ISA/IEC 62443 series (Industrial Automation and Control Systems security)
Status: Published; parts revised on a rolling basis
The core international standards family for IACS/OT security, developed by ISA99 and IEC TC65. Organised into four groups: General (1-x), Policies & procedures (2-x), System (3-x) and Component/product (4-x). Used as the reference control framework for asset owners, integrators/service providers and product suppliers, and referenced by several national NIS2 frameworks (e.g. Belgium's CyFun).
Who it applies to
- Asset owners (62443-2-1, 3-2, 3-3)
- Integrators and maintenance service providers (62443-2-4)
- Product suppliers (62443-4-1, 4-2)
Why it matters for OT
The de facto control language for OT governance — this site maps other regulations back to it.
Parts of the series
| Part | Title |
|---|---|
| 62443-1-1 | Terminology, concepts and models |
| 62443-2-1 | Security program requirements for IACS asset owners |
| 62443-2-3 | Patch management in the IACS environment (TR) |
| 62443-2-4 | Security program requirements for IACS service providers |
| 62443-3-2 | Security risk assessment for system design (zones and conduits) |
| 62443-3-3 | System security requirements and security levels |
| 62443-4-1 | Secure product development lifecycle requirements |
| 62443-4-2 | Technical security requirements for IACS components |
Source: isa.org. Part list per ISA's public overview; newer parts (e.g. 1-5, 6-1) reported elsewhere — needs verification against the IEC webstore.
Sources
Monitored for changes: isa.org. Data file: data/regulations/iec-62443.yaml. Not legal advice.
Get IEC 62443 changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.