IEC 62443: OT Cybersecurity Explained for IT Teams

IEC 62443 is the international standard for cybersecurity in industrial control systems (ICS). Critical for plants, utilities, infrastructure. Parallels ISO 27001 for IT but adapted to OT specifics: safety, realtime, legacy equipment. With NIS2 push, companies with OT must master this. This article is an IT-team-friendly overview.

Why IT Teams Should Know

IT/OT convergence: blurred lines.
NIS2 obliges many companies to integrate OT security.
Coordination: IT cybersecurity must align with OT.
Audit: IT teams increasingly audit OT.

IEC 62443 Structure

Series of standards:

62443-1-x: general (terminology, concepts).
62443-2-x: policies and procedures.
62443-3-x: system requirements.
62443-4-x: component requirements.

Comprehensive.

Zones and Conduits

Core concept: segment networks into zones, connect via conduits:

Zone: group of assets with similar security requirements.
Conduit: network path between zones with defined security.
Trust boundaries: explicit.

Similar to IT DMZ but formalised.

Purdue Model

Reference architecture:

Level 0: sensors, actuators.
Level 1: PLCs, RTUs.
Level 2: SCADA, HMI.
Level 3: manufacturing operations (MES).
Level 3.5: DMZ.
Level 4-5: enterprise IT.

IEC 62443 conceptually incorporates Purdue.

Security Levels (SL)

62443 defines 4 SLs:

SL 1: protection against casual/inadvertent.
SL 2: intentional with simple means.
SL 3: intentional with sophisticated means.
SL 4: intentional sophisticated + extensive resources.

Assess zone SL target, implement matching controls.

Roles

Framework distinguishes:

Asset owner: operates system.
System integrator: builds.
Product supplier: makes components.

Each has distinct obligations. Clear responsibility separation.

Foundational Requirements

7 foundational requirements (FRs):

Identification and Authentication Control (IAC).
Use Control (UC).
System Integrity (SI).
Data Confidentiality (DC).
Restricted Data Flow (RDF).
Timely Response to Events (TRE).
Resource Availability (RA).

Basis for all assessments.

Security Program (CSMS)

Cybersecurity Management System (CSMS):

Risk assessment.
Security program definition.
Implementation.
Maintenance.
Improvement.

Similar ISO 27001 ISMS but OT-focused.

Certification

Available certifications:

IEC 62443-2-4: system integrator.
IEC 62443-3-3: system.
IEC 62443-4-1: secure development lifecycle.
IEC 62443-4-2: component.

Industry demands increasingly.

vs ISO 27001

Comparative:

Aspect	IEC 62443	ISO 27001
Focus	OT / industrial	IT / info security
Safety	Critical	Not primary
Legacy equipment	Handles	Less
Realtime	Considered	No
Certifications	Multiple	ISMS
Complementary	Yes	Yes

Use both: ISO 27001 enterprise, 62443 OT zones.

NIS2 Alignment

NIS2 mandates OT security. 62443:

Recognised framework.
Compliance evidence with NIS2.
Risk management: 62443 provides methodology.

62443 adoption accelerates NIS2 compliance.

IT-OT Coordination

Where IT teams help OT:

Network segmentation via VLANs, firewalls.
Monitoring: SIEM ingests OT logs.
Incident response procedure alignment.
Patch management: different cadence but coordinated.
Identity management: across domains.

Where IT shouldn’t: don’t change OT without understanding impact.

Common IT Mistakes

Patch aggressively: OT patches require coordination with safety.
Rolling updates: OT systems may require specific windows.
IT-grade crypto: OT may need lighter (realtime constraints).
“IT best practices” blindly applied: may break OT.

Respect OT expertise.

Relevant Technologies

Industrial firewalls: Moxa, Hirschmann.
Data diodes: unidirectional for critical.
Industrial IDS: Claroty, Nozomi, Dragos.
SIEM OT integration: Splunk, QRadar OT modules.
OT patch management: specialised tools.

Specific tech stack.

Implementation Phases

Typical org journey:

Asset inventory OT (often poor).
Zone/conduit diagram.
Risk assessment.
Gap analysis vs 62443.
Control implementation priorities.
Continuous improvement.

Typically years-long.

Budget Considerations

Consultancy: expert analysis.
Tech stack: firewalls, IDS, monitoring.
Training: OT + IT cross-pollination.
Certification: if pursued.

Significant but justified vs incident cost.

Recent Updates

IEC 62443-2-1: 2024 update.
Cloud OT: emerging considerations.
Wireless: private 5G integration.
Remote access: vendor access management.

Evolving standard.

Integration with Other Frameworks

NIST CSF: complementary, US-centric.
ISO 27001: ISMS layer.
NERC CIP: North American utility.
CIS Controls: tactical guidance.

Most enterprises mix.

Conclusion

IEC 62443 is serious framework for OT cybersecurity. For IT teams in companies with industrial operations, understanding is essential. IT/OT convergence + NIS2 push force this. Not “adopt everything overnight” — years-long gradual journey. IT teams contribute: segmentation, monitoring, incident response. OT teams own: actual OT operations, specific controls. Coordination matters. With increasing industrial attacks (Colonial Pipeline, Oldsmar, others), this isn’t theoretical — urgent.