The method
The IEC 62443 series (building on ISA99) covers the cybersecurity of industrial automation and control systems (IACS): PLCs, control systems, industrial networks, connected sensors and actuators. It separates the responsibilities of the asset owner, the system integrator and the component supplier.
The system under consideration (SuC) is divided into zones — groups of assets sharing the same security requirements — connected by conduits, which carry communications between zones or to the outside. Each zone is assigned a target security level (SL-T), from 1 (protection against casual violation) to 4 (protection against a state-sponsored attacker with extensive resources), against seven foundational requirements (identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability).
IEC 62443-3-2 describes the risk assessment and zone/conduit partitioning process; 62443-3-3 details technical requirements by security level; 62443-4-1 and 4-2 address product and component suppliers.
When to use it
- Design or modernisation of an industrial control system (manufacturing, energy, water, transport).
- Regulatory compliance (NIS2 for essential operators, contractual requirements from a client).
- Segmenting an existing industrial network, to prioritise which zones to protect first.
Watch out for
- IT and OT systems do not share the same priorities: IT often favours confidentiality, OT favours availability and personnel safety.
- Zone partitioning must reflect the site’s physical and organisational reality, not just network topology.
- A target security level set too high everywhere dilutes effort; it is better modulated by each zone’s actual criticality.
Steps (IEC 62443-3-2 process)
- Define the system under consideration (SuC) and gather the asset inventory, data flows and existing network architecture.
- Perform an initial, high-level risk assessment to identify candidate zones.
- Partition the system into zones and conduits based on criticality, physical constraints and organisational responsibilities.
- Assess the detailed risk of each zone and set its target security level (SL-T).
- Compare the achieved level (SL-A) with the target, document gaps and define the compliance plan.
IEC 62443 assessment and compliance tools
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| CISA CSET ↗ | Public bodyFree | United States | Security evaluation of IT and industrial networks. |
| CISO Assistant ↗ | Open sourceFree | France | Open-source GRC platform (risk, compliance). |
| Polyodos — IEC 62443 ↗ | Commercial publisherFree for teaching | International | OT/ICS risk analysis under IEC 62443-3-2. |
| MONARC ↗ | Public bodyOpen source | Europe | Four-phase risk analysis reusing similar analyses; online or self-hosted; published by NC3 (Luxembourg). |
Standards and references
- IEC 62443 — Sécurité des systèmes d’automatisation et de commande industriels
- ISO/IEC 27001
- NIST SP 800-82 — Guide to OT security
- Directive (UE) 2022/2555 (NIS2)