Why most articles on IEC 62443 are the problem
Type "IEC 62443" into a search engine. What you get: standards texts, consulting offers with five-figure budgets, and articles full of abbreviations that assume you are a standards specialist.
What production managers need instead: a clear answer to the question "What do I need to do now?"
That is the purpose of this article.
What IEC 62443 actually is
IEC 62443 is an international family of standards for cybersecurity in industrial automation and control systems (IACS). It was developed specifically for the challenges of the OT world - environments where availability takes priority over confidentiality and where systems cannot simply be taken offline for a restart.
The standard consists of several parts covering different aspects: from security policy and system architecture to concrete requirements for individual components.
To get started, you do not need to understand every part. What matters: the core principles.
The core principles that are relevant for you
Principle 1: Zones and conduits
IEC 62443 recommends dividing OT networks into security zones. Less security-critical areas must be separated from highly critical areas. Transitions between zones are controlled.
In practice, this means: not every device in the plant needs to be reachable from the same network segment. PLCs and critical control systems should sit in a separate segment.
Principle 2: Security levels
IEC 62443 defines security levels (SL 1-4) that specify which types of attackers a system should be protected against. Most manufacturing companies should initially aim for SL 1 or SL 2 - that means protection against unintentional errors (SL 1) and against deliberate attacks without special resources (SL 2).
Principle 3: Data backup and recovery
IEC 62443 makes backup and recovery an explicit security element. Backups must be created regularly, checked for integrity and tested for recoverability. Sounds familiar? That is because NIS2 has the same requirements - and IEC 62443 serves as the reference standard for implementation.
Principle 4: Change management
Every change to a critical OT system must be documented, approved and traceable. Unauthorized changes must be detected and logged.
The mapping: NIS2 ↔ IEC 62443 ↔ eguide4DATA
| Requirement | NIS2 | IEC 62443 | eguide4DATA |
|---|---|---|---|
| Regular backups | Art. 21(2)(c) | SL 1: Backup processes (62443-2-1) | Automatic backups of all OT systems |
| Integrity check | Art. 21(2)(c) | SL 2: Verification processes (62443-3-3) | Automatic comparison of target and actual state |
| Restore test | Art. 21(2)(c) | SL 2: Recovery tests (62443-2-1) | Restore documentation with timestamp |
| Change log | Art. 21(2)(e) | SL 2: Change management (62443-2-1) | Versioning with user, time, comment |
| Asset inventory | Art. 21(2)(a) | SL 1: Inventory (62443-2-1) | Central asset management of all OT systems |
The first concrete step: the OT inventory
Before you can talk about security zones, security levels or compliance, you need a complete list of all OT assets.
That sounds trivial. It is not.
In practice, many production sites have assets that nobody has inventoried for years. Old controllers that somehow still run. Remote accesses that were set up once and never deactivated. Systems that should have been replaced but are still in production.
The OT inventory is the starting point for everything else. eguide4DATA starts exactly here - with an automatic capture of all known OT systems and their current states.
FAQ: IEC 62443 & OT Security
Do I need formal IEC 62443 certification?
Certification according to IEC 62443 is voluntary – unless your industry or a client explicitly requires it. NIS2 refers to IEC 62443 as a reference standard but does not mandate formal certification.
What is the difference between NIS2 and IEC 62443?
NIS2 is an EU directive that defines legal requirements. IEC 62443 is a technical standard that explains how to implement these requirements in OT practice. Both complement each other.
Can eguide4DATA cover full IEC 62443 compliance?
eguide4DATA addresses security-relevant areas such as backup, versioning, change management, and inventory. Full IEC 62443 compliance also requires network architecture, access management, and additional measures.
Which parts of IEC 62443 are most relevant for SMEs?
For manufacturing companies without a specialized security department, IEC 62443-2-1 (security management) and IEC 62443-3-3 (system requirements) are the most practical entry points.
