Where to start

Home page of the IEC 62443-3-2 module. It offers an entry point by need (mapping, analysing, checking compliance, producing the CRS, monitoring) and recaps the normative path.

The ZCR 1 → ZCR 7 path

Step	Purpose
ZCR 1	Identify the SUC — scope, assets, access points
ZCR 2	Initial risk assessment — worst case, L × S
ZCR 3	Zones & conduits — segmentation, SL-T
ZCR 4	Comparison to tolerable risk
ZCR 5	Detailed risk assessment (5.1 → 5.13)
ZCR 6	Document the CRS — full or light
ZCR 7	Approval by the asset owner

The order isn't intuitive

Initial risk (ZCR 2) comes before zoning: it feeds the per-zone SL-T suggestion. And a light CRS is possible as early as ZCR 3, without a detailed analysis.

Three choices to make before starting

These settings condition data entry on several pages at once. Setting them upfront avoids having to re-rate a study that's already under way.

1. The likelihood rating mode (Risk metrics) — Vc only or the Vp × Vc decomposition. It applies to ZCR 2 and ZCR 5 together: the standard (§4.6.1) requires the same scale for the initial and detailed assessments. Changing it later means redoing both.
2. The study profile (Context, Configuration tab) — "SIS analysis" and "Lifecycle" are two independent options, off by default. They add tabs and pages without removing anything that already exists.
3. The intended depth — light CRS (zones, conduits, SL-T, compliance gap) or detailed ZCR 5 analysis. The light CRS is enough to frame a specification; the detailed analysis becomes necessary as soon as an initial risk exceeds the tolerable threshold.

WARNING

None of these choices is locked in, but changing the rating mode invalidates the likelihoods already entered.

The two optional profiles

SIS analysis (IEC 61511 / ISA TR84.00.09) — enable if the SUC includes a safety instrumented system and the study needs to dovetail with the existing SIL analysis. Adds: essential functions in ZCR 1, the "initial SL-T = severity" rule and a cyber-LOPA tab in ZCR 2, a six-factor likelihood calculator in ZCR 5, a CSA review in ZCR 6.

Lifecycle (IEC 62443-2-3) — enable if the study needs to be maintained over time. Opens the Lifecycle page: cyber life sheets, commissioning checklists, periodic SL-A assessments and a patch register.

Reusing an existing safety study

Two separate import chains avoid re-entering scenarios from a project that already carries an Industrial Risks analysis:

• PHA, PHA — Hazard study, HAZOP, FMEA → ZCR 2 rows — "Import from RI" button, with a scale mapping proposed and editable. Available regardless of the profile.
• LOPA → cyber-LOPA → Vp — the cyber-LOPA tab of ZCR 2 pulls in the LOPA scenarios and carries the result into the Vp column. It is the only chain that feeds Vp automatically; it assumes both the "SIS analysis" profile and the decomposed rating mode.