What is IEC 62443, and do we need it?

IEC 62443 is a series of international standards for the security of industrial automation and control systems. It covers the asset owner's security programme, the duties of integrators and service providers, the requirements for a whole system divided into zones and conduits, and the requirements for the products themselves, with security levels that describe how capable an attacker a zone should withstand. It is voluntary: no law requires a typical manufacturer to obtain certification against it, but customers, insurers and auditors increasingly use it as the yardstick, and its zones-and-conduits approach is a practical way to organise NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. risk measures in a plant. You do not need certification to benefit: divide the plant into zones, list the conduits between them and decide what each may carry. Monitoring then checks the conduits in practice. NetSenX can contribute that evidence: from the Pro plan it reads industrial protocols passively and flags traffic that crosses plant network levels.

← All 50 questions on OT and IoTAll topics