IEC 62443

International (IEC TC 65/WG 10 with ISA99); adopted as EN IEC 62443

vseries: 2-1 Ed 2 (2024), 2-4 Ed 2 (2023), 3-2 (2020), 3-3 (2013), 4-1 (2018), 4-2 (2019), PAS 2-2 (2025), TS 1-5 (2023), TR 2-3 (2015)

6 domains

303 controls

The ISA/IEC series for securing industrial automation and control systems across the asset owner (2-1 security program), the service provider (2-4), the system (3-2 risk assessment in 32 sub-requirements, 3-3 system requirements and security levels) and the product supplier (4-1 development lifecycle, 4-2 component requirements).

Verified

IEC 62443 is a compliance framework from International (IEC TC 65/WG 10 with ISA99); adopted as EN IEC 62443 with 6 domains and 303 controls that map to 239 other frameworks. The largest domains are IEC 62443-2-1:2024 asset owner security program requirements – IEC 62443 (87 controls), IEC 62443-4-2:2019 technical security requirements for IACS components – IEC 62443 (74 controls), IEC 62443-3-3:2013 system security requirements and security levels – IEC 62443 (51 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

IEC 62443-2-1:2024 asset owner security program requirements – IEC 62443

87 controls

Controls in the IEC 62443-2-1:2024 asset owner security program requirements – IEC 62443 domain of IEC 62443: 87 controls
Code	Title	Description
iec-62443::AVAIL 1.1	Continuity management	The asset owner shall plan for continuity of IACS operation under disruption, including security incidents, with recover...
iec-62443::AVAIL 1.2	Resource availability management	The asset owner shall manage the resources the IACS depends on (compute, network, power, personnel) so that security mea...
iec-62443::AVAIL 1.3	Failure-state	The asset owner shall define and verify the failure state of IACS components and systems under security failure, so that...
iec-62443::AVAIL 2.1	Backup	The asset owner shall back up IACS data, configuration and software at a frequency matched to the rate of change and the...
iec-62443::AVAIL 2.2	Backup non-interference	The asset owner shall ensure backups do not interfere with IACS operation.
iec-62443::AVAIL 2.3	Backup verification	The asset owner shall verify backups can be restored, by periodic restore tests.
iec-62443::AVAIL 2.4	Backup media	The asset owner shall protect backup media and storage from unauthorized access and from the same events that would dest...
iec-62443::AVAIL 2.5	Backup restoration	The asset owner shall have a restoration procedure that returns the IACS to a known secure state within the recovery obj...
iec-62443::CM 1.1	Asset inventory baseline	The asset owner shall maintain an inventory of IACS hardware and software components as a baseline, with the properties...
iec-62443::CM 1.2	Infrastructure drawings/documentation	The asset owner shall maintain current drawings and documentation of the IACS infrastructure, including network diagrams...
iec-62443::CM 1.3	Configuration settings	The asset owner shall document the security-relevant configuration settings of IACS components as a baseline and control...
iec-62443::CM 1.4	Change control	The asset owner shall control changes to the IACS through a change management process that assesses the security impact...
iec-62443::COMP 1.1	Component hardening	The asset owner shall harden IACS components according to the supplier's guidance and the zone's requirements: unnecessa...
iec-62443::COMP 1.2	Dedicated portable media	The asset owner shall control portable media used with the IACS, dedicating media to the IACS and scanning or restrictin...
iec-62443::COMP 2.1	Malware free	The asset owner shall ensure components are free of malware before they are connected to the IACS and when returned from...
iec-62443::COMP 2.2	Malware protection	The asset owner shall implement malware protection on IACS components where it is available and compatible, and compensa...
iec-62443::COMP 2.3	Malware protection software validation and installation	The asset owner shall validate malware protection software and its updates (signatures, engine versions) for compatibili...
iec-62443::COMP 3.1	Security patch authenticity/integrity	The asset owner shall verify the authenticity and integrity of security patches before installation, using the supplier'...
iec-62443::COMP 3.2	Security patch validation and installation	The asset owner shall validate security patches for compatibility with the IACS (using supplier statements and testing)...
iec-62443::COMP 3.3	Security patch status	The asset owner shall maintain the patch status of IACS components, knowing which patches are installed, which are pendi...
iec-62443::COMP 3.4	Security patching retention of security	The asset owner shall ensure that patching does not reduce the security state (settings reset, services re-enabled) and...
iec-62443::COMP 3.5	Security patch mitigation	The asset owner shall implement mitigations for vulnerabilities where patches are not available or cannot be applied, an...
iec-62443::DATA 1.1	Data classification	The asset owner shall classify IACS data by its sensitivity and criticality so that protection can be applied in proport...
iec-62443::DATA 1.2	Data confidentiality	The asset owner shall protect the confidentiality of IACS data according to its classification, in storage and in transi...
iec-62443::DATA 1.3	Safety system configuration mode	The asset owner shall control the mode in which safety systems can be configured (the key switch or equivalent), so that...
iec-62443::DATA 1.4	Data retention policy	The asset owner shall define and apply retention periods for IACS data, including logs and backups, so that data is kept...
iec-62443::DATA 1.5	Cryptographic mechanisms	The asset owner shall use cryptographic mechanisms per accepted practice where data protection requires them, selecting...
iec-62443::DATA 1.6	Key management	The asset owner shall manage cryptographic keys through their lifecycle: generation, distribution, storage, rotation and...
iec-62443::DATA 1.7	Data Integrity	The asset owner shall protect the integrity of IACS data, including configuration, logic and historian data, and detect...
iec-62443::EVENT 1.1	Event detection	The asset owner shall detect security events in the IACS through monitoring of components, networks and boundaries.
iec-62443::EVENT 1.2	Event reporting	The asset owner shall have a process by which personnel and systems report security events, so that events reach the peo...
iec-62443::EVENT 1.3	Event reporting interfaces	The asset owner shall provide interfaces (technical and organizational) for events to be reported from components and se...
iec-62443::EVENT 1.4	Logging	The asset owner shall log security-relevant events on IACS components and networks, per the zone's requirements.
iec-62443::EVENT 1.5	Log entries	The asset owner shall ensure log entries carry the content needed for investigation (time, source, user, event, outcome)...
iec-62443::EVENT 1.6	Log access	The asset owner shall protect logs from unauthorized access, modification and deletion, and give authorized personnel re...
iec-62443::EVENT 1.7	Event analysis	The asset owner shall analyse events to identify incidents and trends, with the analysis performed by people who underst...
iec-62443::EVENT 1.8	Incident handling and response	The asset owner shall have an IACS incident response plan covering detection, containment, eradication, recovery and les...
iec-62443::EVENT 1.9	Vulnerability handling	The asset owner shall have a process to receive, assess and act on vulnerability information for its IACS components, ti...
iec-62443::NET 1.1	Segmentation from non-IACS zones	The asset owner must have policies and procedures that segment the IACS from non-IACS zones and keep any interconnection...
iec-62443::NET 1.2	Documentation of zones and network zone interconnections	The asset owner shall document the zones and the interconnections between them, the conduits, with the security requirem...
iec-62443::NET 1.3	Network segmentation from safety systems	The asset owner shall segment safety instrumented systems from other IACS networks, so that a compromise of the control...
iec-62443::NET 1.4	Network autonomy	The asset owner shall ensure that the IACS keeps running when cut off from external networks, including the enterprise n...
iec-62443::NET 1.5	Network disconnection from external networks	The asset owner shall be able to cut the IACS off from external networks when required, with a defined procedure and aut...
iec-62443::NET 1.6	Internal network access control	The asset owner shall control access within the IACS network, so that only authorized devices connect and only authorize...
iec-62443::NET 1.7	Network accessible services	The asset owner shall restrict the network-accessible services in the IACS to those required, and document the ones allo...
iec-62443::NET 1.8	User messaging	The asset owner shall restrict general purpose user messaging (email, chat, web browsing) in the IACS, which the 3-3 SR...
iec-62443::NET 1.9	Network time distribution	The asset owner shall provide and protect time distribution to IACS components so that logs are correlatable and time-de...
iec-62443::NET 2.1	Wireless protocols	The asset owner shall use wireless protocols with security capabilities suitable for the zone's target level and configu...
iec-62443::NET 2.2	Wireless network segmentation	The asset owner shall segment wireless networks from wired IACS zones so that wireless access passes through a controlle...
iec-62443::NET 2.3	Wireless properties and addresses	The asset owner shall control the wireless properties and addresses used (identifiers, channels, addresses) and detect u...
iec-62443::NET 3.1	Remote access applications	The asset owner shall control the applications used for remote access to the IACS, allowing only approved ones with the...
iec-62443::NET 3.2	Remote access connections	The asset owner shall control remote access connections: who may connect, from where, with what authentication, and with...
iec-62443::NET 3.3	Remote access termination	The asset owner shall ensure remote access sessions are terminated when no longer needed, whether by timeout or manually...
iec-62443::ORG 1.1	Information security management system (ISMS)	The asset owner shall have an ISMS, or integrate the IACS security program with the organization's ISMS, so that the IAC...
iec-62443::ORG 1.2	Background checks	The asset owner shall perform background checks, consistent with law and the sensitivity of the role, on personnel who a...
iec-62443::ORG 1.3	Security roles and responsibilities	The asset owner shall define and assign security roles and responsibilities for the IACS, including the boundary between...
iec-62443::ORG 1.4	Security awareness training	The asset owner shall provide security awareness training to all personnel with access to the IACS, so that they know th...
iec-62443::ORG 1.5	Security responsibilities training	The asset owner shall provide role-specific training to personnel with IACS security responsibilities, matching the trai...
iec-62443::ORG 1.6	Supply chain security	The asset owner shall address security in its supply chain: requirements placed on service providers and product supplie...
iec-62443::ORG 2.1	Security risk mitigation	The asset owner shall assess IACS security risk, determine the mitigations needed to reduce it to a tolerable level, and...
iec-62443::ORG 2.2	Processes for discovery of security anomalies	The asset owner shall have processes to discover security anomalies in the IACS, whether by monitoring, review or audit,...
iec-62443::ORG 2.3	Secure development and support	The asset owner shall ensure that its own development and support activities on the IACS (custom applications, integrati...
iec-62443::ORG 2.4	SP reviews	The asset owner shall review the security program periodically for its effectiveness and its continued suitability, and...
iec-62443::ORG 3.1	Physical access control	The asset owner shall control physical access to the IACS and its components in proportion to the risk, since physical a...
iec-62443::USER 1.1	User identity assignment	The asset owner shall assign a unique identity to each user of the IACS, human or otherwise, so that actions are attribu...
iec-62443::USER 1.10	Mutual authentication	The asset owner shall use mutual authentication between components and services where the risk requires it, so that a co...
iec-62443::USER 1.11	Password protection	The asset owner shall protect passwords in storage and transmission, and set rules for their strength and change.
iec-62443::USER 1.12	Shared and disclosed/compromised passwords	The asset owner shall control shared passwords where they cannot be avoided (who holds them, how they are changed) and c...
iec-62443::USER 1.13	User login display information	The asset owner shall display a system use notification at login and avoid displaying information that helps an attacker...
iec-62443::USER 1.14	User login failure displays	The asset owner shall ensure that login failure messages do not reveal which part of the credential was wrong.
iec-62443::USER 1.15	Consecutive login failures	The asset owner shall limit consecutive login failures and respond (lockout or delay), without locking out operators fro...
iec-62443::USER 1.16	Session integrity	The asset owner shall protect the integrity of user sessions so that a session cannot be hijacked or replayed.
iec-62443::USER 1.17	Concurrent sessions	The asset owner shall limit concurrent sessions per user where the risk requires it.
iec-62443::USER 1.18	Screen lock	The asset owner shall apply screen locks after inactivity on IACS workstations, with an exception process for operator c...
iec-62443::USER 1.19	Component authentication	The asset owner shall ensure components authenticate to each other where the protocol and the zone level require it, usi...
iec-62443::USER 1.2	User identity removal	The asset owner shall remove user identities when no longer needed (leavers, contract end) within a defined time.
iec-62443::USER 1.3	User identity persistence	The asset owner shall ensure a removed identity is not reassigned to another person for a defined period, so that histor...
iec-62443::USER 1.4	Access rights assignment	The asset owner shall assign access rights to users based on role and need, with approval and periodic review.
iec-62443::USER 1.5	Least privilege	The asset owner shall grant users the least privilege needed for their role, on IACS components and the applications on...
iec-62443::USER 1.6	Software service authentication	The asset owner shall ensure software services and processes authenticate to the IACS with their own credentials, not sh...
iec-62443::USER 1.7	Software services interactive login rights	The asset owner shall prevent service accounts from being used for interactive login, so that a service credential canno...
iec-62443::USER 1.8	Human user authentication	The asset owner shall authenticate human users before granting access to the IACS, with the strength matched to the zone...
iec-62443::USER 1.9	Multifactor authentication (MFA)	The asset owner shall use multifactor authentication for access where the risk requires it, at minimum for remote access...
iec-62443::USER 2.1	Authorization	The asset owner shall authorize access to IACS functions and data based on the user's role, enforced by the components (...
iec-62443::USER 2.2	Separation of duties	The asset owner shall separate duties so that no single person can both make and approve critical changes, or operate an...
iec-62443::USER 2.3	Multiple approvals	The asset owner shall require multiple approvals for actions whose consequence justifies it (safety logic changes, bypas...
iec-62443::USER 2.4	Manual elevation of privileges	The asset owner shall require manual, logged elevation of privileges for administrative actions rather than standing adm...

