Industrial Automation Cybersecurity (IEC 62443) Certification

IEC 62443 is a family of cybersecurity standards for industrial automation and control systems (IACS). It has a different priority order from IT security: in operational technology, availability and process safety come before confidentiality. The standard distributes responsibility across three roles — asset owner, system integrator and product supplier — with separate parts for each role. At its centre are the zone/conduit model and the security level (SL 1-4) concept.

• Manufacturers of industrial control systems (PLC, DCS, SCADA)
• Automation system integrators
• Operators of energy, water, chemical and manufacturing facilities
• Critical infrastructure operators
• Providers of industrial IoT and remote-monitoring solutions

The standard itself is generally not mandatory. However, critical-infrastructure and network-security regulations (e.g. NIS2 in the EU) impose security obligations on operators, and IEC 62443 is referenced in meeting these obligations. Certification is role-based: assessment is carried out under IEC 62443-4-1/4-2 for a product, 62443-2-4 for an integrator, and 62443-2-1 for an asset owner.

• 62443-2-1 — Asset owner: the IACS security programme and management system
• 62443-2-4 — Service provider: security-programme requirements for integrators
• 62443-3-2 — System design: risk assessment, zone/conduit modelling, determining the target security level
• 62443-3-3 — System security requirements: the seven foundational requirements (FRs) and security levels
• 62443-4-1 — Secure product development lifecycle: threat modelling, secure design and coding, vulnerability testing, patch management, end of support
• 62443-4-2 — Component security requirements: technical requirements for embedded devices, host devices, network devices and applications
• Foundational requirements (FRs): identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability
• Security levels: SL 1 (casual/coincidental) — SL 4 (a highly resourced, targeted attacker)

1. 1Application and Product DescriptionThe product family, model list, technical specifications and target market are determined. The applicable standard and certification route become clear at this step.
2. 2Technical File ReviewDesign documents, the bill of materials, critical-component certificates and the instructions for use are examined.
3. 3Product TestingThe tests the relevant standard requires are carried out. The test report is the fundamental basis for the certification decision.
4. 4Factory AuditIf the scheme requires it, the continuity of manufacturing and factory production control (FPC) are verified on site.
5. 5Issuing the Certificate and MarkingOnce conformity is verified, the certificate is issued; the marking rules for the product and packaging are applied.
6. 6Follow-up AuditsDepending on the scheme, periodic factory audits and/or follow-up testing on samples taken from the market are carried out.

The validity period varies by scheme: some product certificates are indefinite and rely on periodic factory audits, while some schemes (e.g. country market marks) require annual or per-shipment renewal. Every design change to the product requires the certificate to be reviewed.

• The list of product models and variants
• Technical drawings, diagrams and the bill of materials
• Certificates for critical components
• The instructions for use and a sample label
• Existing test reports, if any
• Production-site details

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The number of models and variants in the product family
• The test scope the applicable standard requires
• Whether a factory audit is required
• The number of target markets and whether each requires separate testing
• Whether existing test reports can be accepted

Product certification is carried out under ISO/IEC 17065; The tests that form the basis for certification are carried out in laboratories with ISO/IEC 17025 accreditation. The two scopes are separate. Recognition between accreditation bodies is provided through IAF and ILAC agreements.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• Common Criteria
• Cybersecurity Assessment
• ISO/IEC 27001Information Security Management
• ISO/IEC 27017Cloud Security
• ISO/IEC 27018Personal Data in the Cloud
• ISO/IEC 27701Privacy Information Management
• ISO/IEC 42001Artificial Intelligence Management System
• SOC 1Financial Reporting Controls