Reading IEC 62443 without a consultant

Most plant managers meet ISA/IEC 62443 the same way: a customer, an insurer or an auditor asks whether the plant “complies with 62443”, someone searches for it, and the first result is a list of a dozen documents with numbers that look like software versions. It is not one standard. It is a series, written over many years by people with different jobs, and only a few parts of it are addressed to the person who owns a plant.

This guide is a map. It is not a substitute for the documents, which are published by the IEC and ISA and have to be bought; it is a way of knowing which to buy and which to leave on the shelf.

The four groups

The series is organised into four groups, and the first digit after the hyphen tells you which group a part belongs to. The groups are, in order: general, policies and procedures, system, and component.

The general group, 62443-1-x, sets out the vocabulary and the models. If you have ever wondered what the series means by “zone”, “conduit” or “security level”, this is where the definitions live. It is reference material; most people open it only to settle an argument.

The policies and procedures group, 62443-2-x, is written for organisations rather than networks. It describes what a security programme looks like for an owner of control systems: who is responsible, how risk is assessed, how patches and changes are handled, how service providers are managed. This is the group that most resembles a management standard, and it is the one an auditor is most likely to ask about.

The system group, 62443-3-x, is about the plant network as a whole: how to split it into zones, how to decide what level of protection each zone needs, and what a system has to be able to do to reach that level. It is the most useful group for anyone drawing a network diagram.

The component group, 62443-4-x, is written for the people who make and supply equipment: controllers, HMIs, network devices, software. It covers how a product should be developed and what security features it should have. An asset owner does not need to read it, but it is the part a vendor should be able to show evidence against.

ISA/IEC 62443-1-1 · terminology, concepts and models

Zones, conduits and security levels in plain words

A zone is a group of equipment that shares the same security needs and can be protected as one thing. A packing line and its HMIs might be one zone; the plant historian and the servers around it another; the engineering workstations a third. Drawing zones stops you treating every device as if it needs the same protection, which is impossible as well as wrong.

A conduit is the path by which two zones talk to each other. It might be a firewall, a cable through a data diode, a VPN into a vendor, or, on a flat network, simply the fact that everything can see everything. Naming the conduits is the more useful half of the exercise, because that is where the accidental connections live.

The zones are usually what everyone expected. The conduits are not.

A security level is the series’ way of saying how capable an attacker a zone should be able to withstand. There are four, and it is simplest to think of them as four kinds of person.

Level 1 is protection against accidents and casual misuse: an operator who clicks the wrong thing, a contractor who plugs into the wrong port. Level 2 is protection against someone who means harm but has ordinary tools, little time and no special knowledge of control systems. Level 3 is protection against someone with real skill in control systems, specific tools and moderate resources, who has chosen your plant deliberately. Level 4 is the same again with the resources of a large organisation behind them.

The series uses these levels in three ways, which is where readers get lost. A target level is what you decide a zone ought to reach. A capability level is what a product or system can reach if configured properly, which is the number a vendor will quote you. An achieved level is what a zone actually reaches today. The gap between target and achieved is the work.

The mistake to avoid is assuming higher is better. Level 4 everywhere is neither affordable nor necessary. Most zones on a private industrial site are reasonably targeted at level 2, with a smaller number, often the safety systems and whatever the plant cannot run without, at level 3. The decision belongs to the plant, because the plant knows what it would cost to lose each zone.

ISA/IEC 62443-3-3 · system security requirements and security levels

Which parts to read first

If you own a plant and have a week, read three parts. Start with 62443-2-1, which describes the programme: the roles, the policies, the risk assessment, the handling of changes and vendors. It describes a mature programme, not a first year; a reasonable plan is to decide which elements you have, which you lack and which matter most now.

Then read 62443-3-2. It describes how to break the plant into zones and conduits, assess the risk to each, and set a target security level for each one. It turns a network diagram into a security design, and it is the part our method leans on most, because you cannot draw zones without knowing what is on the network.

Then read 62443-3-3, or at least its list of what a system should be able to do: identify who is on it, control what they can do, keep its own integrity, protect the data that matters, restrict what flows between zones, respond to events, and stay available. Each of those is described at every security level, so you can see what level 2 asks of a packing line and what level 3 asks of a safety system.

ISA/IEC 62443-2-1 · security programme requirements for asset owners

ISA/IEC 62443-3-2 · zones, conduits and risk assessment

Which parts to leave to others

The component parts, 62443-4-1 and 62443-4-2, are for whoever supplies your equipment. 62443-4-1 says how a product should be developed; 62443-4-2 says what a component should be able to do at each security level. You do not need to read either. You do need to ask a vendor, in writing, which capability level their product has been certified to and by whom, and to notice when the answer is vague.

62443-2-4 is written for integrators and service providers, and it is the right document to hand to the people who build and maintain your lines. If a machine builder tells you their remote-support connection is fine, this is the part that describes what “fine” would have to mean.

The rest of the series, the technical reports and the parts on patch management and on the programme’s detailed metrics, are useful once the first three parts are in hand and rarely before. Reading them first is how people conclude the series is impossible. It is long, and it was not written to be read front to back.

Where the parts bite hardest

The parts matter differently from plant to plant. In pharmaceuticals, the programme requirements of 62443-2-1 sit naturally beside an existing quality system, and the zones-and-conduits work of 62443-3-2 can be done entirely passively, without opening a change control on a validated system.

In manufacturing, 62443-3-2 is the part that pays for itself, because lines from several integrators tend to have been joined into one network for a reporting rollout, and drawing the zones is the first time anyone has written down which line should be able to talk to which. The component parts matter here too, because a floor full of machine builders’ equipment is a floor full of vendors who should be able to answer the capability question.

Whatever the sector, the order is the same. Know what is on the network. Draw the zones around what is there. Set a target level per zone that the plant can defend to itself. Then read the requirements for that level, and only that level. The series rewards being read in that order, and almost nobody is told so.

Sources · ISA/IEC 62443-1-1 (concepts and models); ISA/IEC 62443-2-1 (security programme requirements for asset owners); ISA/IEC 62443-3-2 (risk assessment and system design); ISA/IEC 62443-3-3 (system security requirements and security levels); ISA/IEC 62443-4-2 (component requirements).