IEC 62443-2-4:2023 service provider security program requirements – IEC 62443

12 controls

Controls in the IEC 62443-2-4:2023 service provider security program requirements – IEC 62443 domain of IEC 62443: 12 controls
Code	Title	Description
iec-62443::SP.01	Solution staffing	The service provider shall assign to the Automation Solution personnel whose security background, training and competenc...
iec-62443::SP.02	Assurance	The service provider shall provide assurance that the Automation Solution meets the asset owner's security requirements:...
iec-62443::SP.03	Architecture	The service provider shall design the Automation Solution's security architecture with the asset owner: zones and condui...
iec-62443::SP.04	Wireless	The service provider shall design, install and configure wireless communication in the Automation Solution securely, wit...
iec-62443::SP.05	Safety instrumented systems (SIS)	The service provider shall address the security of safety instrumented systems in the Automation Solution: their separat...
iec-62443::SP.06	Configuration management	The service provider shall manage how the Automation Solution is configured: a hardware and software inventory, configur...
iec-62443::SP.07	Remote access	The service provider shall implement and operate remote access to the Automation Solution under the asset owner's approv...
iec-62443::SP.08	Event management	The service provider shall configure and support the logging, monitoring and reporting of security events in the Automat...
iec-62443::SP.09	Account management	The service provider shall manage accounts in the Automation Solution during integration and maintenance: unique account...
iec-62443::SP.10	Malware protection	The service provider shall install and maintain malware protection on the Automation Solution where available, validate...
iec-62443::SP.11	Patch management	The service provider shall manage security patches for the Automation Solution: qualification of patches against the sol...
iec-62443::SP.12	Backup/restore	The service provider shall establish backup and restore for the Automation Solution: what is backed up, how often, verif...

