Certification of security requirements in accordance with IEC 62443-2-1 and -2-4

• Certification of internationally recognised safety standards for customers and business partners
• Minimising the risk of errors and reputational damage (risk management)
• Reducing costs and risks by identifying and eliminating digital security vulnerabilities in advance
• Minimisation of production downtimes, increase in availability
• Demonstration of up-to-date quality and security certifications as proof of business performance and customer focus
• Fulfilment of the duty of care in accordance with the Industrial Safety Ordinance and Product Safety Act

The second part "Security requirements for operators and service providers" describes the IT security management system and thus defines the organisation of security and the associated implementation aids.

Part 2-1 describes requirements for an IT security management system, such as the definition of security procedures. Part 2-2 contains information on how and in which areas these procedures are to be implemented. Updating the software of automation systems (patching) is of particular importance because outdated software can lead to security vulnerabilities. Part 2-3 is therefore completely dedicated to patch management. Parts 2-4 deal with the use of service providers for commissioning and service from a security perspective.

The audit consists of the pre-audit, on-site readiness assessment and certification audit stages. The certification addresses the logical levels of organisation/processes, system and components as well as procedural and functional requirements. The aim is to certify the implemented CSMS (Cyber Security Management System).

The new standard content is partly based on established ISMS requirements, which means that certification can be easily combined with ISMS audits. Existing risks are identified, analysed and remedied through qualified measures. In this way, you simultaneously protect your confidential data and improve the integrity and availability of your IT systems. After passing the audit, you will receive a certificate. It is valid for three years (including annual surveillance audits).