IEC 62443 Explained: Zones, Conduits and Security Levels

ISA/IEC 62443 is the most widely referenced cybersecurity standard for industrial automation and control systems (IACS). Regulators cite it, insurers ask about it and procurement teams write it into contracts. It can also look intimidating: it is a series of documents, not a single standard, and it uses its own vocabulary. This guide explains the parts that matter most to an operator.

Who IEC 62443 is for

Unlike many security standards, IEC 62443 is written for everyone who touches an industrial system, and gives each a role:

• Asset owners operate the system and are responsible for its security over its whole life.
• Service providers and system integrators design, install and maintain it.
• Product suppliers build the controllers, software and network devices that go into it.

Security is shared between them. An asset owner cannot reach a high security level with components that were never designed for it, and a well-designed product can still be deployed insecurely.

How the series is organized

The documents are grouped into four parts:

1. General (62443-1-x): concepts, terminology and models used throughout the series.
2. Policies and procedures (62443-2-x): how an asset owner runs a security program (2-1), manages patches (2-3) and what it should require of its service providers (2-4).
3. System (62443-3-x): how to assess risk and divide a system into zones and conduits (3-2), and the technical security requirements a system must meet at each security level (3-3).
4. Component (62443-4-x): how suppliers develop secure products (4-1), and the technical requirements for individual components such as controllers and network devices (4-2).

For most operators, 2-1, 3-2 and 3-3 are where the work starts.

Zones and conduits

The central idea of IEC 62443 is that not every part of a system needs the same protection.

A zone is a group of assets, physical or logical, that share the same security requirements. The safety instrumented system of a refinery might be one zone; the basic process control system another; the site historian and its servers a third.

A conduit is the path between zones: the network connections, protocols and devices that carry traffic from one to the other. Conduits have security requirements too, defining what may cross, in which direction and how it is protected.

If this sounds like network segmentation, it is, with a risk assessment behind it. The Purdue model is a common starting point for drawing zones, though IEC 62443 asks you to group by risk and function, not just by level.

Security levels

Each zone is assigned a security level that describes the strength of attacker it must withstand:

• SL 1: protection against casual or coincidental violation, such as an accidental change.
• SL 2: protection against intentional violation using simple means, few resources, generic skills and low motivation.
• SL 3: protection against intentional violation using sophisticated means, moderate resources, skills specific to industrial systems and moderate motivation.
• SL 4: protection against intentional violation using sophisticated means, extensive resources, specific skills and high motivation.

The standard distinguishes three versions of the same number:

• Target (SL-T): the level a zone needs, decided by the risk assessment.
• Capability (SL-C): the level the components in the zone can support when properly configured.
• Achieved (SL-A): the level the zone actually reaches, as built and operated.

The gap between target and achieved is your remediation plan.

The seven foundational requirements

Security levels are measured against seven foundational requirements, each broken down into detailed system and component requirements in 3-3 and 4-2:

1. Identification and authentication control: know who and what is accessing the system.
2. Use control: make sure they can only do what they are allowed to.
3. System integrity: protect against unauthorized changes to software, configuration and data.
4. Data confidentiality: protect information in transit and at rest where needed.
5. Restricted data flow: segment the system and control traffic between zones.
6. Timely response to events: detect, report and respond to security events.
7. Resource availability: keep the system running under attack or failure.

Applying IEC 62443 in practice

Start with an inventory and a risk assessment

Zones cannot be drawn without knowing what is on the network. Build an accurate asset inventory, then assess risk for the system as a whole and for each candidate zone, as 62443-3-2 describes.

Set targets, then measure the gap

Assign each zone a target security level. Then compare what you have against the requirements in 62443-3-3: configurations, accounts, network rules, patch levels. Configuration benchmarking against a hardening baseline is one of the fastest ways to measure the gap for every endpoint and network device.

Build the program around it

Part 2-1 expects the technical work to sit inside a management system: policies, roles, training, patch management, incident response and continual improvement. Our OT patch management guide covers the approach 62443-2-3 describes.

How Novaigu helps

Mission Guard gives you the inventory and network structure that zones are built on, benchmarks endpoint and network device configurations against the standards you choose, and keeps policies, procedures and plans reviewed in its documents library. Its reports show compliance levels system by system, so the gap between target and achieved is visible. Our assessments and secure design services can run the risk assessment and design the zones and conduits with your team.