IEC 62443
Industrial OT Security
Securing Industrial Automation and Control Systems (IACS)
Industrial cybersecurity advisory for critical infrastructure operators, industrial automation asset owners, and OT system integrators. VULNSEE bridges the divide between corporate IT security and industrial engineering across Europe, the US, the UK, and Israel.
In operational technology, standard IT practices like sudden reboot patching or active port sweeps can crash delicate PLCs and shut down assembly lines. We implement IEC 62443 Zones and Conduits, Security Level targets (SL-T), and Purdue Model network segmentation to preserve physical safety and process availability.
The Four Structural Tiers
of IEC 62443
IEC 62443 is an international series of standards for industrial automation and control systems (OT) security, covering asset owners, system integrators, and product suppliers across four distinct tiers:
Defense in Depth
Multi-layered physical, logical, and procedural protection across the industrial plant.
Security Levels
Quantifiable protection targets (SL 1 to SL 4) matched to asset criticality.
Zones & Conduits
Industrial network segmentation isolating process control from enterprise IT.
Deterministic Availability
Safeguards designed never to introduce latency or disrupt physical manufacturing processes.
The 4 Security Levels (SL 1 to SL 4)
Casual or Coincidental
Protection against unintentional mistakes, human error, or casual non-malicious misuse by unauthorized personnel.
Intentional (Simple Means)
Protection against intentional cyber attacks using basic publicly available tools, simple exploits, and low adversary resources.
Intentional (Sophisticated Means)
Protection against professional cyber criminals utilizing advanced industrial malware, sophisticated techniques, and moderate resources.
Intentional (Nation-State / Extended)
Protection against state-sponsored advanced persistent threats (APTs) wielding customized ICS zero-day exploits and extensive resources.
Risk-Based
Protection Targets (SL-T)
In an industrial plant, applying maximum security controls uniformly to every single sensor or workstation is physically impossible and cost-prohibitive.
Protection must mirror operational consequence.
IEC 62443 introduces three distinct concepts of Security Level: Target Security Level (SL-T) established during threat modeling, Capability Security Level (SL-C) engineered into components, and Achieved Security Level (SL-A) validated through operational auditing.
By conducting formal IEC 62443-3-2 risk assessments, VULNSEE helps operators define appropriate SL-T targets for each zone and conduit, ensuring security budgets protect mission-critical operations without over-engineering low-risk monitoring nodes.
Regional requirements
IEC 62443 is an international series of standards for industrial automation and control systems (OT) security, covering asset owners, system integrators and product suppliers, with security levels SL 1 to SL 4 and zones and conduits. Headquartered in Jerusalem, VULNSEE advises industrial operators across global jurisdictions.
European Union
Relevant to NIS2 risk management for operators of essential and important entities and to the Cyber Resilience Act for products with digital elements.
United States
Referenced by CISA and widely used in critical infrastructure.
United Kingdom
Used alongside the NCSC Cyber Assessment Framework for operators of essential services.
Israel
Relevant to critical infrastructure and industrial organizations under INCD guidance.
How an IEC 62443 Project Runs
Our structured delivery guides industrial teams through passive discovery, zones and conduits segmentation, and operational verification without downtime.
OT Asset Discovery & Process Characterization
Conduct non-intrusive asset inventory across plant floor networks, catalogue PLCs, RTUs, HMIs, and SCADA servers, and document physical process dependencies without interrupting operations.
Zones & Conduits Definition (3-2)
Perform cybersecurity risk assessments under IEC 62443-3-2, segment operational assets into logical security zones, and define communication conduits and traffic filtering policies.
Security Level Target (SL-T) Allocation
Assign Target Security Levels (SL 1 to SL 4) to each zone based on potential impact to life safety, environmental compliance, and plant availability.
Technical Architecture & IDMZ Implementation (3-3)
Engineer industrial demilitarized zones (IDMZ), configure industrial firewalls with deep-packet inspection, harden remote maintenance gateways, and isolate safety instrumented systems.
Verification, Supplier Governance & Response (2-4 / 4-1)
Validate achieved security levels (SL-A), establish OT-specific incident response playbooks, evaluate component vendor security capabilities, and produce audit-ready documentation.
Total Project Duration
An IEC 62443 OT cybersecurity engagement typically takes between 4 and 9 months depending on plant scale, operational complexity, and targeted security levels.
Where Industrial Cybersecurity
Commonly Breaks Down
Industrial cyber incidents often stem from treating OT security as a routine extension of corporate IT. When IT security teams attempt to enforce standard corporate scanning tools on plant networks, legacy PLCs frequently lock up, halting production lines.
Conversely, plant operators often leave remote maintenance modems and unmonitored vendor connections active, providing attackers with uninhibited ingress into internal control loops.
VULNSEE designs passive monitoring, hardened industrial demilitarized zones (IDMZ), and compensated air-gapped workflows that safeguard plants without disrupting operations.
Active Port Scanning on Sensitive Fieldbuses
Running aggressive IT vulnerability scanners against Modbus, Profinet, or Ethernet/IP controllers, causing critical PLCs to crash and triggering emergency plant shutdowns.
Uncontrolled Third-Party Vendor Remote Access
Allowing machine builders and system integrators permanent, direct remote access into plant control networks via consumer remote desktop tools without session logging.
Direct Dual-Homed Server Connections
Bridging corporate IT networks and industrial SCADA networks using dual-homed servers without an intermediate Industrial DMZ (IDMZ) as mandated by the Purdue Model.
Neglecting Legacy Firmware & Safety Systems
Leaving safety instrumented systems (SIS) connected to general operational networks without physical logic-lock keys or independent cryptographic isolation.
Industrial Security Architecture
Industrial security is an engineering and physical safety challenge. We bridge the gap between cybersecurity governance and factory-floor realities, ensuring security measures enhance uptime and operational resilience.
