What Is IEC 62443? Plain-English Guide for Engineers

IEC 62443 is the international series of standards for securing industrial automation and control systems, the PLCs, SCADA, drives and networks that run plants. It is written jointly as ISA/IEC 62443 and covers four things: general concepts, the security programme, system design and secure components. Its best-known ideas are zones and conduits, security levels 1 to 4 and seven foundational requirements.

EDWartens is not affiliated with ISA or the IEC. This post is an independent, plain-English introduction. It paraphrases and does not reproduce the standards, so read the originals before you design or audit anything.

Why does IEC 62443 exist?

Office IT security protects data. Industrial security protects processes, and a failure can stop production, damage equipment or hurt people. Control systems were designed for reliability, often with long lifetimes and little security, and they are now connected to company networks and remote support. CISA, the US cyber agency, publishes guidance for industrial control systems and operational technology, and its page lists resources for asset owners, integrators and vendors (page opened 17 October 2026). IEC 62443 gives engineers a shared method for the same problem.

What are the parts of the series?

ISA lists the published documents on its series page (opened 17 October 2026). They fall into four groups.

• Group 1, General. Part 1-1 sets out terminology, concepts and models, the vocabulary the other parts use.
• Group 2, Policies and procedures. Part 2-1 covers the security programme an asset owner runs, 2-3 covers patch management, and 2-4 covers the requirements for service providers. Part 2-2, listed as a technical report, describes a protection scheme.
• Group 3, System. Part 3-2 covers security risk assessment for system design, and 3-3 covers system security requirements and security levels.
• Group 4, Component. Part 4-1 covers the secure product development lifecycle, and 4-2 sets technical security requirements for components.

Notice that the groups follow the people involved. The standard talks about three main roles: the asset owner who runs the plant, the system integrator who builds the control system, and the product supplier who makes the devices. Each role has parts addressed to it, and the series asks them to work together.

What are zones and conduits?

A zone is a group of assets, physical or logical, that share the same security requirements. A conduit is the path along which zones talk to each other, together with the controls on that path. The idea is simple: do not treat a plant as one flat network. Divide it, decide how much protection each part needs, and control what crosses the boundaries.

Worked example: a small pump station. You might define three zones. The safety system is one zone because a failure there is the most serious. The PLC and its field I/O are a second zone. The SCADA server and operator workstation are a third. Conduits join the PLC to SCADA and SCADA to the company network. Each conduit gets rules: only named protocols, only named addresses, logging, and no direct route from the company network to the PLC. That small drawing is the core of the method. Part 3-2 describes the risk assessment that produces it. For the model that sits behind this thinking, read the Purdue model explained.

What are security levels 1 to 4?

Security levels describe how strong a defence needs to be, judged by the attacker it must resist. In plain terms:

There are three versions of the idea, and mixing them up is a common mistake. The target level (SL-T) is what a zone needs, decided by risk assessment. The capability level (SL-C) is what a component or system can deliver. The achieved level (SL-A) is what the finished installation actually provides. A good design closes the gap between target and achieved.

What are the seven foundational requirements?

The foundational requirements, FR1 to FR7, are the seven headings under which the technical requirements are grouped. Think of them as seven questions about any zone. Who is acting (FR1)? What may they do (FR2)? Can the system be changed without permission (FR3)? Is sensitive data protected (FR4)? Does data only flow where it should (FR5)? Will we notice and respond to events in time (FR6)? Will the system keep running under stress (FR7)? Their full names are identification and authentication control (FR1), use control (FR2), system integrity (FR3), data confidentiality (FR4), restricted data flow (FR5), timely response to events (FR6) and resource availability (FR7). Part 3-3 turns each question into system requirements for each security level, and part 4-2 does the same for components.

Who uses IEC 62443, and is it mandatory?

Asset owners use it to run a security programme. Integrators use it to design and document zones and conduits. Suppliers use it to build products with a secure development lifecycle. Auditors and customers use it as a shared yardstick. The series is voluntary in itself, although a regulator, a law or a customer contract can require it, so check what applies to your sector and country.

A certificate in this area proves study, not authority. ISA offers a Cybersecurity Fundamentals Specialist exam, and the fee for it is paid to ISA, not to us. EDWartens does not run it, and nothing here is a substitute for the standards. Avoid exam dumps. They teach answers rather than understanding, and they can breach the exam rules.

What do people often get wrong?

• 'It is an IT standard.' It is built for operational technology, where availability and safety come first. An IT habit such as patching on a schedule can be wrong for a running plant, and part 2-3 treats patch management as a process with its own care.
• 'It is one document.' It is a series of parts for different roles. You rarely need all of them, so start with the part that matches your job.
• 'A product can be 62443 compliant on its own.' Components can be assessed against part 4-2 and their supplier's process against 4-1, but a secure plant also depends on how the system is designed, installed and run.
• 'Security levels are a score you buy.' They are targets chosen by risk assessment, then checked against what a system achieves.
• 'Higher is always better.' A higher level costs more in design, operation and complexity, so the target should match the risk, not the ambition.

Keeping these five points in mind avoids most of the confusion in a first meeting about the standard.

How do you start learning IEC 62443?

Go in this order. First, learn what a control system is and what it connects to. The ICS security foundations course starts from PLC, DCS and SCADA and reaches the seven requirements. Second, learn the model: Purdue levels, zones and conduits. Third, learn the series itself with the OT and ICS cybersecurity with ISA/IEC 62443 course, and fourth, if you want an exam goal, the IEC 62443 fundamentals exam prep course. PLC programmers can add cybersecurity for PLC programmers.

All the courses are free to join. A certificate of completion is optional and paid, shown in your currency before you pay, and verifiable at /verification. The OT and ICS security hub lists every course in the area. For deeper reading on the standard, go to IEC 62443 explained: roles, zones and security levels and free IEC 62443 training, and for a lab view see Zeek for ICS.

Practise defensively and only on systems you own or are authorised to use. A home lab with simulated PLCs is enough to draw zones, write conduit rules and test them.

What next?

If you are new to the field, the ICS security foundations course takes about four weeks at a steady pace. If you want practice on a project, try a free engineering internship with a security-minded task such as an asset list or a zone drawing for a simulated plant. Internships here are free to join, are training and not employment, and pay no stipend. Remember the one-line summary: divide the plant into zones, control the conduits between them, choose a target level for each and check that the result matches.

Take the free course

Free

Cybersecurity · Beginner · Free

ICS Security Foundations: Control Systems, Defence in Depth and the 62443 Requirements

Free

Cybersecurity · Intermediate · Free

OT and ICS Cybersecurity with ISA/IEC 62443

Free

Cybersecurity · Intermediate · Free

IEC 62443 Cybersecurity Fundamentals Exam Prep

Free

Cybersecurity · Intermediate · Free

Cybersecurity for PLC Programmers: Hardening Siemens and Rockwell Controllers