ISA/IEC 62443 (security for industrial automation and control systems)

What it is

ISA describes the ISA/IEC 62443 series as standards that define requirements and processes for implementing and maintaining electronically secure industrial automation and control systems (IACS). ISA says the ISA99 committee and IEC Technical Committee 65 Working Group 10 develop the series together, that the ISA and IEC editions are identical, and that in 2021 IEC recognized the series as a horizontal standard.

The parts ISA lists cover asset-owner security programs (2-1), patch management (2-3), service providers (2-4), security risk assessment for system design (3-2), system security requirements and security levels (3-3), the secure product development lifecycle (4-1) and technical requirements for components (4-2).

The IEC catalog entry for IEC 62443-3-3:2013 says it provides detailed technical control system requirements (SRs) associated with the seven foundational requirements (FRs) described in IEC 62443-1-1, used with the defined zones and conduits for the system under consideration to set a target security level. The catalog lists it as an International Standard, edition 1.0, published 2013-08-07. IEC sells the full text; we do not reproduce requirement text.

Certification

ISA says its ISA Security Compliance Institute runs ISASecure schemes: Component Security Assurance (CSA), IoT Component Security Assurance (ICSA), System Security Assurance (SSA) and Security Development Lifecycle Assurance (SDLA). ISA says these certifications assure conformance to the ISA/IEC 62443 family of cybersecurity standards. A product’s 62443 certificate covers its security capabilities; it is not an assessment of any machine-learning model running on it.

Where AI fits

IEC 62443 is not an AI standard. The joint guidance from CISA, ASD’s ACSC and partner agencies on integrating AI into operational technology asks owners and operators to embed AI system assessments within existing risk evaluation, mitigation, and monitoring processes. The same document flags a lack of OT-oriented AI standards, saying current international AI technical standards are broadly aligned to the deployment of AI systems into IT environments. It does not name IEC 62443.

Editorial judgment: for an AI-enabled control system, IEC 62443 is the existing OT security framework into which those AI assessments would be embedded, alongside IEC 61508 or IEC 61511 for functional safety and the NIST AI RMF for AI risk. We have not found an official IEC or ISA page that defines AI-specific 62443 requirements.

Tagging rule

We tag a listing with IEC 62443 only when the vendor’s own page names IEC 62443 for that product.