model.

Going further

• Cyber Resilience Act: EU regulation for products with digital elements, reporting from 11 September 2026, full application 11 December 2027
• EN 303 645, consumer IoT cybersecurity: the consumer IoT baseline, a different scope from 62443
• Industrial robotics, ISO 10218 and ISO/TS 15066: safety side of industrial automation
• Machinery functional safety, IEC 62061 and ISO 13849: the safety functions that 1.2.1 also covers
• Common Criteria, ISO/IEC 15408: generic security evaluation framework
• Certification timeline: cross-cutting orders of magnitude per phase
• Glossary: definitions of the terms used on this page

See also

• Product cybersecurity: obligation, evaluation, label
• DO-326A and ED-202A: avionics cybersecurity airworthiness
• ETSI EN 303 645: cybersecurity for consumer IoT
• NISTIR 8425 and the US Cyber Trust Mark: consumer-IoT label
• NIST SP 800-213 and 8259A: US baseline for IoT cybersecurity
• Common Criteria (ISO/IEC 15408): IT security eval
• CB Scheme (IECEE): one test report for many countries
• Machinery Directive 2006/42/EC and Regulation 2023/1230

Working on IEC 62443 readiness, SDL implementation per 62443-4-1 and component evaluation per 62443-4-2 for industrial automation products for a real product? AESTECHNO can audit your design and certification plan. Get in touch

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Sources & references

1. IEC 62443-2-1:2024 (edition 2.0, August 2024), preview, IEC webstore.iec.ch/en/iec_catalog/product/preview/?id=L3B1Yi9wZGYvcHJldmlldy9pbmZvX2llYzYyNDQzLTItMXtlZDIuMH1iLnBkZg%3D%3D
2. IEC 62443-2-4:2023 (edition 2.0, December 2023), IEC webstore.iec.ch/en/publication/67631
3. IEC 62443-3-2:2020, security risk assessment for system design, IEC webstore.iec.ch/en/publication/30727
4. IEC 62443-3-3:2013, system security requirements and security levels, IEC webstore.iec.ch/en/publication/7033
5. IEC 62443-4-1:2018, secure product development lifecycle requirements, IEC webstore.iec.ch/en/publication/33615
6. IEC 62443-4-2:2019, technical security requirements for IACS components, IEC webstore.iec.ch/en/publication/34421
7. IEC TS 62443-1-1:2009, terminology, concepts and models, IEC webstore.iec.ch/en/publication/7029
8. IEC TS 62443-6-1:2024, evaluation methodology for IEC 62443-2-4, IEC webstore.iec.ch/en/publication/67462
9. IEC TS 62443-6-2:2025, evaluation methodology for IEC 62443-4-2, IEC webstore.iec.ch/en/publication/67463
10. IECEE Test Report Form 62443-4-2B:2023, IEC (IECEE) webstore.iec.ch/en/publication/90117
11. ISA/IEC 62443 series of standards (ISA99 committee), International Society of Automation www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
12. ISASecure certification schemes, ISA Security Compliance Institute isasecure.org/certification
13. ISASecure Component Security Assurance (CSA), ISA Security Compliance Institute isasecure.org/certification/iec-62443-csa-certification
14. ISASecure Automation and Control System Security Assurance (ACSSA) 1.0.0, ISA Security Compliance Institute isasecure.org/acssa-certification
15. CRA Standards Unlocked: from EN IEC 62443 to CRA (webinar, 9 September 2025), CEN-CENELEC www.cencenelec.eu/media/CEN-CENELEC/Events/Webinars/2025/2025-09-08_webinar_unlocking_cra_iec62443-series-for-cra.pdf
16. Cyber Resilience Act, standardisation (request M/606), European Commission digital-strategy.ec.europa.eu/en/policies/cra-standardisation
17. Cyber Resilience Act (Regulation (EU) 2024/2847), EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
18. NIS 2 Directive (Directive (EU) 2022/2555), EUR-Lex eur-lex.europa.eu/eli/dir/2022/2555/oj
19. Machinery Regulation (Regulation (EU) 2023/1230), EUR-Lex eur-lex.europa.eu/eli/reg/2023/1230/oj
20. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, NIST csrc.nist.gov/pubs/sp/800/82/r3/final
21. NERC CIP standards (Critical Infrastructure Protection), North American Electric Reliability Corporation www.nerc.com/standards/reliability-standards/cip