The IEC 62443 standard provides an internationally recognized standard for network security in the process and automation industry, which is increasingly used in Industry 4.0. It helps prevent cyberattacks and serves as proof of due diligence in accordance with the Industrial Safety Regulation and Product Safety Act.
Request Offer
The risk of cyberattacks is constantly increasing for companies. This makes the responsible handling of information more important than ever. After all, information is a valuable asset whose loss or manipulation can cause considerable damage.
The IEC 62443 standard (Industrial Communication Networks - Networks and System Security) has established itself as an internationally recognised standard for proof of conformity in the process and automation industry. Due to the lack of standardisation specifications, many other industrial sectors now rely on this standard. This makes IEC 62443 the central certification standard for Industry 4.0.
IEC 62443 also serves as possible proof of fulfilment of the duty of care in accordance with the Industrial Safety Ordinance and the Product Safety Act.
The second part "Security requirements for operators and service providers" describes the IT security management system and thus defines the organisation of security and the associated implementation aids.
Part 2-1 describes requirements for an IT security management system, such as the definition of security procedures. Part 2-2 contains information on how and in which areas these procedures are to be implemented. Updating the software of automation systems (patching) is of particular importance because outdated software can lead to security vulnerabilities. Part 2-3 is therefore completely dedicated to patch management. Parts 2-4 deal with the use of service providers for commissioning and service from a security perspective.
Within the IEC 62443 series of standards, IEC 62443-2-1 plays a central strategic role as it establishes an organisational framework for the systematic cybersecurity of operational technology (OT).
The IEC 62443 series is an internationally recognised standard for the comprehensive protection of industrial automation and control systems (IACS).
A certified implementation of IEC 62443-2-1 establishes the basis for applying other parts of the series. The implemented security programme provides an overarching control and governance framework on which technical, system and component-related security requirements are based.
Results can be used directly for action planning, prioritization, and management decisions.
The existing management and review system facilitates the verification of the effectiveness of technical measures.
Supplier and service provider risks are systematically addressed and monitored.
Easier integration of certified or tested components into existing system and plant architectures
IEC 62443-2-1 therefore serves as a strategic entry point and a cornerstone for the gradual, structured, and sustainable implementation of the entire IEC 62443 series of standards in the industrial environment.
The audit consists of the pre-audit, on-site readiness assessment and certification audit stages. The certification addresses the logical levels of organisation/processes, system and components as well as procedural and functional requirements. The aim is to certify the implemented CSMS (Cyber Security Management System).
The new standard content is partly based on established ISMS requirements, which means that certification can be easily combined with ISMS audits. Existing risks are identified, analysed and remedied through qualified measures. In this way, you simultaneously protect your confidential data and improve the integrity and availability of your IT systems. After passing the audit, you will receive a certificate. It is valid for three years (including annual surveillance audits).
In addition to a digitalisation strategy, industrial plants need a stringent cyber security strategy. The IEC 62443 standard offers a well thought-out, structured and established process model for this. In addition to technology, it also takes processes into account and consistently incorporates the three important roles of Industry 4.0: Operators, integrators and component manufacturing companies. This certification standard can be used to demonstrate fulfilment of the duty of care and lay the foundation for proof of conformity at an early stage. Our white paper highlights all the important aspects:
