Align with IEC 62443
Dragos assists organizations in implementing ISA/IEC 62443 standards through our platform, services, and threat intelligence.
IEC 62443 is the world’s only consensus-based OT cybersecurity standards series for industrial automation and control systems (IACS). Developed by ISA99 and IEC TC65/WG10, it provides a comprehensive framework for securing operational technology across asset owners, product suppliers, and service providers.
Countries including Australia, Japan, Singapore, and Malaysia have adopted IEC 62443 for critical infrastructure. The IEC designated it a “horizontal standard” applicable across industries. It’s extensively referenced in NIST CSF, CISA CPGs, and the UN Economic and Social Council’s cybersecurity framework proposal for Europe.
Adoption is optional and should be based on risk assessment.However, the standards are increasingly referenced in regulatory frameworks worldwide and represent international best practices. Many organizations have successfully implemented IEC 62443 enterprise-wide to build sustainable cybersecurity cultures and operational resilience.
Group 1 (General) covers terminology, concepts, and models. Group 2 (Policies & Procedures) addresses security programs and organizational requirements. Group 3 (System) defines system-level security requirements. Group 4 (Component) specifies requirements for IACS product development and components.
The standards bridge the gap between operations and information technology by providing a holistic, risk-based approach. They establish common terms and requirements that both IT and OT stakeholders can use, while recognizing the unique constraints of operational environments where safety, reliability, and uptime are paramount.
Key challenges include helping management understand that security is an ongoing operational approach (not a one-time project), defining service provider requirements, establishing component and system security baselines, and conducting thorough risk assessments. ISA/IEC 62443-2-1, 2-3, 2-4, 3-2, 3-3, and 4-2 specifically address these areas.
The standards are written in a technology-neutral form, so most requirements apply to emerging technologies. Joint teams (JT-62443-3-1, JT-62443-1-6, JT-62443-07) assess IIoT, cloud integration, AI, and regulatory developments like European NIS2 and CRA to identify when new or modified requirements are needed for future versions.
Unlike generic IT frameworks, IEC 62443 is specifically designed for industrial control systems. It’s a functional standard that sets security performance objectives without prescribing specific technologies, recognizing operational constraints like real-time requirements, legacy systems, and safety-critical processes that can’t be disrupted.
