IEC 62443 and OT cybersecurity

IEC 62443 is a series of standards for the security of industrial automation and control systems. It is written for asset owners, system integrators and product suppliers, and it assumes an environment where availability and safety come first.

Why OT is not IT with different cables

In an office environment, the usual answer to a vulnerable system is to patch it. In an industrial environment, the system may control a physical process, may be certified in its current configuration, may have a maintenance window measured in hours per year, and may run software the vendor no longer updates. Applying an IT playbook unchanged can remove a safety function or stop production.

The classic security triad is also reordered. Confidentiality usually leads in IT. In OT, availability and integrity lead, because the consequence of failure is physical rather than informational.

Zones and conduits

The organising idea in IEC 62443 is to divide the system into zones — groupings of assets with common security requirements — and to define conduits for the communication between them. Each zone is assigned a target security level based on the risk it carries.

This is more useful than it first appears. It converts "secure the plant" into a set of bounded questions: what is in this zone, what must cross this conduit, and what security level does the risk justify? It also makes compensating controls explicit, which matters when patching is not available.

Security levels

The standard defines security levels describing the capability an attacker would need to defeat the protection — from casual or coincidental violation through to a well-resourced actor with system-specific skills. Assigning a target level per zone forces a conversation about what you are actually defending against, rather than applying uniform controls everywhere.

Shared responsibility

IEC 62443 divides obligations between the asset owner, the integrator who builds the solution, and the supplier who develops the product. This matters commercially: security requirements belong in procurement and integration contracts, not only in your own operating procedures. Requiring 62443-aligned development practice from suppliers is a control you can apply at purchase time.

Starting without disruption

An accurate asset inventory and a network diagram that reflects reality come first, and both are often absent. From there, passive monitoring establishes a traffic baseline without touching the process. Zone and conduit definition can then be done on paper, and segmentation implemented during planned maintenance rather than against it.