IEC 62443-3-2:2020 security risk assessment for system design – IEC 62443

32 controls

Controls in the IEC 62443-3-2:2020 security risk assessment for system design – IEC 62443 domain of IEC 62443: 32 controls
Code	Title	Description
iec-62443::ZCR 1.1	ZCR 1.1 Identify the SUC perimeter and access points	The organization identifies the system under consideration: the collection of IACS assets needed for a complete automati...
iec-62443::ZCR 2.1	ZCR 2.1 Perform initial cyber security risk assessment	The organization carries out a first, high-level assessment of the cyber security risk the SUC presents, to establish th...
iec-62443::ZCR 3.1	ZCR 3.1 Establish zones and conduits	The organization groups the SUC's assets into zones on the basis of risk and other criteria (criticality, function, loca...
iec-62443::ZCR 3.2	ZCR 3.2 Separate business and IACS assets	IACS assets are to be grouped into zones kept logically or physically apart from business or enterprise system assets; t...
iec-62443::ZCR 3.3	ZCR 3.3 Separate safety related assets	Assets that perform safety functions are grouped into zones separate from all other zones; the IIoT paper applies the sa...
iec-62443::ZCR 3.4	ZCR 3.4 Separate temporarily connected devices	Devices that connect to the SUC only temporarily (laptops, phones, removable media) are considered for the additional ri...
iec-62443::ZCR 3.5	ZCR 3.5 Separate wireless devices	Wireless devices are grouped into zones separated from wired devices; the IIoT paper states this as a should.
iec-62443::ZCR 3.6	ZCR 3.6 Separate devices connected via external networks	Devices allowed to connect to the SUC through external networks are grouped into a separate zone or zones; the IIoT pape...
iec-62443::ZCR 4.1	ZCR 4.1 Compare initial risk to tolerable risk	The initial risk from ZCR 2.1 is compared with the organization's tolerable risk; where it is higher than the organizati...
iec-62443::ZCR 5.1	ZCR 5.1 Identify threats	For each zone and conduit, the threats that could affect it are identified from past incidents and other sources of thre...
iec-62443::ZCR 5.10	ZCR 5.10 Determine residual risk	The residual risk of each zone and conduit is determined from the updated likelihood and impact on the corporate risk ma...
iec-62443::ZCR 5.11	ZCR 5.11 Compare residual risk with tolerable risk	The residual risk of each zone and conduit is compared with the tolerable risk to decide whether additional countermeasu...
iec-62443::ZCR 5.12	ZCR 5.12 Identify additional cyber security countermeasures	Where residual risk remains above tolerance, additional cyber security countermeasures are identified (the flowchart loo...
iec-62443::ZCR 5.13	ZCR 5.13 Document and communicate results	The outcome of the detailed risk assessment is written up in a report, shared with the stakeholders concerned, and submi...
iec-62443::ZCR 5.2	ZCR 5.2 Identify vulnerabilities	For each zone and conduit, vulnerabilities are identified from vulnerability assessments, prior audits and vulnerability...
iec-62443::ZCR 5.3	ZCR 5.3 Determine consequence and impact	The consequences of each threat exploiting a vulnerability are determined and their impact rated on the organization's s...
iec-62443::ZCR 5.4	ZCR 5.4 Determine unmitigated likelihood	The likelihood of each threat materialising is determined before any countermeasure is considered, on the organization's...
iec-62443::ZCR 5.5	ZCR 5.5 Determine unmitigated cyber security risk	Likelihood and impact are combined through the corporate risk matrix into the unmitigated cyber security risk of each zo...
iec-62443::ZCR 5.6	ZCR 5.6 Determine SL-T	A target security level (SL-T) is set for each zone and conduit from its risk, using the corporate risk matrix and toler...
iec-62443::ZCR 5.7	ZCR 5.7 Compare unmitigated risk with tolerable risk	The unmitigated risk of each zone and conduit is compared with the tolerable risk to decide whether countermeasures must...
iec-62443::ZCR 5.8	ZCR 5.8 Identify and evaluate existing countermeasures	Where the unmitigated risk exceeds tolerance, the countermeasures already in place are identified and evaluated for thei...
iec-62443::ZCR 5.9	ZCR 5.9 Reevaluate likelihood and impact	Likelihood and impact are reassessed with the existing countermeasures taken into account, giving updated ratings.
iec-62443::ZCR 6.1	ZCR 6.1 Cyber security requirements specification	The organization documents a cyber security requirements specification (CRS) for the SUC, bringing together the security...
iec-62443::ZCR 6.2	ZCR 6.2 SUC description	The CRS describes the SUC so that its networks, information technology, protocols and control systems are clearly unders...
iec-62443::ZCR 6.3	ZCR 6.3 Zone and conduit drawings	Drawings showing the SUC's zones and conduits form part of the CRS.
iec-62443::ZCR 6.4	ZCR 6.4 Zone and conduit characteristics	The CRS records the characteristics of each zone and conduit, such as its name and unique identifier, lead organization,...
iec-62443::ZCR 6.5	ZCR 6.5 Operating environment assumptions	The CRS states the assumptions made about the environment in which the SUC operates.
iec-62443::ZCR 6.6	ZCR 6.6 Threat environment	The CRS describes the threat environment of the SUC, its threat sources and vectors, including sources of knowledge abou...
iec-62443::ZCR 6.7	ZCR 6.7 Organizational security policies	The CRS records the organization's security policies that apply to the SUC.
iec-62443::ZCR 6.8	ZCR 6.8 Tolerable risk	The CRS records the tolerable risk used for the SUC.
iec-62443::ZCR 6.9	ZCR 6.9 Regulatory requirements	The CRS records the regulatory requirements that apply to the SUC's cyber security.
iec-62443::ZCR 7.1	ZCR 7.1 Attain asset owner approval	The asset owner reviews and approves the results of the risk assessment and the CRS, which records acceptance of the res...

