Financial · OT/ICS
IEC 62443: a practical guide
By AssureCore Compliance Team · Last reviewed
IEC/ISA 62443 — international standard for industrial automation and control systems (IACS) security. Covers OT/ICS cybersecurity for critical infrastructure sectors.
What IEC 62443 is for
IEC/ISA 62443 — international standard for industrial automation and control systems (IACS) security. Covers OT/ICS cybersecurity for critical infrastructure sectors.
Cybersecurity of industrial automation and control systems across asset owners, product suppliers, integrators, and service providers.
Related frameworks
Governing body and current version
Governing body: International Electrotechnical Commission (IEC)
Current version: IEC 62443 series (current published parts)
Obligation profile: Voluntary / contractual
Applicable industries
Financial services, payment, infrastructure, and technology teams with heightened resilience or reporting expectations.
- Manufacturing
- Energy
- Utilities
- Transport
- Industrial automation
Key domains or obligations
- Security lifecycle
- System requirements
- Component security
- Secure development
- Zone and conduit design
Catalogue capabilities
- Security Level (SL) target and achieved assessment
- Zone and conduit network segmentation
- Security Management System (CSMS) implementation
- Supplier / component security requirements
- Risk assessment for OT/ICS environments
- Incident response for industrial systems
Implementation approach
- Confirm legal, contractual, customer, and system scope.
- Assign accountable owners and document exceptions.
- Link recurring evidence to controls and review freshness on a cadence.
- Track risks and remediation, then complete an internal review before external assessment.
Evidence examples
- Approved policies, procedures, scope and applicability statements
- Asset, supplier, access-review, training, and risk records
- Configuration exports, tickets, logs, test results, minutes, and incident records
- Evidence metadata showing source, owner, period, approval, exceptions, and review date
Audit or assessment preparation
- Verify each in-scope control has an owner and current status.
- Check evidence covers the requested period and remains traceable.
- Reconcile open risks, findings, action plans, and management decisions.
- Prepare a scope narrative and evidence index for reviewers.
Common failure points
- Treating the framework as a one-time checklist
- Relying on inherited controls without documenting responsibility
- Collecting screenshots without dates, owners, context, or period coverage
- Leaving scope, exceptions, risk acceptance, and corrective actions undocumented
Mappings and AssureCore workflows
Bring controls, evidence, risks and framework mappings together in an AssureCore workspace.
Applicable regions
Frequently asked questions
Is IEC 62443 mandatory for every organisation?
No. Applicability depends on the relevant law, regulator, contract, customer, or assurance objective.
Can evidence support multiple frameworks?
Often yes, when it demonstrates the same operating practice and each framework-specific qualification remains visible.
Official references
Educational resource
This guide is for general education and planning. It is not legal advice, an audit opinion, a certification, or a determination that a particular framework applies to your organisation.