IEC 62443 Compliance Guide: From Gap Assessment to Security Level Certification

Introduction

IEC 62443 is the internationally recognized standard series for Industrial Automation and Control System (IACS) cybersecurity. It provides a comprehensive framework covering the entire lifecycle of industrial cybersecurity, from policies and procedures through system architecture to individual component security.

For organizations operating OT environments, IEC 62443 is increasingly becoming a regulatory requirement, a contractual obligation, and a competitive differentiator. This guide provides a practical roadmap for achieving IEC 62443 compliance based on real-world implementation experience across multiple industrial sectors.

Understanding the IEC 62443 Standard Series

Structure Overview

IEC 62443 consists of four series addressing different stakeholders:

Series 1 - General (62443-1-x): Foundational concepts, terminology, and models

• 62443-1-1: Concepts and models
• 62443-1-2: Master glossary of terms and abbreviations
• 62443-1-3: System security conformance metrics
• 62443-1-4: IACS security lifecycle and use cases

Series 2 - Policies and Procedures (62443-2-x): Requirements for asset owners

• 62443-2-1: Requirements for an IACS security management system
• 62443-2-4: Requirements for IACS solution suppliers (security capabilities of integrators)

Series 3 - System (62443-3-x): System-level security requirements

• 62443-3-2: Security risk assessment and system design
• 62443-3-3: System security requirements and security levels

Series 4 - Component (62443-4-x): Product development and technical requirements

• 62443-4-1: Product security development lifecycle requirements
• 62443-4-2: Technical security requirements for IACS components

Which Parts Apply to You?

For asset owners (organizations operating industrial facilities):

• 62443-2-1: Your security management system
• 62443-3-2: Your risk assessment methodology
• 62443-3-3: Your system security requirements

For system integrators (organizations designing and deploying control systems):

• 62443-2-4: Your integration security capabilities
• 62443-3-2: Risk assessment for the systems you design
• 62443-3-3: System security requirements you must meet

For product suppliers (organizations manufacturing OT components):

• 62443-4-1: Your secure development lifecycle
• 62443-4-2: Technical security requirements for your products

The Security Level Framework

The cornerstone of IEC 62443 is the Security Level (SL) framework, which defines four levels of security capability:

Security Level Definitions

Security Level Types

IEC 62443 defines three types of Security Level measurement:

• SL-T (Target): The desired security level based on risk assessment. This is what you are building toward.
• SL-C (Capability): The security level a system is capable of achieving based on its technical controls. This is what your architecture can deliver.
• SL-A (Achieved): The security level actually achieved in the operational environment, accounting for configuration, procedures, and operational practices. This is your current state.

The goal is: SL-A >= SL-T for every zone.

Phase 1: Gap Assessment

Establishing the Baseline

A gap assessment measures your current state (SL-A) against your target state (SL-T) for each security zone. The process:

Step 1 - Define zones and conduits:

• Map your OT environment into security zones based on common security requirements
• Identify all conduits connecting zones
• Document asset inventory per zone

Step 2 - Assign target Security Levels:

• Conduct a risk assessment per 62443-3-2 for each zone
• Assign SL-T based on the consequence severity and threat environment
• Typical assignments: Safety systems at SL 3-4, process control at SL 2-3, non-critical monitoring at SL 1-2

Step 3 - Assess current controls against 62443-3-3:

IEC 62443-3-3 defines seven Foundational Requirements (FR), each containing multiple System Requirements (SR):

For each SR, assess:

• Is the control implemented? (Yes / Partial / No)
• At what Security Level is it implemented? (SL 1 / SL 2 / SL 3 / SL 4)
• What evidence supports this assessment?
• What gaps exist between current implementation and SL-T?

Gap Assessment Deliverables

The gap assessment should produce:

1. Zone and conduit diagram: Visual representation of all security zones, conduits, and SL-T assignments
2. Control assessment matrix: Every SR assessed per zone with current SL-A vs. SL-T
3. Gap register: Every identified gap with severity, affected zone, and remediation priority
4. Compliance score: Percentage of SRs meeting SL-T per zone and overall

Phase 2: Remediation Planning

Prioritizing Gaps

Not all gaps are equal. Prioritize based on:

1. Risk impact: Gaps in high-SL-T zones (safety, critical control) before low-SL-T zones
2. Exploitability: Gaps that are easily exploitable with known tools before theoretical vulnerabilities
3. Dependency: Foundational controls (network segmentation, asset inventory) before advanced controls (behavioral analytics)
4. Quick wins: Controls that can be implemented without process changes or procurement before those requiring budget and planning

Common High-Priority Gaps

Based on hundreds of assessments, these gaps are almost universal and should be prioritized:

FR 1 - Authentication:

• Shared accounts on HMIs and engineering workstations (most common finding)
• No multi-factor authentication for remote access
• Default credentials on PLCs and network devices

FR 2 - Authorization:

• No role-based access control on OT systems
• Excessive privileges for maintenance and vendor accounts
• No access review or recertification process

FR 5 - Network Segmentation:

• Flat OT network without zone boundaries
• Direct routing between IT and OT without DMZ
• Unmonitored conduits between zones

FR 6 - Monitoring:

• No centralized log collection from OT devices
• No OT-specific network monitoring capability
• No alert correlation between IT and OT events