IEC 62443-3-3:2013 system security requirements and security levels – IEC 62443

51 controls

Controls in the IEC 62443-3-3:2013 system security requirements and security levels – IEC 62443 domain of IEC 62443: 51 controls
Code	Title	Description
iec-62443::SR 1.1	Human user identification and authentication	The control system must be able to identify and authenticate every human user, and enforce that on every interface that...
iec-62443::SR 1.10	Authenticator feedback	The control system shall obscure feedback of authentication information during the authentication process, so that a pas...
iec-62443::SR 1.11	Unsuccessful login attempts	The control system shall enforce a configurable limit on consecutive invalid access attempts within a time period and de...
iec-62443::SR 1.12	System use notification	The control system shall display a configurable system use notification message before granting access, warning users of...
iec-62443::SR 1.13	Access via untrusted networks	The control system must be able to monitor and control every method of access to it over untrusted networks. RE 1 requir...
iec-62443::SR 1.2	Software process and device identification and authentication	The control system shall identify and authenticate all software processes and devices, enforcing it on all interfaces th...
iec-62443::SR 1.3	Account management	The control system shall support the management of all accounts by authorized users, including adding, activating, modif...
iec-62443::SR 1.4	Identifier management	The control system must support managing identifiers per user, group, role or interface of the control system, so that e...
iec-62443::SR 1.5	Authenticator management	The control system shall initialize authenticator content, change all default authenticators on installation, change or...
iec-62443::SR 1.6	Wireless access management	The control system shall identify and authenticate every user taking part in wireless communication, whether a human, a...
iec-62443::SR 1.7	Strength of password-based authentication	For password-based authentication the control system shall enforce configurable password strength (minimum length and ch...
iec-62443::SR 1.8	Public key infrastructure (PKI) certificates	Where PKI is used, the control system shall be able either to run a PKI in line with commonly accepted best practice or...
iec-62443::SR 1.9	Strength of public key authentication	Where public key authentication is used, the control system must be able to validate a certificate's signature, validate...
iec-62443::SR 2.1	Authorization enforcement	On all interfaces the control system shall enforce authorizations assigned to all human users for controlling use of the...
iec-62443::SR 2.10	Response to audit processing failures	The control system shall alert personnel and prevent loss of essential services when an audit processing failure occurs,...
iec-62443::SR 2.11	Timestamps	The control system shall provide timestamps for audit records. RE 1 requires internal time synchronization; RE 2 require...
iec-62443::SR 2.12	Non-repudiation	It shall be possible for the control system to establish whether a particular action was performed by a given human user...
iec-62443::SR 2.2	Wireless use control	The control system shall authorize wireless connectivity, monitor it and enforce restrictions on its use, according to c...
iec-62443::SR 2.3	Use control for portable and mobile devices	The control system shall automatically enforce configurable restrictions on how portable and mobile devices are used, in...
iec-62443::SR 2.4	Mobile code	The control system shall enforce usage restrictions for mobile code (scripts, applets, macros) including preventing its...
iec-62443::SR 2.5	Session lock	The control system shall prevent further access after a configurable period of inactivity or on manual activation, keepi...
iec-62443::SR 2.6	Remote session termination	The control system shall end a remote session automatically once a configurable inactivity period has passed, or when th...
iec-62443::SR 2.7	Concurrent session control	The control system shall limit the number of concurrent sessions per interface for any given user (human, process or dev...
iec-62443::SR 2.8	Auditable events	The control system must be able to generate security-relevant audit records in eight categories: access control, request...
iec-62443::SR 2.9	Audit storage capacity	The control system shall allocate audit record storage capacity according to commonly accepted recommendations for log m...
iec-62443::SR 3.1	Communication integrity	The control system must be able to protect information against alteration while it is being transmitted. RE 1 requires c...
iec-62443::SR 3.2	Malicious code protection	The control system must be able to use protection mechanisms against malicious code and unauthorized software that preve...
iec-62443::SR 3.3	Security functionality verification	The control system shall verify the intended operation of security functions and report when anomalies are discovered, d...
iec-62443::SR 3.4	Software and information integrity	The control system shall protect software and stored information against unauthorized changes, and detect, record and re...
iec-62443::SR 3.5	Input validation	The control system shall check the syntax and the content of every input that feeds industrial process control or direct...
iec-62443::SR 3.6	Deterministic output	The control system shall drive its outputs to a predetermined state when an attack prevents normal operation from contin...
iec-62443::SR 3.7	Error handling	The control system shall identify and handle error conditions in a way that does not give attackers information that cou...
iec-62443::SR 3.8	Session integrity	The control system shall keep sessions intact, rejecting invalid session IDs. RE 1 requires invalidating session IDs at...
iec-62443::SR 3.9	Protection of audit information	The control system shall protect audit information and audit tools from unauthorized access, modification and deletion....
iec-62443::SR 4.1	Information confidentiality	The control system shall keep information confidential, both at rest and in transit, where explicit read authorization i...
iec-62443::SR 4.2	Information persistence	When components are decommissioned or taken out of active service, the control system must be able to purge from them ev...
iec-62443::SR 4.3	Use of cryptography	Where cryptography is required, the control system must use algorithms, key sizes and mechanisms for establishing and ma...
iec-62443::SR 5.1	Network segmentation	The control system must be able to separate, logically, its own networks from networks that are not part of it, and its...
iec-62443::SR 5.2	Zone boundary protection	At zone boundaries the control system shall monitor and control communications so that the compartments laid down in the...
iec-62443::SR 5.3	General purpose person-to-person communication restrictions	The control system shall block general purpose person-to-person messages (email, chat) sent in by users or systems that...
iec-62443::SR 5.4	Application partitioning	The control system shall support separating data, applications and services according to how critical they are, making a...
iec-62443::SR 6.1	Audit log accessibility	The control system shall let authorized humans and tools read audit logs without being able to change them. RE 1 require...
iec-62443::SR 6.2	Continuous monitoring	The control system shall continuously monitor how every security mechanism performs, using commonly accepted industry pr...
iec-62443::SR 7.1	Denial of service protection	When a DoS event forces the control system into a degraded mode, it shall keep its essential functions running. RE 1 req...
iec-62443::SR 7.2	Resource management	The control system shall cap how much of its resources security functions may consume, guarding against exhaustion, so t...
iec-62443::SR 7.3	Control system backup	The control system must support identifying where critical files are and backing up information at both user and system...
iec-62443::SR 7.4	Control system recovery and reconstitution	After a failure or disruption, the control system shall be capable of recovery and reconstitution back to a known secure...
iec-62443::SR 7.5	Emergency power	The control system shall move onto an emergency power supply, and back off it, without disturbing its current security s...
iec-62443::SR 7.6	Network and security configuration settings	The control system must be able to be configured to the network and security settings the supplier recommends in its gui...
iec-62443::SR 7.7	Least functionality	The control system must be able to specifically prohibit or restrict the use of functions, ports, protocols and services...
iec-62443::SR 7.8	Control system component inventory	The control system must be able to report which components are currently installed, together with their properties. The...

IEC 62443-4-1:2018 secure product development lifecycle requirements – IEC 62443

47 controls

Controls in the IEC 62443-4-1:2018 secure product development lifecycle requirements – IEC 62443 domain of IEC 62443: 47 controls
Code	Title	Description
iec-62443::DM-1	Receiving notifications of security-related issues	A process shall be employed to receive and track security-related issues reported by internal and external sources, with...
iec-62443::DM-2	Reviewing security-related issues	A process shall be employed to ensure that reported security-related issues are investigated in a timely manner to deter...
iec-62443::DM-3	Assessing security-related issues	A process shall be employed to assess each verified security-related issue for its impact and severity (using a vulnerab...
iec-62443::DM-4	Addressing security-related issues	A process shall be employed to address security-related issues in a manner consistent with their assessment: fixing, rem...
iec-62443::DM-5	Disclosing security-related issues	A process shall be employed to inform users about security-related issues in the product and their mitigations, includin...
iec-62443::DM-6	Periodic review of security defect management practice	A process shall be employed to periodically review the defect management practice for its effectiveness, including the i...
iec-62443::SD-1	Secure design principles	A process shall be employed to ensure the product design applies secure design principles: least privilege, defense in d...
iec-62443::SD-2	Defense in depth design	A process shall be employed to implement multiple layers of defense in the product design, with each layer's purpose, th...
iec-62443::SD-3	Security design review	A process shall be employed to conduct design reviews to identify, characterise and track security issues: whether the d...
iec-62443::SD-4	Secure design best practices	A process shall be employed to ensure that secure design best practices (the supplier's own catalogue, informed by indus...
iec-62443::SG-1	Product defense-in-depth	A process shall be employed to create user documentation describing the product's defense in depth strategy: the securit...
iec-62443::SG-2	Defense-in-depth measures expected in the environment	A process shall be employed to document the security measures expected in the environment in which the product is deploy...
iec-62443::SG-3	Security hardening guidelines	A process shall be employed to create user documentation describing how to harden the product: the security settings, th...
iec-62443::SG-4	Secure disposal guidelines	A process shall be employed to create user documentation describing how to remove the product from use securely, includi...
iec-62443::SG-5	Secure operation guidelines	A process shall be employed to create user documentation describing how to operate and maintain the product securely, in...
iec-62443::SG-6	Account management guidelines	A process shall be employed to create user documentation describing the accounts the product supports and how to manage...
iec-62443::SG-7	Documentation review	A process shall be employed to ensure that the security guidelines in the user documentation are reviewed and updated wi...
iec-62443::SI-1	Security implementation review	A process shall be employed to ensure that implementation reviews (code reviews and static analysis) are performed to id...
iec-62443::SI-2	Secure coding standards	A process shall be employed to ensure that secure coding standards are documented, applied and kept current for each lan...
iec-62443::SM-1	Development process	A process shall be employed for developing and maintaining the product that documents each of the practices of this stan...
iec-62443::SM-10	Custom developed components from third-party suppliers	A process shall be employed to ensure that components developed to the supplier's specification by a third party follow...
iec-62443::SM-11	Assessing and addressing security-related issues	A process shall be employed to verify that a product is not released until all security-related issues with unmitigated...
iec-62443::SM-12	Process verification	A process shall be employed to verify that the secure development process itself is being followed, through audits or re...
iec-62443::SM-13	Continuous improvement	A process shall be employed to improve the secure development process over time, using findings from process verificatio...
iec-62443::SM-2	Identification of responsibilities	The process shall identify the organizational roles and personnel responsible for each of the practices, so that every s...
iec-62443::SM-3	Identification of applicability	The process shall identify the products, and the parts of products, to which the practices apply, including third-party...
iec-62443::SM-4	Security expertise	The process shall identify the security-related training and assessment needed for personnel with responsibility for the...
iec-62443::SM-5	Process scoping	The process shall identify the parts of the practices applicable to a given product development and record the scoping d...
iec-62443::SM-6	File integrity	A process shall be employed to provide integrity verification for all scripts, executables and other files used in the p...
iec-62443::SM-7	Development environment security	A process shall be employed to protect the development environment, including the private development and test systems,...
iec-62443::SM-8	Controls for private keys	A process shall be employed to protect private keys used for code signing and product identity from unauthorized access...
iec-62443::SM-9	Security requirements for externally provided components	A process shall be used to identify every externally provided component the product relies on, including open source and...
iec-62443::SR-1	Product security context	A process shall be employed to document the intended security context of the product: the environment it is expected to...
iec-62443::SR-2	Threat model	A process shall be employed to develop and maintain a threat model for the product covering its correct usage, trust bou...
iec-62443::SR-3	Product security requirements	A process shall be employed to document the security requirements of the product, derived from the threat model, the sec...
iec-62443::SR-4	Product security requirements content	Security requirements shall include the scope and capabilities of the product, the security capability level it targets,...
iec-62443::SR-5	Security requirements review	A process shall be employed to ensure security requirements are reviewed, updated and approved by personnel with the sec...
iec-62443::SUM-1	Security update qualification	A process shall be employed to verify that security updates created by the supplier address the issue and do not introdu...
iec-62443::SUM-2	Security update documentation	A process shall be employed to ensure that documentation about a security update is available to users, describing the i...
iec-62443::SUM-3	Dependent component or operating system security update documentation	A process shall be employed to ensure that security updates for dependent components and operating systems the product u...
iec-62443::SUM-4	Security update delivery	A process shall be employed to ensure that security updates are made available to users in a manner that allows their au...
iec-62443::SUM-5	Timely delivery of security patches	A process shall be employed to define the policy for the timing of security update delivery relative to the severity of...
iec-62443::SVV-1	Security requirements testing	A process shall be employed to verify that the product's security functions meet the security requirements and that the...
iec-62443::SVV-2	Threat mitigation testing	A process shall be employed to test the effectiveness of the mitigations for the threats in the threat model, including...
iec-62443::SVV-3	Vulnerability testing	A process shall be employed to perform vulnerability testing, including abuse case testing of interfaces, attack surface...
iec-62443::SVV-4	Penetration testing	A process shall be employed to perform penetration testing on the product, based on the threat model and the attack surf...
iec-62443::SVV-5	Independence of testers	A process shall be employed to ensure that the people performing security verification and validation are independent of...

