What Is IEC 62443 Explained for Industrial Security

Published Date: September 9, 2026

Category: Knowledge Hub Tags: OT ICS

Most industrial breaches don't start on the plant floor; they start in the gap between IT and OT that nobody mapped. Here is what IEC 62443 covers, how its structure works, and where to start applying it.

What Is IEC 62443?

IEC 62443 is a series of international standards that define how to secure industrial automation and control systems, the hardware, software, and networks that run manufacturing plants, power grids, water utilities, and other physical operations, across their full lifecycle from design through decommissioning.

The standard began in 2002 as ISA99, a committee formed by the International Society of Automation to protect the equipment behind U.S. critical infrastructure. Around 2010, the work was adopted by the International Electrotechnical Commission, and the series became jointly known as ISA/IEC 62443.

Unlike IT security standards built around confidentiality, IEC 62443 is built around availability and physical safety first. A ransomware attack that encrypts a database is a very different event from one that stops a chemical process mid-cycle or disables a safety interlock, and the standard’s structure reflects that difference throughout.

Why Does IEC 62443 Matter for Industrial Organizations?

IEC 62443 matters now because the wall between IT and OT, the industrial equipment running physical processes, has largely come down. Plant floor sensors feed cloud dashboards. Vendors need remote access to maintain equipment. Legacy controllers, some running for twenty years or more, are increasingly reachable from corporate networks never built with them in mind.

Regulators have taken notice. In 2025, CISA, the FBI, and the UK’s National Cyber Security Centre jointly urged critical infrastructure operators to align their OT security practices with IEC 62443 and ISO/IEC 27001, a rare multi-agency, cross-border endorsement of a single standard.

The stakes differ from a typical data breach, too. A compromised industrial system can affect physical safety, environmental controls, and public services, not just data, which is why insurers, regulators, and boards increasingly ask for it by name.

How Is IEC 62443 Structured?

IEC 62443 is organized into four parts, aimed at different audiences: General covers terminology and concepts, Policies and Procedures covers the security management program an asset owner runs, System covers technical requirements for designing a secure system, and Component covers requirements for the individual products vendors build.

Two ideas run through all four parts. The first is Security Levels, four tiers running from SL 1, protection against casual or accidental misuse, to SL 4, protection against a well-resourced, motivated attacker such as a nation-state. Each level is measured against seven Foundational Requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

The second is zones and conduits, the practice of grouping assets that share the same risk profile into a zone, then tightly controlling every conduit, the connection between zones. This is network segmentation applied specifically to industrial environments, built on the same Zero Trust assumption that no connection should be trusted by default. It is the direct answer to the undocumented connection that shut down the plant at the start of this article.

Who Needs to Comply with IEC 62443?

IEC 62443 defines three roles, and most organizations touch at least one. Asset owners operate the plant and are accountable for the overall security program. System integrators design and build the automation systems asset owners run. Product suppliers manufacture the individual components, sensors, controllers, and software, that make up those systems.

Compliance obligations differ by role too. Vendors pursue Maturity Levels, which certify how securely their development process is run, while asset owners and integrators target Security Levels for the systems they operate and build. The two are related but not interchangeable and treating them as the same thing is a common early mistake.

Organizations already working within NIST’s cybersecurity frameworks will recognize the risk-based structure, though IEC 62443 stays specific to industrial environments rather than IT broadly.

When Should an Organization Start Implementing IEC 62443?

The right time to start is during a risk assessment, before any zone and conduit design work begins, since the standard’s own methodology requires understanding what needs protecting before deciding how to protect it. Retrofitting segmentation onto a running plant is possible but far more disruptive than designing it in from the start.

For organizations with existing, older infrastructure, a phased approach works better than an all-at-once rollout: assess and inventory first, segment the highest-risk zones next, then extend the same discipline outward as budget and maintenance windows allow. New builds and major plant expansions are the cleanest point to apply the full standard from day one.

What Happens If an Organization Ignores IEC 62443?

An organization that ignores IEC 62443 does not just risk a slower breach response. It risks discovering, during an actual incident, that nobody can say with confidence which systems are connected to which, exactly the blind spot that turned a phishing email into a two-day plant shutdown at the start of this article.

The consequences of an unsegmented industrial environment go beyond downtime. A breach that reaches safety instrumented systems or physical process controls carries risk to employees, the surrounding community, and the environment, not just data. That is the distinction regulators keep pointing to, and it is why IEC 62443 has moved from a specialist standard to a baseline expectation for critical infrastructure operators.