Written and maintained by CASRAI Editorial Board
Last updated
IEC 62443 is the international series of standards for the cybersecurity of industrial automation and control systems (IACS), the operational technology (OT) that runs plant equipment, building systems and, in research settings, large instruments and facility controls. This page explains how the series is organised, what the security levels mean, how the seven foundational requirements work, and how it relates to the ISO/IEC 27000 series. It is a reference explainer based on the IEC’s own description of the series, read on 2026-11-07; the normative text is sold by IEC and ISA and is not reproduced here.
What IEC 62443 is used for in research
IEC 62443 is a multi-part series, not a single document. The IEC’s Systems Committee on Smart Energy groups its parts into four clusters: general concepts, policies and procedures, system-level requirements, and component-level requirements. Different parts are written for different roles, so the first practical question is which part applies to your role: owning and operating a system, building or integrating one, or making the products inside it.
The four groups of parts
| Group | Part | Subject (per the IEC page) |
|---|---|---|
| General | IEC/TS 62443-1-1 | Terminology, concepts and models for IACS security |
| General | IEC/TS 62443-1-2 | Definitions of terms and acronyms |
| Policies and procedures | IEC 62443-2-1 | Asset owner security program requirements |
| Policies and procedures | IEC/IS 62443-2-2 Ed.2 | Framework and methodology for evaluating IACS protection |
| Policies and procedures | IEC/TR 62443-2-3 | Patch management in the IACS environment |
| Policies and procedures | IEC 62443-2-4 | Security capabilities for IACS service providers |
| System | IEC/TR 62443-3-1 | Assessment of cybersecurity tools, countermeasures and technologies |
| System | IEC 62443-3-2 | Risk assessment, zones and conduits |
| System | IEC 62443-3-3 | System security requirements and security levels |
| Component | IEC 62443-4-1 | Process requirements for secure product development |
| Component | IEC 62443-4-2 | Technical requirements for components |
Reading the table by role (an editorial reading of the part titles, not an IEC statement): the 2-x parts lean toward the organisation that owns and runs the system, the 3-x parts toward whoever designs or integrates the system, and the 4-x parts toward the people who build the products. Parts carry different publication types (TS, TR, IS) and editions; check the current edition of each part at the IEC webstore before citing it.
The seven foundational requirements
IEC 62443-1-1 defines seven foundational requirements (FRs), which organise the technical requirements in the system and component parts:
- FR1: Identification and authentication control
- FR2: Use control
- FR3: System integrity
- FR4: Data confidentiality
- FR5: Restricted data flow
- FR6: Timely response to events
- FR7: Resource availability
Install or access: where to read the documents
The standards are published by the IEC (developed with ISA), and copies are purchased from the IEC webstore or ISA. This page gives no edition years, because they change per part; check the webstore listing for the current edition of each part. Free documents found online are usually summaries or unofficial copies, so confirm the edition before relying on them.
Step by step: reading a security level vector
- Identify the part: IEC 62443-3-3 defines the four security levels, SL1 to SL4.
- Confirm the zone or conduit the vector is assigned to (see IEC 62443-3-2).
- Map each of the seven elements to FR1 to FR7 in order.
- Read each number as the countermeasure strength required against a potential adversary for that requirement.
What are the security levels in IEC 62443?
IEC 62443-3-3 defines four security levels, SL1 to SL4. Per the IEC, they correlate the required set of countermeasures with the strength of a potential adversary. To meet a level, the defined requirements for that level must be fulfilled. A requirement can also be met through a compensating countermeasure, which is what makes the model workable for legacy equipment that cannot support a requirement directly.
Security level vectors
A zone or conduit does not have one single number. Its security level is a vector with seven elements, one for each foundational requirement. The IEC gives SL=(3,3,3,1,2,1,3) and SL=(2,2,2,0,1,1,0) as examples. The elements follow FR1 to FR7 order.
Worked reading of a vector (illustrative, not a real facility)
This example is constructed for this page and is not a case from any institution. Take the IEC’s first example vector, SL=(3,3,3,1,2,1,3), and read it element by element: identification and authentication control (FR1) at 3, use control (FR2) at 3, system integrity (FR3) at 3, data confidentiality (FR4) at 1, restricted data flow (FR5) at 2, timely response to events (FR6) at 1, and resource availability (FR7) at 3. The pattern describes a zone where integrity, access control and availability weigh more than confidentiality, a plausible shape for equipment whose first job is to keep running correctly. The vector is the requirement for that zone; the interpretation of what it implies is the editor’s, not the IEC’s.
Output and how to read it: zones and conduits
IEC 62443-3-2 covers risk assessment and the partitioning of a system into zones and conduits. The IEC describes a zone as a grouping of assets based on risk, and communication between zones runs through conduits. The security level vector described above is assigned to a zone or conduit.
IEC 62443 vs ISO 27001
The short answer: they address different things and can be used together. The IEC states that IEC 62443 can be used in conjunction with the ISO/IEC 27000 series, citing ISO/IEC 27019 for the energy domain. The ISO/IEC 27000 series is the family of information security management standards, with ISO/IEC 27001 as its best-known member. IEC 62443 is specific to industrial automation and control systems, with requirements down to component level. As an editorial interpretation: an organisation that already runs an information security management system can treat IEC 62443 as the OT-specific layer for its control systems rather than a replacement. For the IT-side standard, see ISO 27001 for research data security.
How does it relate to NIST SP 800-82?
NIST SP 800-82 is US guidance on operational technology security, while IEC 62443 is an international standards series with defined parts, security levels and component requirements. Our guide to NIST SP 800-82 and OT security covers the NIST document. For the wider field, see what is cybersecurity.
Troubleshooting: common misreadings
- A security level is not one number for a whole facility; each zone or conduit carries a seven-element vector.
- A zero or low element is a stated requirement for that foundational requirement, not an omission; interpreting what it implies is editorial.
- IEC 62443 does not replace ISO/IEC 27001; the IEC says the two can be used together.
- Parts differ in publication type (TS, TR, IS) and edition, so confirm the edition before citing.
Free alternatives and orientation resources
| Resource | What it gives you |
|---|---|
| IEC Systems Committee on Smart Energy page | The IEC’s own free description of the series, its parts and security levels (not the normative text) |
| NIST SP 800-82 guide | Our guide to the US operational technology security guidance |
| ISO 27001 guide | The IT-side information security standard that IEC 62443 can be used alongside |
FAQ
What are the different security levels defined in the IEC 62443 standard?
Four: SL1, SL2, SL3 and SL4, defined in IEC 62443-3-3. They correlate the countermeasures required with the strength of a potential adversary, and each zone or conduit carries a seven-element vector with one level per foundational requirement.
What are the major security standards used in the IT industry?
The ISO/IEC 27000 series, with ISO/IEC 27001 the best known, is the main international family; NIST publications are widely used alongside it. IEC 62443 is the industrial control system counterpart rather than a general IT standard.
What is the difference between ISO 27001 and IEC 62443?
ISO/IEC 27001 belongs to the ISO/IEC 27000 information security family. IEC 62443 is a multi-part series for industrial automation and control systems, covering programs, system design and component requirements. The IEC says the two can be used together.
What are the 5 C’s of cybersecurity?
It is not an IEC 62443 term. The phrase is a teaching mnemonic that circulates in several versions with no single authoritative definition, so check which list a course or document means before using it.
Sources
- IEC Systems Committee on Smart Energy, IEC 62443 (security standards and best practices), read 2026-11-07.
- IEC webstore, current editions of each part.