IEC 62443-4-2:2019 technical security requirements for IACS components – IEC 62443

74 controls

Controls in the IEC 62443-4-2:2019 technical security requirements for IACS components – IEC 62443 domain of IEC 62443: 74 controls
Code	Title	Description
iec-62443::CR 1.1	Human user identification and authentication	Each component must be able to identify and authenticate every human user, as SR 1.1 of 3-3 describes, on every interfac...
iec-62443::CR 1.10	Authenticator feedback	The component shall obscure feedback of authentication information during authentication. No enhancements.
iec-62443::CR 1.11	Unsuccessful login attempts	The component shall enforce a configurable limit on consecutive invalid attempts and deny access for a period or until u...
iec-62443::CR 1.12	System use notification	The component shall display a configurable system use notification before granting access, where it has a human interfac...
iec-62443::CR 1.14	Strength of symmetric key-based authentication	For symmetric key authentication the component shall establish mutual trust using the key, protect it in storage, and re...
iec-62443::CR 1.2	Software process and device identification and authentication	Each component must be able to identify itself to, and authenticate with, any other component it communicates with (whet...
iec-62443::CR 1.3	Account management	The component must support the management of accounts by authorized users, or integrate with a system-level account mana...
iec-62443::CR 1.4	Identifier management	The component shall support managing identifiers per user, group, role or interface, or else integrate with a system fun...
iec-62443::CR 1.5	Authenticator management	The component shall support the initialisation of authenticator content, changing all default authenticators on installa...
iec-62443::CR 1.7	Strength of password-based authentication	Where a component authenticates by password it must, itself or through integration with a system that does, enforce conf...
iec-62443::CR 1.8	Public key infrastructure certificates	When public key infrastructure is used, the component must be able to work and interoperate with that PKI, either itself...
iec-62443::CR 1.9	Strength of public key authentication	Where authentication is public key based, the component must, directly or through an integrated system in the same IACS...
iec-62443::CR 2.1	Authorization enforcement	The component shall enforce authorizations assigned to human users, supporting least privilege and segregation of duties...
iec-62443::CR 2.10	Response to audit processing failures	The component shall alert personnel and prevent loss of essential services on audit processing failure and provide actio...
iec-62443::CR 2.11	Timestamps	The component shall provide timestamps for audit records. RE 1 internal time synchronization (SL 2 per the ISAGCA paper)...
iec-62443::CR 2.12	Non-repudiation	If a component has a human user interface, it must be able to establish whether a given human user performed a particula...
iec-62443::CR 2.2	Wireless use control	A component with wireless capability must be able to authorize wireless connectivity, monitor it and enforce restriction...
iec-62443::CR 2.3	Use control for portable and mobile devices	The component must be able to enforce configurable usage restrictions on portable and mobile devices connected to it: wh...
iec-62443::CR 2.5	Session lock	The component shall prevent further access after a configurable inactivity period or on manual lock until re-authenticat...
iec-62443::CR 2.6	Remote session termination	The component shall end a remote session once a configurable inactivity period has passed, or when the user who started...
iec-62443::CR 2.7	Concurrent session control	The component shall limit the number of concurrent sessions per interface for any user to a configurable number, from SL...
iec-62443::CR 2.8	Auditable events	Components must be able to generate security-relevant audit records in six categories: access control, request errors, e...
iec-62443::CR 2.9	Audit storage capacity	The component shall allocate audit storage per accepted log management practice and protect against exceeding it. RE 1 w...
iec-62443::CR 3.1	Communication integrity	Components must be able to protect the integrity of the information they transmit (SL 1). RE 1, communication authentica...
iec-62443::CR 3.3	Security functionality verification	The component must be able to verify the intended operation of its security functions and report anomalies found, on dem...
iec-62443::CR 3.4	Software and information integrity	The component shall protect its software and stored information against unauthorized changes, and detect, record and rep...
iec-62443::CR 3.5	Input validation	The component shall check the syntax and the content of every input used as a process control input or that directly aff...
iec-62443::CR 3.6	Deterministic output	The component shall drive its outputs to a predetermined state when an attack prevents normal operation from continuing....
iec-62443::CR 3.7	Error handling	The component shall identify and handle error conditions without giving attackers information that could be used to expl...
iec-62443::CR 3.8	Session integrity	The component must protect the integrity of sessions and reject invalid session IDs; the ISAGCA paper places it among th...
iec-62443::CR 3.9	Protection of audit information	The component shall protect audit information and tools from unauthorized access, modification and deletion, from SL-C 2...
iec-62443::CR 4.1	Information confidentiality	Components must (a) be able to keep stored information confidential where explicit read authorization is supported for i...
iec-62443::CR 4.2	Information persistence	When released from service, the component shall purge every item of information that supports explicit read authorizatio...
iec-62443::CR 4.3	Use of cryptography	Where cryptography is required, the component must use cryptographic security mechanisms that follow recommendations and...
iec-62443::CR 5.1	Network segmentation	The component must support a segmented network, through its interfaces and configuration, so that zones and conduits, la...
iec-62443::CR 6.1	Audit log accessibility	The component shall provide the capability for authorized humans and tools to access audit logs read-only. RE 1 programm...
iec-62443::CR 6.2	Continuous monitoring	The component shall be able to be monitored continuously, by accepted practice, so that security breaches are detected,...
iec-62443::CR 7.1	Denial of service protection	Components must be able to keep their essential functions running in a degraded mode when a denial of service event occu...
iec-62443::CR 7.2	Resource management	Components must be able to limit the resources that security functions consume, so that the functions cannot exhaust the...
iec-62443::CR 7.3	Control system backup	Components must be able to take part in system-level backup operations that safeguard their state (user-level and system...
iec-62443::CR 7.4	Control system recovery and reconstitution	After a failure or disruption, components must be capable of recovery and reconstitution back to a known secure state (S...
iec-62443::CR 7.6	Network and security configuration settings	The component shall be configurable in line with the network and security configuration guidelines its supplier recommen...
iec-62443::CR 7.7	Least functionality	Components must be able to specifically restrict the use of functions, ports, protocols and services that are not needed...
iec-62443::CR 7.8	Control system component inventory	The component shall support a system-level inventory by reporting its identity and properties, from SL-C 2 per the ISAGC...
iec-62443::EDR 2.13	Use of physical diagnostic and test interfaces (embedded device)	An embedded device shall protect against unauthorized use of its physical factory diagnostic and test interfaces (JTAG,...
iec-62443::EDR 2.4	Mobile code (embedded device)	An embedded device shall enforce usage restrictions on mobile code it can execute (prevent, authenticate and authorize,...
iec-62443::EDR 3.10	Support for updates (embedded device)	An embedded device must support being updated and upgraded (SL 1). RE 1, update authenticity and integrity (SL 2): befor...
iec-62443::EDR 3.11	Physical tamper resistance and detection (embedded device)	An embedded device shall have mechanisms that resist and detect tampering, guarding it against physical access by anyone...
iec-62443::EDR 3.12	Provisioning product supplier roots of trust (embedded device)	When the embedded device is manufactured, it must be able to take on the product supplier's keys and data that act as it...
iec-62443::EDR 3.13	Provisioning asset owner roots of trust (embedded device)	An embedded device shall be able to provision the asset owner's roots of trust and keep them protected, so the owner can...
iec-62443::EDR 3.14	Integrity of the boot process (embedded device)	An embedded device shall verify the integrity of its firmware, software and configuration during the boot process using...
iec-62443::EDR 3.2	Protection from malicious code (embedded device)	An embedded device must provide protection from malicious code through means the supplier documents (such as allow-listi...
iec-62443::HDR 2.13	Use of physical diagnostic and test interfaces (host device)	A host device shall protect its physical diagnostic and test interfaces against unauthorized use; RE 1 adds active monit...
iec-62443::HDR 2.4	Mobile code (host device)	A host device shall enforce usage restrictions on mobile code; RE 1 adds a check that mobile code is authentic. Mirrors...
iec-62443::HDR 3.10	Support for updates (host device)	A host device shall support updates and upgrades; RE 1 update authenticity verification. The identifier is named in the...
iec-62443::HDR 3.11	Physical tamper resistance and detection (host device)	A host device shall resist tampering and detect it; RE 1 adds notification when tampering occurs. The identifier is name...
iec-62443::HDR 3.12	Provisioning product supplier roots of trust (host device)	When the host device is manufactured, it must be able to take on the product supplier's keys and data that act as its ro...
iec-62443::HDR 3.13	Provisioning asset owner roots of trust (host device)	A host device shall be able to provision the asset owner's roots of trust and keep them protected. The identifier is nam...
iec-62443::HDR 3.14	Integrity of the boot process (host device)	A host device shall verify the integrity of its boot process using the roots of trust; RE 1 adds verification that the b...
iec-62443::HDR 3.2	Protection from malicious code (host device)	A host device shall provide protection from malicious code and support updating that protection; RE 1 report the protect...
iec-62443::NDR 1.13	Access via untrusted networks (network device)	A network device shall be able to monitor and control every way in which it can be accessed over untrusted networks; RE...
iec-62443::NDR 1.6	Wireless access management (network device)	A network device supporting wireless shall identify and authenticate all users (humans, processes, devices) engaged in w...
iec-62443::NDR 2.13	Use of physical diagnostic and test interfaces (network device)	A network device shall protect its physical diagnostic and test interfaces against unauthorized use; RE 1 adds active mo...
iec-62443::NDR 2.4	Mobile code (network device)	A network device shall enforce usage restrictions on mobile code it can execute or transfer; RE 1 integrity check. The i...
iec-62443::NDR 3.10	Support for updates (network device)	A network device shall support updates and upgrades; RE 1 update authenticity. The identifier is named in the IIC SMM ma...
iec-62443::NDR 3.11	Physical tamper resistance and detection (network device)	A network device shall resist tampering and detect it; RE 1 adds notification. The identifier is named in the IIC SMM ma...
iec-62443::NDR 3.12	Provisioning product supplier roots of trust (network device)	When the network device is manufactured, it must be able to take on the product supplier's keys and data that act as its...
iec-62443::NDR 3.13	Provisioning asset owner roots of trust (network device)	A network device shall be able to provision the asset owner's roots of trust and keep them protected. The identifier is...
iec-62443::NDR 3.14	Integrity of the boot process (network device)	A network device shall verify the integrity of its boot process; RE 1 adds verification that the boot is authentic. The...
iec-62443::NDR 3.2	Protection from malicious code (network device)	A network device must provide protection from malicious code, with the supplier documenting the means. No enhancement: t...
iec-62443::NDR 5.2	Zone boundary protection (network device)	A network device placed on a zone boundary must monitor and control communications at that boundary to enforce the zones...
iec-62443::NDR 5.3	General purpose person-to-person communication restrictions (network device)	A network device shall be able to block general purpose person-to-person messages arriving from users or systems outside...
iec-62443::SAR 2.4	Mobile code (software application)	A software application shall enforce usage restrictions on mobile code it can execute; RE 1 mobile code integrity check....
iec-62443::SAR 3.2	Protection from malicious code (software application)	For a software application, the product supplier must qualify and document which protection mechanisms against malicious...

