IEC 62443 in plain English
In a modern factory, computers control the machines: they open valves, regulate temperatures, and set the pace of conveyor belts. This technology is called OT (operational technology) – as opposed to office IT, which mainly processes data. In the past, such plants ran on isolated networks. Today, they are connected to the corporate network, to remote maintenance access points, and often to the internet. That makes them vulnerable to attack.
IEC 62443 is a kind of building code for the IT security of such plants. A building code specifies where fire walls have to go and what escape routes must look like – no matter who builds the house. In a similar way, the series of standards describes which security requirements an industrial plant should meet. It also defines who is responsible for what: the operator, the integrator – that is, the service provider who designs and builds the plant – or the manufacturer of individual devices.
It is published by the International Electrotechnical Commission (IEC). The series consists of numerous individual documents that are continually being added to and revised.
What IEC 62443 covers
The parts of the series are organized into four groups:
- General (Part 1): terms, concepts, and models – the common language of everyone involved.
- Policies and procedures (Part 2): requirements for the operator’s security program – for example, for handling updates – and for service providers such as integrators and maintenance companies.
- System (Part 3): risk assessment and security requirements for a plant as a whole.
- Components (Part 4): requirements for manufacturers – Part 4-1 for a secure development process, Part 4-2 for the security functions of individual devices such as controllers or operator panels.
Two concepts run through the entire series. The first is zones and conduits: a plant is divided into areas with similar protection needs – the zones. Connections between them run only over defined, controlled communication channels – the conduits. This is similar to the fire compartments in a building: if a fire breaks out in one compartment, it shouldn’t spread to the whole building.
The second is security levels from 1 to 4. They describe which attackers a zone should be protected against. Level 1 stands for protection against casual or accidental violations, level 4 for protection against targeted attacks with extensive resources, specialized knowledge of the plant, and high motivation. Which level a zone needs is determined by the risk assessment.
A practical example
Here’s a typical scenario: A mid-sized food manufacturer is modernizing its filling line. So far, the controllers have been on the same network as the office PCs, and the machine supplier maintains the plant via remote access that is permanently open. Following the IEC 62443 model, the company divides the plant into zones: office, control room, filling line, and remote maintenance. Firewalls – filters that only let permitted connections through – regulate traffic between the zones. Remote access is now opened only after approval and requires a second proof of identity in addition to the password, for example via an app (multi-factor authentication). For new components, purchasing requires proof that they meet the requirements of Part 4-2. A penetration test – an authorized, simulated attack by experts – then checks whether the separation holds up in practice.
Why does this matter for businesses?
A successful attack on an industrial plant costs more than data: it can mean production downtime, damaged machines, defective products, and, in the worst case, danger to people. At the same time, requirements are increasing. The NIS2 Directive – implemented in Germany through the BSI Act (BSIG, the Act on the Federal Office for Information Security) – requires many companies to manage risks in line with the state of the art, that is, with currently proven safeguards. Among them are parts of the manufacturing sector. For manufacturers of connected products, the Cyber Resilience Act sets binding security requirements.
IEC 62443 itself is not a law. However, it is regarded as the leading standard for the security of industrial automation systems. Companies that use it as a guide can show customers, insurers, and authorities in a verifiable way that they take a systematic approach to security. The standard also frequently serves as a benchmark in tenders and supplier requirements.
What businesses should do now
- Take inventory: List all controllers, operator stations, network gateways, and remote access points – you can only protect what you know about.
- Define zones and conduits: Divide your plants according to their protection needs, and allow only the connections between zones that operations really need (network segmentation).
- Determine the protection level: Assess the risks for each zone and derive the appropriate security level from them.
- Secure remote maintenance: Open remote access only after approval, with multi-factor authentication, and with logging.
- Build requirements into purchasing: Have manufacturers and integrators demonstrate that they meet the relevant parts of the standard.
- Verify effectiveness: Regularly test whether segmentation and safeguards withstand a realistic attack – using methods that don’t put ongoing operations at risk.
How Rootsektor can help
With our penetration test for OT, ICS/SCADA & IoT, we examine industrial networks, controllers, and connected devices. Safe operation takes priority: we start with a passive analysis and test within agreed time windows with clear abort criteria. We classify the findings by zones and conduits in line with IEC 62443. You can present the report and test certificate to customers, insurers, and auditors; they do not replace certification under the standard. You’ll receive a fixed-price quote after scoping via our Pentest Quote page.