FR 7 - Availability:

• No tested backup and recovery procedures for OT systems
• No documented disaster recovery plan for control system failure
• No redundancy for critical communication links

Building the Remediation Roadmap

Structure the remediation into phases aligned with operational constraints:

Phase 1 (0-3 months) - Quick Wins:

• Eliminate default credentials
• Implement basic network segmentation between IT and OT
• Deploy centralized log collection
• Establish asset inventory baseline
• Implement MFA for remote access

Phase 2 (3-12 months) - Core Controls:

• Implement full zone and conduit architecture
• Deploy OT network monitoring platform
• Implement role-based access control
• Establish change management and configuration control
• Develop and test incident response procedures

Phase 3 (12-24 months) - Advanced Maturity:

• Implement behavioral anomaly detection
• Establish continuous vulnerability management
• Implement application whitelisting on critical systems
• Conduct tabletop exercises and red team assessments
• Prepare for third-party certification audit

Phase 3: Control Implementation

Implementation Principles for OT

Every control implementation must respect OT operational requirements:

Test before deploying: Validate every control in a lab or non-production environment before touching the live control system. A firewall rule that blocks a critical communication will cause a process upset.

Implement during maintenance windows: For controls that require configuration changes to active systems, schedule implementation during planned maintenance to minimize risk.

Maintain rollback capability: For every change, document the rollback procedure and verify it works before executing the change.

Coordinate with vendors: Many OT systems are vendor-supported. Changes to system configuration, network architecture, or security settings may affect warranty and support agreements. Engage vendors early.

Document everything: IEC 62443 compliance requires evidence. Document every control implementation with configuration screenshots, test results, and approval records.

Key Technical Controls

Network Segmentation (FR 5):

• Implement firewall-enforced zone boundaries per the zone and conduit model
• Configure default-deny rules with explicit allow policies per documented communication requirements
• Deploy industrial protocol-aware firewalls where the budget allows
• Implement the Industrial DMZ with dual-firewall architecture

Authentication and Access Control (FR 1, FR 2):

• Replace shared accounts with individual authentication on all HMIs and workstations
• Implement centralized authentication for OT systems where supported (RADIUS, dedicated OT LDAP)
• Deploy MFA on all remote access pathways and DMZ jump servers
• Implement least-privilege access with documented roles per job function

Monitoring (FR 6):

• Deploy passive OT network monitoring with protocol-aware analysis
• Configure syslog collection from firewalls, switches, servers, and PLCs where supported
• Establish baseline communication patterns per zone
• Implement automated alerting for anomalous behavior

Backup and Recovery (FR 7):

• Back up PLC logic, HMI configurations, server images, and network device configurations
• Store backups offline with integrity verification
• Test restoration procedures annually
• Document recovery time objectives per system criticality

Phase 4: Preparing for Certification

Understanding Certification Options

IEC 62443 certification is conducted by accredited certification bodies (ISASecure, TUV, Bureau Veritas). Certification options include:

• CSMS Certification (62443-2-1): Certifies your security management system
• SSA Certification (62443-3-3): Certifies a specific system or zone at a target Security Level
• SDLA Certification (62443-4-1): Certifies a product development lifecycle (for vendors)
• Component Certification (62443-4-2): Certifies individual products (for vendors)

For most asset owners, CSMS and SSA certifications are the relevant targets.

Audit Preparation Checklist

Before engaging a certification body:

• Zone and conduit documentation complete and current
• Risk assessment documented per 62443-3-2
• SL-T assigned and justified for each zone
• Control assessment matrix showing SL-A per SR per zone
• Evidence packages for each implemented control
• Gap register showing all gaps addressed or formally accepted
• Security management system policies and procedures documented
• Staff training records demonstrating competency
• Incident response plan tested with documented results
• Change management process documented with implementation records
• Vendor management procedures and agreements on file
• Internal audit results demonstrating self-assessment capability

Common Certification Pitfalls

• Insufficient evidence: Auditors require documented proof, not verbal assurance. Every control needs configuration evidence, test records, or policy documentation.
• Scope creep: Define the certification scope carefully. A smaller, well-controlled scope is better than a large scope with gaps.
• Procedure vs. practice: Written procedures that are not actually followed will be identified during the audit. Ensure procedures reflect actual practice.
• Management commitment: Auditors assess leadership commitment through resource allocation, management reviews, and corrective action responsiveness.

Maintaining Compliance

IEC 62443 compliance is not a one-time achievement. Maintaining certification requires:

• Regular management reviews of the security management system
• Annual risk assessment updates incorporating new threats and vulnerabilities
• Continuous monitoring of control effectiveness
• Corrective action management for identified non-conformities
• Staff competency maintenance through ongoing training
• Surveillance audits by the certification body (typically annual)

Conclusion

IEC 62443 provides the most comprehensive framework for OT cybersecurity, but implementing it requires practical knowledge of both the standard requirements and the operational realities of industrial environments. The journey from initial gap assessment to certification typically takes 18-36 months for a well-resourced organization. Starting with a thorough gap assessment, prioritizing based on risk, and implementing in phases aligned with operational constraints is the proven approach to success.

Beacon Security provides IEC 62443 gap assessments, remediation planning, and certification preparation services for industrial organizations. Contact us to begin your compliance journey.