IEC 62443 — method and step-by-step example

1What is IEC 62443?

The series of standards IEC 62443 standard governs the cybersecurity of industrial systems (PLCs, SCADA, DCS, and OT networks). Unlike conventional IT, OT must meet stringent availability and safety constraints: a safety PLC cannot be patched like an office server. The standard therefore uses security zones instead of one perimeter.

Core principle: divide the facility into zones (groups of assets with similar criticality) connected by conduits (communication flows), then assign each zone a target security level (SL-T, 0 to 4) based on the selected threats, and compare it with the achieved security level (SL-A) provided by the controls in place.

IEC 62443 is often used alongside EBIOS RM on the same scope: EBIOS RM supplies the threat scenario, while IEC 62443 supplies the zone-and-conduit structure and control framework (Foundational Requirements FR1–FR7).

2The process, step by step

1. Define the SUC (System Under Consideration)

Map the scope under study—equipment, networks, and flows—as the basis for the SUC diagram.

2. Divide the SUC into zones and conduits (ZCR1)

Group assets into zones of similar criticality (e.g. critical process, supervision, and OT-office zones) connected by conduits representing inter-zone flows. Segmentation limits incident propagation.

3. Assess risk by zone (ZCR2)

For each zone, identify threat scenarios (feared event, cause, and consequence) and rate the risk. This is where EBIOS RM or Cyber-LOPA connects for the most critical scenarios.

4. Set the target security level SL-T (ZCR3)

For each zone, determine the SL-T required level (0 to 4) based on the target residual risk, for each Foundational Requirement (FR1 Identification and Authentication Control, FR2 Use Control, FR3 System Integrity, FR4 Data Confidentiality, FR5 Restricted Data Flow, FR6 Timely Response to Events, and FR7 Resource Availability).

5. Assess achieved level SL-A and close the gap

Assess existing controls (SL-C, the system's capability), compare them with SL-T, and document the gap-remediation plan.

6. Compliance report (CRS)

The Cybersecurity Requirements Specification consolidates zones, target and achieved levels, and gaps for compliance review.

3Example completed in Polyodos

Section to be completed — step-by-step segmentation of a production line with SCADA and field zones, with Polyodos screenshots from the SUC diagram to the CRS report.

4Common mistakes

Mistake	Why it is a problem
Using one zone for the entire OT scope	This defeats segmentation: a safety PLC and an office-style supervision workstation do not have the same criticality or SL-T.
Confusing SL-T and SL-A	SL-T is a target and SL-A is an observed level. Mixing them conceals the actual gap to address.
Ignoring inter-zone conduits	A well-protected zone connected to a weaker zone through an uncontrolled conduit exposes the whole system. The conduit is often the real weak point.
Applying IT controls without adaptation	Automatic restart or conventional IT patching may be incompatible with an industrial process's availability or safety requirements.

5Further reading

🏛

EBIOS RM

Complementary threat analysis

🧪

PHA — Hazard study

Safety analysis for the same industrial site

📚

All methods

Back to the wiki

Related product module: User guide — IEC 62443 module.