Your Compliance Coverage

If you comply with IEC 62443, you already cover:

EU Cyber Resilience Act

30 controls mapped

Compare →

ISO 27002:2022

28 controls mapped

Compare →

IEEE 1686

17 controls mapped

Compare →

+ 236 more: API 1164 (4%), NIST SP 1800-32 (4%)

See all 239 mapped frameworks ↓

Maps to 239 other frameworks

385 total controls

EU Cyber Resilience Act

30 source controls mapped|24 target controls covered

ISO 27002:2022

28 source controls mapped|21 target controls covered

IEEE 1686

17 source controls mapped|6 target controls covered

API 1164

17 source controls mapped|16 target controls covered

NIST SP 1800-32

17 source controls mapped|16 target controls covered

ISO/IEC 27019:2024

17 source controls mapped|16 target controls covered

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

15 source controls mapped|6 target controls covered

NIST SP 800-53 Rev 5

13 source controls mapped|19 target controls covered

South Korea ISMS-P

13 source controls mapped|10 target controls covered

NERC CIP

12 source controls mapped|3 target controls covered

ISO/IEC 27010:2015

12 source controls mapped|7 target controls covered

NIST Privacy Framework

12 source controls mapped|4 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

12 source controls mapped|5 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

12 source controls mapped|8 target controls covered

BSI IT-Grundschutz

12 source controls mapped|12 target controls covered

ISO/IEC 27011:2024

11 source controls mapped|7 target controls covered

TISAX - Trusted Information Security Assessment Exchange

11 source controls mapped|7 target controls covered

MTCS (Singapore)

11 source controls mapped|5 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

11 source controls mapped|7 target controls covered

Annex 11 to EU GMP - Computerised Systems

11 source controls mapped|5 target controls covered

UK Security and Emergency Measures Direction (SEMD) - Water Industry

11 source controls mapped|5 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

10 source controls mapped|8 target controls covered

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments

10 source controls mapped|4 target controls covered

NIST Cybersecurity Framework 2.0

10 source controls mapped|14 target controls covered

ISO 28001:2007 Supply Chain Security Management

10 source controls mapped|4 target controls covered

UK Telecommunications (Security) Act 2021

10 source controls mapped|4 target controls covered

Oman National Cybersecurity Framework

10 source controls mapped|5 target controls covered

NIST SP 800-146

10 source controls mapped|4 target controls covered

NIST SP 800-145

10 source controls mapped|4 target controls covered

NIST SP 800-144

10 source controls mapped|6 target controls covered

ISMAP (Japan)

10 source controls mapped|4 target controls covered

NIST SP 800-190

10 source controls mapped|9 target controls covered

MITRE ATT&CK

9 source controls mapped|3 target controls covered

SLSA

9 source controls mapped|3 target controls covered

SIG (Shared Assessments)

