In partnership with

Table of Contents

• Important Terms, definitions and relationships

  • Standards Referencing ISA/IEC 62443

  • Standards Elements

  • Security Level (SL)

  • References

• My Recent Most Viewed Social Posts:

• Feedback

Hello Securing Things Community,

This is Part-2 of a multi-part series on ISA/IEC 62443 standards overview - and will be expanding upon the 4 main groups and the series of documents, their purpose, security levels, expand IACS cybersecurity lifecycle phases, individual and product certifications.

{Quick test - Part 1 included a tip to remember the 4 groups in the standards series with the help of a short phrase; see if you can recall, without giving a peep at Part 1. Did you? if not go ahead and click the Part 1 link above and checkout the code snippet like this for the tip...}. :-) hope that'll help you remember. 

But first, let’s cover some basic definitions, which builds the foundation of understanding in later part of the series.

Important Terms, definitions and relationships

Definition & relationships between different OT terms per #62443:

➡ Components✅ = Devices & Software Apps. Includes IIOT components.

➡ Control Systems✅= Software & hardware components. Includes IIOT Systems.

➡ Automation Solution✅= Specific implementation of Control Systems

➡ Industrial Automation Control Systems (IACS)✅= Combo of Automation Solution + People + Security Program. Includes IIOT IACS.

➡ Cloud✅= collection of networked remote servers.

➡ System Under Consideration (SuC)✅= project scope definition.

➡ Zones & Conduits✅= Zones are groups of assets/functions & Conduits are logical groups of communication channels, sharing common security requirements.

➡ All these generates data and data flows ✅ based on information model e.g. ISA95.

➡ All covered in standards ✅e.g. ISA/IEC 62443, ISA95, etc. and other related standards.

ISA/IEC 62443 Standards Series📜

Here’s a current list of published standards below as covered previously.

There are few standards that are been worked on as of now for revisions. The most recent update is for Part 2-1 with significant changes to the standards document.

A simplified overview from ISASecure / ISAGCA presentation is below:

ISA/IEC 62443 is a functional standard that sets security performance objectives without specifying how to achieve them.

General:

As the group name implied, this group includes standard supporting documents addressing topics that are common to the entire series.

Policies & Procedures:

Standards documents in this group focus on the policies and procedures associated with IACS security.

Systems:

Standards documents in this group address requirements at the system level.

Components:

Standards documents that provide information about the more specific and detailed requirements associated with the development of IACS products.

IEC 62443-4-1, along with IEC 62443-4-2 and IEC 62443-3-3, helps organizations develop a 'Secure Development Lifecycle' to ensure security throughout the lifecycle of devices and applications.

Standards Referencing ISA/IEC 62443

The series is referenced throughout the NIST Cybersecurity Framework (CSF), and CISA Cybersecurity Performance Goals (CPGs.).

The CPGs frequently reference ISA/IEC 62443-2-1 and ISA/IEC 62443-3-3 across categories like account security, device security, data security, governance and training, vulnerability management, supply chain/third party, and response and recovery.

Adoption of ISA/IEC 62443 standard is optional and dependent upon a risk assessment of IACS under consideration. Compliance and conformance is voluntary and consensus driven.

Standards Elements

ISA/IEC 62443 standards series contains the following two elements:

• Normative Elements - those parts that shall be complied with to demonstrate compliance with the standard. Indicated by use of words “shall” or “must”.

• Informative Elements - provide clarification or additional information. May not contain requirements. Words “shall” or “must” are not used.

Security Level (SL)

A Security Level (SL) is defined as a measure of confidence that the system, zone, or conduit functions in the intended manner and provide a level of assurance for risk reduction and minimises the chance of exposure due to vulnerabilities.

How and when an organization uses SLs depends on where they are in their life cycle.

There are three types of SLs used throughout the ISA/IEC 62443 Series:

1. Target Security Levels (SL-T) are the desired security levels for an Automation Solution, indicating the protection needed for the system, zone, or conduit. An Asset Owner uses the risk assessment process (Part 3-2) to determine and document the appropriate SL-T in their Cybersecurity Requirements Specification.

2. Capability Security Levels (SL-C) are the native technical security countermeasures within a system (Part 3-3) or component (Part 4-2) that can be configured to protect the Automation Solution without additional compensating countermeasures.

3. Achieved Security Levels (SL-A) are the actual measured SLs for an Automation Solution, determined post-operation.

The SL-C requirements for systems (Part 3-3) and components (Part 4-2) are grouped into different levels using an increasing level of potential risk reduction, as shown below.

SL-Cs are qualitative (in contrast to quantitative risk reduction in safety engineering) and takes an attacker perspective on the motives and how many resources, means, and skills they would need to overcome the security countermeasures required at that SL.

Standards Requirements

Within the standard there’s are several types of requirements with a hierarchy including:

• Foundational Requirements (FR)

• System Requirements (SR)

• Component Requirements (CR)

• Host Device Requirements (HDR)

• Network Device Requirements (NDR).

For each type of requirement above, there’s a defined security level. Security level of FR is derived from its SR and CR.

This is it for now on Part 2.

Stay tuned to find out more in Part 3- ISA/IEC 62443 Standards Series Overview in a future newsletter edition, in which we’ll cover, more on the standards, what are the foundational requirements, its relationship with other requirements, applicability of different parts of the standard across the cybersecurity lifecycle phases, zones and conduits, reference architecture and more.

References

• ISA main website → https://www.isa.org/

• ISA Global Cybersecurity Alliance (ISAGCA) → https://gca.isa.org/resources. e.g.:

  • Quick Start Guide to ISA/IEC 62443

  • IoT Security Maturity Model: 62443 Mappings for Asset Owners and Product Suppliers

  • and more… 

My Recent Most Viewed Social Posts:

Feedback

I invite #SecuringThings community to share their feedback.

Your feedback and input is invaluable to me as we work together to strengthen our cybersecurity defenses and create a safer and smarter digital society. Thank you for your trust and continued support.

Do register, validate your email, and request login link to submit poll to be able to enter a chance to win a future course giveaway. Also:

Here's to Securing Things in 2025 onwards!

Thanks for reading - until the next edition!

It’s a Great Day to Start Securing Things for a Smart & Safer Society.

Take care and Best Regards,

M. Yousuf Faisal.

Follow Securing Things on LinkedIn | X/Twitter & YouTube.