IEC 62443 SAR 3.2: Protection from malicious code (software application)

What does SAR 3.2 require?

For a software application, the product supplier must qualify and document which protection mechanisms against malicious code are compatible with the application, and record any special configuration those mechanisms need (SL 1). No enhancement; the IIC list gives none for SAR 3.2.