ISA/IEC 62443 is the series of standards for securing industrial automation and control systems, developed by the ISA99 committee and adopted by the IEC. It covers asset owners, system integrators and product suppliers, and organizes systems into zones and conduits with target security levels.
ISA/IEC 62443
ISA/IEC 62443 is the series of standards for the security of industrial automation and control systems (IACS). It is written by the ISA99 committee and published jointly with the IEC, and it is the security baseline most operational technology programs measure against.
- Roles, not just products - The series is split by who is responsible: general concepts, policies and procedures for asset owners, requirements for systems, and requirements for components and the people who build them.
- Zones and conduits - A system is divided into zones of assets that share security requirements, connected by conduits that carry communication between them.
- Security levels - Each zone gets a target security level, from protection against casual violation up to sophisticated, well-resourced attackers.
- Secure development - Product suppliers are held to a secure development lifecycle and to technical requirements for the components they ship.
For APIs, 62443 is where governance meets the plant floor. Every REST, MQTT or OPC UA interface that crosses from IT into OT is a conduit, and the standard is the vocabulary for deciding what it is allowed to carry and how it is protected.
Industry: Security
