SL-C Components (annex 4-2)
Component evaluation: a snapshot of hardware capabilities and the gap with the ZCR 5 targets, before drafting the CRS. This is an annex to the CRS, not a step of the ZCR path.
Why this page, and at what point
IEC 62443-3-2 sets a target (SL-T) per zone and conduit. It does not say whether the installed hardware is capable of reaching it. This page makes that observation, then measures the gap.
Why not earlier
Evaluating a capability before knowing the target amounts to working without a criterion: you know neither which requirements are relevant, nor whether the gap found is a problem. Filtering by zone SL-T is only possible once ZCR 5 is done — and it strongly reduces the number of requirements to review.
The chain of three levels
| Level | Meaning | Where |
|---|---|---|
| SL-T — target | The level required for a zone, established from the risk. A need, not an observation. | ZCR 3 / ZCR 5.6 |
| SL-C — capability | What a component can natively do, correctly configured. Observed on the product, never inferred from the target. | This page |
| SL-A — achieved | The level actually obtained once the system is in service. | Compliance Analysis |
Two ways to establish a device's SL-C
Declarative — the level is taken from an ISASecure certificate or a manufacturer data sheet. Fast, but not enforceable: nothing in the study justifies the value.
Derived from the 4-2 requirements — the level is calculated from the CR/RE evaluation of IEC 62443-4-2, filtered by component type (SW, EDR, HDR, NDR). Longer, but each level is backed by requirements evaluated one by one, and the gap to the SL-T becomes a quantifiable action plan.
Two reading rules
An FR with no requirement applicable to this component type is "not evaluated" (null), never "maximum capability": the tool distinguishes "nothing to say against it" from "nothing to say". An FR whose requirements are all satisfied does reach SL 4 (Annex B.1 of 4-2).
A zone's SL-C is the per-FR minimum of its equipment: a single weak component caps the entire zone. This is intentional — a zone is no more protected than its weakest link.
Tabs
| Tab | Content |
|---|---|
| Approach | Normative anchoring (ZCR 5.8, 5.12, Annex A) and the place of this step |
| SL-C Evaluation | Entry per component, declarative or derived mode |
| Gap | SL-C vs SL-T gap, with the detail of components under each zone |
"Points to develop" annex
One line per requirement missing to reach the zone's SL-T, sorted by priority: the smaller the gap between the requirement's level and the target, the higher the priority. Requirements at a level above the target are excluded — they do not condition reaching it.
Two statuses, two distinct actions: Not satisfied → to develop, Not evaluated → to qualify. Exportable to Excel, and included in the module's Word and Excel reports.