How IEC 62443 defines risk tiers and structures security across the full IACS lifecycle.
IEC 62443 defines five security levels that describe a zone or component's ability to withstand attacks from threat actors of increasing sophistication and motivation. Security levels drive the selection of countermeasures and form the basis of conformance assessment.
No specific security requirements or protections applied. Baseline reference point only.
Protection against unintentional or accidental violations — opportunistic actors with no targeted motivation or specialist skills.
Protection against deliberate attack using simple, generic means — low-resource adversaries with IT skills but limited IACS-specific knowledge.
Protection against sophisticated, IACS-aware threat actors using targeted attack methods — well-resourced adversaries with insider knowledge.
Protection against nation-state level actors using extended resources, advanced techniques, and deep system knowledge over prolonged campaigns.
IEC 62443 distinguishes three uses of security levels. The target security level (SL-T) is the level an asset owner determines a zone must achieve, based on the risk assessment under IEC 62443-3-2. The achieved security level (SL-A) is what the deployed system actually delivers — determined by the weakest link across all installed components and configurations. The capability security level (CAP SL) is the level a product or component can support, as claimed by the manufacturer under IEC 62443-4-2. Closing the gap between SL-T and SL-A is the core engineering challenge in any IEC 62443 system design.
IEC 62443 is structured around a continuous security lifecycle. Security is not a one-time project but an ongoing programme of assessment, implementation, and improvement.
Identify IACS assets, define security zones and conduits, assess threats, and determine target security levels per 62443-3-2.
Establish the Security Management System (62443-2-1), assign roles, and develop security policies, procedures, and awareness programmes.
Select components with appropriate CAP SLs (62443-4-2), qualify suppliers against 62443-2-4, and design the system to meet SL-T per 62443-3-3.
Deploy countermeasures, harden configurations, apply secure network segmentation, and enforce identity and access management controls.
Test the system against defined requirements, conduct security acceptance testing, and verify that achieved SL meets or exceeds target SL.
Monitor continuously, manage patches (62443-2-3), respond to incidents, conduct periodic risk reviews, and drive improvement.
Need help implementing IEC 62443 in your organisation? Get in touch ↗