IEC 62443 Basics: Zones and Security Levels

IEC 62443 is the international family of standards for the security of industrial automation and control systems. It is extensive, comprising more than ten parts, which is why many never attempt to use it. Yet its practical value concentrates in a handful of core concepts, and understanding those does not require reading the whole thing.

This article explains the part a plant actually uses.

Why OT needs its own standard

ISO 27001 covers information security management systems and works well in IT environments. OT is different:

• availability and human safety come first, not confidentiality,
• asset lifetimes are 15 to 25 years, not 3 to 5,
• patching requires planned downtime and is often impossible,
• the protocols have no concept of authentication.

IEC 62443 is built around these characteristics. It also provides a shared language for the plant engineer, IT, the auditor and the equipment supplier, which is at least as valuable as the technical content itself.

Structure of the family

It divides into four groups, and most organisations need only two of them.

If you are an asset owner, 2-1 (security programme) and 3-2 (risk assessment and zone design) are the two documents you will work with. Part 4 becomes relevant when purchasing equipment and you want to know what security capability to demand from the supplier.

The zone-and-conduit model

This is the standard's most important practical instrument.

Zone: a grouping of assets with equivalent security requirements. Grouping is by risk and function, not physical location. All controllers on a production line typically share a zone, because they serve the same process with the same criticality.

Conduit: the communication between zones. Not simply cabling: a defined, restricted and monitored data path. For each conduit you record what traffic may cross, in which direction, and what control protects it.

The essence of the model: what is not explicitly permitted on a conduit is denied. This is the same principle as Zero Trust micro-segmentation, expressed in industrial language two decades earlier.

How to define zones

The Purdue model layers give a good starting point, but zones are finer grained.

1. Start with the IT/OT boundary. This is the single most important zone boundary. The industrial DMZ sits here, holding the replicated historian, the jump server and file transfer. No direct traffic passes between the office network and the plant.
2. Separate production lines or cells. If one line is compromised, it should not spread to another.
3. Isolate safety systems (SIS). Always in their own zone with the strictest controls.
4. Treat remote access separately. The supplier maintenance channel is its own tightly controlled path.

Security Level: how strong does it need to be

The standard defines five levels according to the capability of adversary a zone must withstand.

The standard distinguishes three variants: SL-T (target, what we want to reach), SL-A (achieved, what the assets actually deliver) and SL-C (capability, what the product supports). Gap analysis is the difference between SL-T and SL-A.

In practice most industrial zones sit at SL 2, with critical process control and safety systems at SL 3. SL 4 is rare and typically applies to national critical infrastructure. Not every zone needs a high level, and that is precisely what makes the programme affordable: money goes where the risk is.

Where a plant should start

A realistic sequence, delivering measurable results at each step.

1. Asset inventory and communication matrix. Via passive discovery from traffic mirroring. Without it, every subsequent step is guesswork.

2. Risk assessment (per 62443-3-2). Process criticality, potential impact, threat scenarios. This determines the SL-T required per zone.

3. Zone and conduit design. In drawings and tables: which asset belongs to which zone, what conduits exist, what may cross them.

4. Gap analysis. The difference between SL-T and current state, per zone.

5. Action plan. Industrial DMZ, segmentation, channelled remote access, monitoring, asset hardening. Prioritised, because not everything can happen at once.

Relationship with NIS2

If the organisation is in NIS2 scope and operates industrial environments, the two frameworks do not compete: IEC 62443 is the technical language for delivering NIS2 on the OT side.

This matters because the auditor asks about NIS2 while the plant engineer thinks in 62443 terms. The mapping serves both sides.

If you want to assess where you stand, our OT risk assessment follows the 62443-3-2 logic, and network segmentation covers implementation of the zone model. We surveyed the broader OT security picture in our ICS/SCADA article.