9 source controls mapped|2 target controls covered

PTES

9 source controls mapped|4 target controls covered

OWASP SAMM

9 source controls mapped|2 target controls covered

OWASP MASVS

9 source controls mapped|5 target controls covered

OpenSSF Scorecard

9 source controls mapped|4 target controls covered

NIST SP 800-92

9 source controls mapped|5 target controls covered

NIST SP 800-88

9 source controls mapped|4 target controls covered

NIST SP 800-63-4

9 source controls mapped|5 target controls covered

NIST SP 800-61 Rev. 3

9 source controls mapped|2 target controls covered

NIST SP 800-137

9 source controls mapped|3 target controls covered

NIST SP 800-123

9 source controls mapped|4 target controls covered

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)

9 source controls mapped|1 target controls covered

ISO/IEC 27043:2015

9 source controls mapped|7 target controls covered

ISO/SAE 21434

9 source controls mapped|7 target controls covered

UK Gambling Commission LCCP and Remote Technical Standards

9 source controls mapped|1 target controls covered

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4)

9 source controls mapped|5 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

9 source controls mapped|6 target controls covered

SOC for Cybersecurity - Cybersecurity Risk Management Examination

9 source controls mapped|8 target controls covered

ISO/IEC 20000-1:2018

9 source controls mapped|4 target controls covered

ITIL 4

9 source controls mapped|4 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

8 source controls mapped|4 target controls covered

APRA CPS 230 Operational Risk Management

8 source controls mapped|7 target controls covered

Security of Critical Infrastructure Act 2018 (SOCI)

8 source controls mapped|8 target controls covered

TSA Pipeline Cybersecurity Directives

8 source controls mapped|2 target controls covered

NAIC Insurance Data Security Model Law (MDL-668)

8 source controls mapped|3 target controls covered

Canada ITSG-33 - IT Security Risk Management

8 source controls mapped|1 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

7 source controls mapped|16 target controls covered

FBI CJIS Security Policy

7 source controls mapped|4 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

7 source controls mapped|7 target controls covered

PSD2 SCA

7 source controls mapped|4 target controls covered

OSFI B-13

7 source controls mapped|5 target controls covered

Open Banking Security

7 source controls mapped|4 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

7 source controls mapped|3 target controls covered

Monetary Authority of Singapore Technology Risk Management Guidelines

7 source controls mapped|5 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

7 source controls mapped|2 target controls covered

FFIEC IT Examination Handbook

7 source controls mapped|9 target controls covered

PCI P2PE

7 source controls mapped|9 target controls covered

PCI PIN Security

7 source controls mapped|9 target controls covered

PCI SSF

7 source controls mapped|9 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

7 source controls mapped|10 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

7 source controls mapped|2 target controls covered

Virginia CDPA

7 source controls mapped|1 target controls covered

Vietnam PDPD

7 source controls mapped|2 target controls covered

Uruguay DPL

7 source controls mapped|3 target controls covered

Turkey KVKK

7 source controls mapped|2 target controls covered

Texas Data Privacy and Security Act (TDPSA)

7 source controls mapped|2 target controls covered

Taiwan PDPA

7 source controls mapped|1 target controls covered

Qatar DPL

7 source controls mapped|3 target controls covered

Privacy Act 2020

7 source controls mapped|3 target controls covered

POPIA

7 source controls mapped|2 target controls covered

Personal Data Act (personopplysningsloven)

7 source controls mapped|3 target controls covered

PDPA Thailand

7 source controls mapped|3 target controls covered

PDPA Singapore

7 source controls mapped|3 target controls covered

Oregon Consumer Privacy Act

7 source controls mapped|2 target controls covered

NIST SP 800-122

7 source controls mapped|3 target controls covered

Nigeria Data Protection Regulation (NDPR)

7 source controls mapped|1 target controls covered

Nigeria Data Protection Act 2023 (NDPA)

7 source controls mapped|5 target controls covered

Nebraska Data Privacy Act

7 source controls mapped|5 target controls covered

New Jersey Data Privacy Act

7 source controls mapped|3 target controls covered

New Hampshire Data Privacy Act

7 source controls mapped|2 target controls covered

Montana Consumer Data Privacy Act

7 source controls mapped|2 target controls covered

Minnesota Consumer Data Privacy Act

7 source controls mapped|2 target controls covered

Mexico LFPDPPP

7 source controls mapped|2 target controls covered

Mauritius DPA

7 source controls mapped|2 target controls covered

Maryland Online Data Privacy Act of 2024

7 source controls mapped|3 target controls covered

Malaysia PDPA 2010

7 source controls mapped|3 target controls covered

Liechtenstein DPA

7 source controls mapped|2 target controls covered

LGPD

7 source controls mapped|2 target controls covered

South Korea PIPA

7 source controls mapped|3 target controls covered

Kentucky Consumer Data Protection Act

7 source controls mapped|3 target controls covered

Jamaica Data Protection Act 2020

7 source controls mapped|4 target controls covered

Indiana Consumer Data Protection Act

7 source controls mapped|2 target controls covered

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)

7 source controls mapped|1 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

7 source controls mapped|3 target controls covered

Bahrain PDPL

7 source controls mapped|4 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

7 source controls mapped|6 target controls covered

ISO/IEC 27400:2022

7 source controls mapped|3 target controls covered

Saudi Arabia PDPL

7 source controls mapped|4 target controls covered

SOC 2

7 source controls mapped|6 target controls covered

German Supply Chain Due Diligence Act (LkSG)

6 source controls mapped|4 target controls covered

EASA Part-IS - Information Security in Aviation

6 source controls mapped|8 target controls covered

ISO/TS 22317:2021

6 source controls mapped|3 target controls covered

Sigstore - Software Artifact Signing and Verification

6 source controls mapped|2 target controls covered

ISO/TS 22318:2021

6 source controls mapped|3 target controls covered

ISO 22316

6 source controls mapped|3 target controls covered

Peru DPL

6 source controls mapped|2 target controls covered

Barbados Data Protection Act 2019

6 source controls mapped|2 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

6 source controls mapped|3 target controls covered

APPI

6 source controls mapped|3 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

6 source controls mapped|4 target controls covered

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties

6 source controls mapped|6 target controls covered

UK FCA/PRA Operational Resilience Framework

5 source controls mapped|2 target controls covered

SASB Standards

5 source controls mapped|8 target controls covered

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update)

5 source controls mapped|1 target controls covered

O-RAN WG11 Security Specification

5 source controls mapped|2 target controls covered

New Zealand Information Security Manual (NZISM)

5 source controls mapped|3 target controls covered

IRM/AIRMIC/ALARM A Risk Management Standard (2002)

5 source controls mapped|2 target controls covered

French Sapin II Law (Law No. 2016-1691)

5 source controls mapped|2 target controls covered

SQF Code Edition 9 - Safe Quality Food

5 source controls mapped|2 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

5 source controls mapped|5 target controls covered

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process

5 source controls mapped|6 target controls covered

ISO/IEC 27003:2017

5 source controls mapped|4 target controls covered

ISO/IEC 23894:2023

5 source controls mapped|7 target controls covered

UK GDPR (UK General Data Protection Regulation)

5 source controls mapped|1 target controls covered

Nigeria Open Banking Regulatory Framework (CBN, 2023)

5 source controls mapped|2 target controls covered

ISO/IEC 27031:2011

5 source controls mapped|4 target controls covered

FedRAMP Rev 5

5 source controls mapped|3 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

5 source controls mapped|3 target controls covered

AICPA Privacy Management Framework (PMF)

5 source controls mapped|2 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

5 source controls mapped|4 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

5 source controls mapped|3 target controls covered

UK AI Regulation Framework

4 source controls mapped|1 target controls covered

OECD AI Principles

4 source controls mapped|2 target controls covered

Japan AI Guidelines

4 source controls mapped|5 target controls covered

IEEE 7000

4 source controls mapped|2 target controls covered

FDA Quality Management System Regulation (QMSR)

4 source controls mapped|2 target controls covered

AS9100D - Aerospace Quality Management System

4 source controls mapped|2 target controls covered

APRA CPS 234

4 source controls mapped|4 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

4 source controls mapped|5 target controls covered

21 CFR Part 211 - Current Good Manufacturing Practice

4 source controls mapped|4 target controls covered

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model

4 source controls mapped|2 target controls covered

ISO 22320:2018

4 source controls mapped|4 target controls covered

Telecommunications Sector Security Reforms (TSSR)

4 source controls mapped|2 target controls covered

Voluntary Principles on Security and Human Rights (VPs)

4 source controls mapped|1 target controls covered

Laos Law on Prevention and Combating Cybercrime (2015)

4 source controls mapped|2 target controls covered

Japan FSA Cybersecurity Guidelines for Financial Institutions

4 source controls mapped|2 target controls covered

ISO/IEC 30111:2019

4 source controls mapped|4 target controls covered

NIST SP 800-66

4 source controls mapped|4 target controls covered

MDS2 (Medical Device)

4 source controls mapped|4 target controls covered

MARS-E

4 source controls mapped|5 target controls covered

ISO 27799:2025

4 source controls mapped|4 target controls covered

SEC Climate Disclosure Rule

3 source controls mapped|1 target controls covered

SA8000:2014 - Social Accountability Standard

3 source controls mapped|1 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

3 source controls mapped|2 target controls covered

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act

3 source controls mapped|2 target controls covered

OWASP Top 10 for LLM Applications 2025

3 source controls mapped|1 target controls covered

NIST SP 800-39

3 source controls mapped|3 target controls covered

NIST SP 800-37

3 source controls mapped|4 target controls covered

NIST SP 800-30

3 source controls mapped|6 target controls covered

Modern Slavery Act 2018 (Australia)

3 source controls mapped|2 target controls covered

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards

3 source controls mapped|2 target controls covered

ICH Q10 - Pharmaceutical Quality System

3 source controls mapped|3 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

3 source controls mapped|7 target controls covered

IAIS Insurance Core Principles (ICPs)

3 source controls mapped|4 target controls covered

Space ISAC (Information Sharing and Analysis Center) - Threat Framework

3 source controls mapped|1 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

3 source controls mapped|3 target controls covered

AML/CTF Act 2006 (Australia)

3 source controls mapped|2 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

3 source controls mapped|3 target controls covered

Solvency II

3 source controls mapped|4 target controls covered

ISO 50001:2018 - Energy Management Systems

3 source controls mapped|1 target controls covered

ISO 41001:2018 - Facility Management Systems

3 source controls mapped|1 target controls covered

ISO 20400:2017 - Sustainable Procurement

3 source controls mapped|4 target controls covered

APRA SPS 220 Risk Management (Superannuation)

3 source controls mapped|2 target controls covered

BREEAM - Building Research Establishment Environmental Assessment Method

3 source controls mapped|1 target controls covered

Kuwait National Cybersecurity Framework

3 source controls mapped|1 target controls covered

Protective Security Policy Framework (PSPF) Release 2026

3 source controls mapped|1 target controls covered

ISO 26000:2010

3 source controls mapped|1 target controls covered

Trinidad and Tobago Data Protection Act 2011

3 source controls mapped|1 target controls covered

Tanzania Personal Data Protection Act 2022

3 source controls mapped|1 target controls covered

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

3 source controls mapped|1 target controls covered

Nevada Gaming Control Board Cybersecurity Requirements

3 source controls mapped|1 target controls covered

NABERS - National Australian Built Environment Rating System

3 source controls mapped|1 target controls covered

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

3 source controls mapped|3 target controls covered

COSO Internal Control - Integrated Framework (2013)

3 source controls mapped|1 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

3 source controls mapped|1 target controls covered

UK Open Banking Standard

3 source controls mapped|1 target controls covered

ITU-T X.805 - Security Architecture for End-to-End Communications

3 source controls mapped|1 target controls covered

IATA Operational Safety Audit (IOSA) Standards Manual

3 source controls mapped|1 target controls covered

IEC 62351 - Power Systems Communication Security

3 source controls mapped|1 target controls covered

US ITAR and EAR - Export Control and Data Security

3 source controls mapped|1 target controls covered

FedRAMP High

3 source controls mapped|4 target controls covered

FedRAMP Moderate

3 source controls mapped|4 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

2 source controls mapped|4 target controls covered

Secure by Design: A Guide for Manufacturers (CISA)

2 source controls mapped|1 target controls covered

UNICEF Policy Guidance on AI for Children (2021)

2 source controls mapped|1 target controls covered

UNESCO Recommendation on the Ethics of AI

2 source controls mapped|2 target controls covered

ISO/IEC 29147:2018

2 source controls mapped|1 target controls covered

GDPR

2 source controls mapped|1 target controls covered

ISO/IEC 29134:2023

2 source controls mapped|3 target controls covered

UK Modern Slavery Act 2015

2 source controls mapped|1 target controls covered

ISO 22000:2018

2 source controls mapped|1 target controls covered

Singapore Cybersecurity Act 2018

2 source controls mapped|1 target controls covered

UK Age Appropriate Design Code (Children's Code)

2 source controls mapped|1 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

2 source controls mapped|1 target controls covered

OECD Recommendation on Artificial Intelligence (2024 Update)

1 source controls mapped|1 target controls covered

OCC Heightened Standards (12 CFR Part 30, Appendix D)

1 source controls mapped|2 target controls covered

Aged Care Quality Standards 2019 (repealed edition)

1 source controls mapped|1 target controls covered

Singapore AI Governance Framework

1 source controls mapped|1 target controls covered

BS 65000:2014 - Guidance on Organizational Resilience

1 source controls mapped|2 target controls covered

MiFID II / MiFIR

1 source controls mapped|1 target controls covered

Kids Online Safety Act (KOSA)

1 source controls mapped|1 target controls covered

UK Online Safety Act 2023

1 source controls mapped|2 target controls covered

ISO 37001:2016

1 source controls mapped|1 target controls covered

ISO 45001:2018

1 source controls mapped|2 target controls covered

ISO 55001:2014

1 source controls mapped|1 target controls covered

NSA Guidance for Transition to Quantum-Resistant Cryptography

1 source controls mapped|1 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

1 source controls mapped|1 target controls covered

Myanmar Cybersecurity Law (2023)

1 source controls mapped|1 target controls covered

Florida Digital Bill of Rights (FDBR)

1 source controls mapped|1 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

1 source controls mapped|1 target controls covered

ISO/IEC 27006-1:2024

1 source controls mapped|1 target controls covered

US SEC Digital Assets and Crypto Regulatory Framework

1 source controls mapped|1 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

ISO 9001:2015

1 source controls mapped|1 target controls covered

ISO 30401

1 source controls mapped|1 target controls covered

Compare IEC 62443 with EU Cyber Resilience Act

Coverage is not the same as your position

This page shows what IEC 62443 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is IEC 62443 and who does it apply to?

IEC 62443 is a compliance framework from International (IEC TC 65/WG 10 with ISA99); adopted as EN IEC 62443 with 6 domains and 303 controls. The ISA/IEC series for securing industrial automation and control systems across the asset owner (2-1 security program), the service provider (2-4), the system (3-2 risk assessment in 32 sub-requirements, 3-3 system requirements and security levels) and the product supplier (4-1 development lifecycle, 4-2 component requirements). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does IEC 62443 actually require?

IEC 62443 has 303 controls organised across 6 domains. The largest domains are IEC 62443-2-1:2024 asset owner security program requirements – IEC 62443 (87 controls), IEC 62443-4-2:2019 technical security requirements for IACS components – IEC 62443 (74 controls), IEC 62443-3-3:2013 system security requirements and security levels – IEC 62443 (51 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of IEC 62443 do I already cover?

IEC 62443 maps to 239 other compliance frameworks. The top mapping partners are EU Cyber Resilience Act (8% coverage), ISO 27002:2022 (7% coverage), IEEE 1686 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement IEC 62443?

Start your IEC 62443 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about IEC 62443 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 303 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required