Compliance FrameworksInternational
IEC 62443
Industrial Automation & Control Systems security: component inventory, supplier verification, integrity.
Industrial Automation & Control Systems security: component inventory, supplier verification, integrity.
| Region | International |
| Country or scope | International |
| Sector | Energy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers IEC 62443
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 19 controls from Safeguard's control catalog for IEC 62443.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for IEC 62443 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
IEC62443-SR7.8 Control System Component Inventory | The control system must support reporting a current inventory of all its components (IEC 62443-3-3 SR 7.8) | Scan |
IEC62443-SR3.4 Software and Information Integrity | The system must protect and allow verification of the integrity of software, which requires integrity hashes for deployed components (IEC 62443-3-3 SR 3.4) | Scan |
IEC62443-4-1-SM9 Security of Externally Provided Components | Security requirements must be applied to externally provided components, which presupposes knowing the supplier of each third-party component (IEC 62443-4-1 practice SM-9) | Scan |
IEC62443-4-1-SM10 Third-Party Component Identification | Custom and third-party components used in the product must be identified and assessed, requiring unambiguous component identifiers (IEC 62443-4-1 practice SM-10) | Scan |
IEC62443-4-1-DM Security Defect Management | Security-related issues in the product and its components must be received, tracked and remediated, which requires knowing the exact version of each component (IEC 62443-4-1 practice 6, Defect Management) | Scan |
IEC62443-4-1-DOC Development Documentation | Secure development requires documented, traceable artifacts describing the product composition, satisfied by an SBOM with document identity and creation metadata (IEC 62443-4-1 documentation requirements) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
SR 1.1 | Human User Identification and Authentication |
SR 1.2 | Software Process and Device Identification and Authentication |
SR 1.7 | Strength of Password-Based Authentication |
SR 1.13 | Access via Untrusted Networks |
SR 2.1 | Authorisation Enforcement |
SR 2.4 | Mobile Code |
SR 2.8 | Auditable Events |
SR 2.12 | Non-Repudiation |
SR 3.1 | Communication Integrity |
SR 3.3 | Security Functionality Verification |
SR 3.9 | Protection of Audit Information |
SR 4.1 | Information Confidentiality |
SR 5.1 | Network Segmentation |
SR 5.4 | Application Partitioning |
SR 6.1 | Audit Log Accessibility |
SR 6.2 | Continuous Monitoring |
SR 7.1 | Denial of Service Protection |
SR 7.6 | Network and Security Configuration Settings |
SR 7.8 | Control System Component Inventory |
Policy templates
Written for IEC 62443:
- IACS Zone and Conduit Security Policy
- IACS Patch Management and Vulnerability Policy
- IACS Access Control and Authentication Policy
And 22 from the standard set, adapted to IEC 62443.