IEC 62443 is the series of cybersecurity standards for industrial automation and control systems, and it applies to substations and industry. It divides the system into zones with similar security needs, joined by controlled conduits, and assigns each zone a target security level (SL 1 to SL 4) according to the attacker it must resist. It splits the obligations between the asset owner, the integrator and the manufacturer.
What IEC 62443 is
IEC 62443 is a series of standards on the security of industrial automation and control systems (IACS). It was born in the process industry, but its concepts apply just as well to an electrical substation: a set of devices that measure, protect and control a physical process and communicate over networks.
Its main contribution is to split security among the parties involved: the asset owner who operates the facility, the integrator who designs and delivers the system, and the manufacturer who develops the products. Each has its own part of the series.
Structure of the series
| Part | For whom | What it covers | Edition |
|---|---|---|---|
| IEC 62443-2-1 | Asset owner | Security program: policies, people, procedures | 2024 (Ed. 2) |
| IEC 62443-3-2 | Asset owner and integrator | Risk assessment, partitioning into zones and conduits, target level | 2020 |
| IEC 62443-3-3 | Integrator | System security requirements and security levels | 2013 |
| IEC 62443-4-1 | Manufacturer | Secure product development life cycle | 2018 |
| IEC 62443-4-2 | Manufacturer | Technical security requirements for components | 2019 |
There are more parts (concepts, terminology, patch management), but these are the ones that appear in a substation specification.
Zones and conduits
A zone is a group of devices with similar security needs. A conduit is the controlled communication path between two zones. The rule is that all traffic between zones passes through a conduit, where it is controlled and logged.
In a substation, a typical partition is:
- Process zone: merging units and yard interfaces, when there is a process bus.
- Bay and protection and control zone: relays, bay controllers, station bus switches.
- Station zone: local SCADA, gateway, clock, engineering server.
- DMZ: jump server, historian, update server; whatever is shared with the outside.
- Control center zone and corporate zone, outside the substation.
The conduits between them carry a firewall, rules that only let documented flows through, and logging. The industrial router and firewall guide shows how they are implemented.
- 01System under considerationWhich devices and networks are included in the analysis
- 02Initial risk assessmentConsequences of an attack on the substation
- 03Zones and conduitsGroup devices and define the paths between groups
- 04Target level per zoneSL each zone and conduit must reach
- 05RequirementsIEC 62443-3-3 measures and IEC 62443-4-2 capabilities to reach the level
Security levels (SL)
The levels are defined by the attacker the system must resist, not by the damage:
| Level | Protects against |
|---|---|
| SL 1 | Casual or coincidental violation, such as a staff error |
| SL 2 | Intentional violation using simple means with low resources, generic skills and low motivation |
| SL 3 | Intentional violation using sophisticated means with moderate resources, IACS-specific skills and moderate motivation |
| SL 4 | Intentional violation using sophisticated means with extended resources, IACS-specific skills and high motivation |
Three uses of the level are distinguished: the target (what the zone needs), the capability (what the device or system can provide) and the achieved level (what was obtained in the installation). The design work is to make the achieved level match the target.
IEC 62443-3-3 groups the requirements into seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.
Relation to IEC 62351 and IEEE 1686
- IEC 62351 secures the power sector protocols: TLS for MMS, IEC 104 and DNP3, GOOSE and SV authentication, role-based access control and key management. It is the tool inside the conduit.
- IEEE 1686-2022 defines the cybersecurity capabilities an IED must have: access control, audit trail, alarms, configuration, firmware updates and the security of its interfaces.
- IEC TR 61850-90-4, the IEC 61850 network engineering guideline, refers security to IEC 62351 and IEC 62443.
Together, the three cover the system (62443), the protocol (62351) and the device (1686 and 62443-4-2).
Regulation
IEC 62443 is a voluntary standard; what is mandatory is set by each country’s regulation and by the utility’s requirements. In North America, the NERC CIP standards apply. Most regulatory frameworks for the power sector use concepts compatible with zones, conduits and access control.
What to ask a vendor for
- IEC 62443-4-2 certificate for the component, with its capability level, and for the manufacturer’s 4-1 process.
- IEEE 1686 statement for the IED: which capabilities it has and which it lacks.
- IEC 62351 support in the protocols the project will use.
- Vulnerability and patch management: how the manufacturer reports and how often it publishes.
- Accounts per person and per role, with no default passwords that cannot be changed.
- Security event logging exportable to a central server.
The standard is purchased through IEC or ISA; it is not freely distributed.
Cybersecurity with Tiza Group
Cybersecurity starts with the network design and continues with the configuration of each IED. Our team designs the segmentation into zones and conduits as part of our communications engineering service and works on relays through controlled, authorized and logged remote access, as explained in the guide on whether remote relay configuration is secure. Learn about our remote relay configuration service or write to us.
Related guides
- Intrusion detection (IDS) in substation networks
- Substation communications by voltage level: MV, HV, EHV
- Substation network monitoring: SNMP and syslog
- Secure remote access to relays and substations
- IEEE 1686: cybersecurity requirements for IEDs
References
- IEC 62443-2-1:2024, security program requirements for IACS asset owners.
- IEC 62443-3-2:2020, security risk assessment for system design.
- IEC 62443-3-3:2013, system security requirements and security levels.
- IEC 62443-4-1:2018, secure product development life cycle requirements.
- IEC 62443-4-2:2019, technical security requirements for IACS components.
- IEC 62351 (series): security of power system communications.
- IEEE 1686-2022, Standard for Intelligent Electronic Devices Cybersecurity Capabilities.
- NERC CIP standards (North America).
Frequently asked questions
Does IEC 62443 replace IEC 62351?
No, they complement each other. IEC 62351 secures the protocols (TLS for MMS and IEC 104, GOOSE and SV authentication, role-based access control). IEC 62443 organizes the security of the whole system: zones, conduits, security levels, the asset owner's program and secure product development.
What security level (SL) does a substation need?
There is no fixed level. The target level of each zone comes from the IEC 62443-3-2 risk assessment, considering the consequences of an attack and the applicable regulation. It is common for the protection and control zone to have a higher target than the general services network.
Does an IEC 62443-4-2 certified relay make the substation secure?
Not by itself. A 4-2 certification says the component has the security capabilities of a certain level. Real security depends on those capabilities being configured, on how zones and conduits are designed, on account and patch management, and on the asset owner's program.