IEC 62443

Asset owners establish, implement and maintain a documented Cyber Security Management System covering scope, policy, risk analysis, risk treatment, training, business continuity, physical security, network segmentation, access control, monitoring, incident response and management review specific to IACS environments.

Asset owner performs high-level and detailed cybersecurity risk assessments of IACS considering threats, vulnerabilities, consequences to safety, environment, production and reputation, and documents risk treatment decisions before commissioning and on significant change.

Asset owner segments IACS networks into zones and conduits based on risk, separating IACS from corporate IT via DMZ, restricting traffic to documented purposes, and protecting safety systems from other control systems.

Asset owner integrates cybersecurity into management of change processes so that hardware, software, firmware, network, or logic changes to IACS are risk-assessed, approved, tested and documented including effect on security posture.

Asset owner operates a documented IACS patch management process covering vulnerability monitoring, applicability analysis, vendor approval, test, deployment during outages, and risk acceptance for unpatchable systems.

Asset owner protects control rooms, marshalling cabinets, PLCs, RTUs, network equipment and engineering workstations from unauthorised physical access, tampering and environmental damage.

Asset owner manages IACS user and service accounts with least privilege, individual accountability where feasible, role-based access, periodic review and removal upon role change or departure.

Asset owner maintains an incident response capability tailored to IACS, including detection, triage, containment, eradication, recovery, lessons learned, communication with regulators, and exercises that include OT-specific scenarios such as ransomware on engineering workstation or malicious PLC logic change.

Asset owner plans, tests and maintains the ability to recover IACS function after a cybersecurity incident or other disruption, including configuration backups for controllers, HMI images, historian data and engineering workstations, with documented RTO and RPO.

Asset owner provides role-based IACS cybersecurity training to operators, engineers, maintenance staff, contractors and managers, with content tailored to OT realities and refresher cadence defined.

The IACS shall provide the capability to identify and authenticate all human users and enforce the authentication on all interfaces providing access to the IACS, including operator HMI, engineering workstation and remote access.

The IACS shall provide the capability to enforce authorisations assigned to all human users for controlling use of the IACS to support segregation of duties and least privilege.

The IACS shall provide the capability to detect, record, report and protect against unauthorised changes to software, firmware, configuration and information at rest within the control system.

The IACS shall provide the capability to logically segment networks and restrict data flow between zones based on the principle of least communication necessary.

The IACS shall provide the capability to be configured according to recommended network and security configurations and maintain them across normal operation, restart and recovery.

The IACS shall provide the capability to identify and authenticate software processes and devices communicating across conduits or to control system components.

The IACS shall provide the capability to generate audit records for security-relevant events including access control, configuration change, authentication, system events and operator actions on safety-critical commands.

The IACS shall provide the capability to protect the integrity of transmitted information, especially for control commands and safety-relevant communications, using cryptographic or other appropriate mechanisms.

The IACS shall provide the capability to monitor and control communications at zone boundaries, providing deny-by-default policy and alarming on attempted boundary violations.

The IACS shall provide the capability to make audit records accessible to authorised humans or automated tools for analysis in support of incident detection and response.

The IACS shall provide the capability to back up user-level information and system-level information without affecting the normal operation of the control system, and protect backup integrity and confidentiality.

The IACS shall provide the capability to continuously monitor security-relevant events using mechanisms appropriate for control system environments such as passive network monitoring and asset inventory tools.

IACS service providers (integrators, maintenance providers) establish a documented security program addressing personnel, processes and technical practices delivered to asset owners during integration, commissioning and ongoing maintenance.

Service provider ensures personnel deployed on IACS engagements are vetted, trained and supervised, with background checks proportionate to access level and competency verified for tasks performed.

Service provider applies secure architecture practices when designing IACS solutions, including zones, conduits, defence in depth, secure remote access, least functionality and adherence to asset owner security requirements.

Service provider implements secure wireless and remote access mechanisms when providing IACS services, including MFA, jump servers, session recording, time-limited access and explicit asset owner approval.

Service provider applies malware protection on its own tools, removable media and delivery devices used at customer sites, and supports asset owner anti-malware controls during commissioning and maintenance.

Service provider supports IACS backup and restore capability including controller program backups, system images, configuration archives and procedures handed over to asset owner with restore test evidence.

Product supplier provides documentation to asset owners and integrators describing secure configuration, hardening, account management, removal/disposal and integration security considerations.

Product supplier maintains a process to receive, triage, remediate and disclose security defects including coordinated disclosure with researchers and customers, advisories, and CVE assignment.

Product supplier provides security updates for products including evaluation of compatibility, controlled distribution, signing, and clear documentation of remediated vulnerabilities for asset owners.

Embedded devices (PLCs, RTUs, IEDs) shall support the capability to be updated with security patches in a manner consistent with availability requirements, including signed firmware and rollback protection.

Components (embedded devices, host devices, network devices, software applications) shall provide the capability to identify and authenticate all human users seeking access to the component.

Define the System Under Consideration including boundary, components, functions, supporting infrastructure and external interfaces as the basis for risk assessment and zone/conduit definition.

Perform an initial high-level cybersecurity risk assessment on the SUC to identify worst-case unmitigated consequences and prioritise areas needing detailed analysis and zoning.

Partition the SUC into zones (groupings with common security requirements) and conduits (communications between zones), based on function, risk, criticality, ownership and physical or logical boundaries.

For each zone and conduit perform detailed risk assessment identifying threats, vulnerabilities, existing countermeasures, likelihood, consequence and resulting risk against tolerable risk, leading to target Security Level SL-T.

Document the Cybersecurity Requirements Specification capturing per-zone and per-conduit security requirements, SL-T, assumptions and constraints used as input to design, procurement and acceptance.

The IACS shall provide the capability to verify intended operation of security functions and report when verification fails, including periodic self-tests, configuration baselines and integrity checks.