What is IEC 62443, and do we need it?

IEC 62443 is a series of international standards for the security of industrial automation and control systems, the operational technology (OTOT: operational technology. The computers that run machines, production lines, building systems and utilities.) that runs machines, plants and building systems. It divides responsibilities between asset owners who operate the systems, integrators who build them into a site and product suppliers who make the components, and gives each its own requirements. Central ideas are dividing the plant network into zones with controlled connections between them, called conduits; setting target security levels for each zone according to the threat; and maintaining security over the whole life cycle, from design to decommissioning. You need it if customers, insurers or regulators in your sector ask for it, or if you build or supply industrial components; many operators also use it as a structure for their own OT security without seeking certification. Network monitoring fits its emphasis on knowing what talks to what across zones. From the Pro plan, NetSenX reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm passively and never probes OT devices; it is not a safety system and does not act on the process.

This answer also appears, with more context, here: What is IEC 62443, and do we need it?

← All 15 questions on Security standards: ISO 27001, SOC 2All topics