IEC PAS 62443-2-2:2025
(Main)Security for industrial automation and control systems – Part 2-2: IACS security protection scheme
Security for industrial automation and control systems – Part 2-2: IACS security protection scheme
IEC PAS 62443-2-2: 2025 provides guidance on the development, validation, operation, and maintenance of a set of technical, physical, and process security measures called Security Protection Scheme (SPS). The document’s goal is to provide the asset owner implementing an IACS Security Program (SP) with mechanisms and procedures to ensure that the design, implementation and operation of an SPS manage the risks resulting from cyberthreats to each of the IACS included in its operating facility.
The document is based on contents specified in other documents of the IEC 62443 series and explains how these contents can be used to support the development of technical, physical, and process security measures addressing the risks to the IACS during the operation phase.
General Information
Standards Content (Sample)
IEC PAS 62443-2-2 ®
Edition 1.0 2025-03
PUBLICLY AVAILABLE
SPECIFICATION
Security for industrial automation and control systems –
Part 2-2: IACS security protection scheme
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.
IEC Secretariat Tel.: +41 22 919 02 11
3, rue de Varembé info@iec.ch
CH-1211 Geneva 20 www.iec.ch
Switzerland
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.
About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigendum or an amendment might have been published.
IEC publications search - webstore.iec.ch/advsearchform IEC Products & Services Portal - products.iec.ch
The advanced search enables to find IEC publications by a Discover our powerful search engine and read freely all the
variety of criteria (reference number, text, technical publications previews, graphical symbols and the glossary.
committee, …). It also gives information on projects, replaced With a subscription you will always have access to up to date
and withdrawn publications. content tailored to your needs.
IEC Just Published - webstore.iec.ch/justpublished
Electropedia - www.electropedia.org
Stay up to date on all new IEC publications. Just Published
The world's leading online dictionary on electrotechnology,
details all new publications released. Available online and once
containing more than 22 500 terminological entries in English
a month by email.
and French, with equivalent terms in 25 additional languages.
Also known as the International Electrotechnical Vocabulary
IEC Customer Service Centre - webstore.iec.ch/csc
(IEV) online.
If you wish to give us your feedback on this publication or need
further assistance, please contact the Customer Service
Centre: sales@iec.ch.
IEC PAS 62443-2-2 ®
Edition 1.0 2025-03
PUBLICLY AVAILABLE
SPECIFICATION
Security for industrial automation and control systems –
Part 2-2: IACS security protection scheme
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
ICS 25.040.40; 35.100.05 ISBN 978-2-8327-0299-4
– 2 – IEC PAS 62443-2-2:2025 © IEC 2025
CONTENTS
FOREWORD . 4
INTRODUCTION . 6
1 Scope . 7
2 Normative references . 7
3 Terms, definitions, abbreviated terms and acronyms . 8
3.1 Terms and definitions . 8
3.2 Abbreviated terms and acronyms . 10
4 Relationship between this document and other documents . 10
5 Security program and security protection scheme . 11
5.1 Relationship between security program and security protection scheme. 11
5.2 Process steps for the generation of a Security Protection Scheme . 12
6 Security protection ratings . 14
6.1 Overview. 14
6.2 Use of the maturity model defined in IEC 62443-2-1 for the determination of
SPR values . 15
6.3 Use of alternative SPR matrixes for internal purposes . 17
6.4 Grouping of security requirements . 18
6.5 Tracing to SPEs and sub-SPEs . 18
6.6 Views . 19
6.7 SPR and SL types . 20
6.7.1 General . 20
6.7.2 SL types for products . 20
6.7.3 SPR types used in an IACS life cycle . 20
7 Principal roles. 22
7.1 Overview. 22
7.2 Asset owner . 23
7.3 Integration service provider . 24
7.4 Maintenance service provider . 24
7.5 Product supplier . 24
7.6 Other roles . 25
8 Duties and activities in the IACS life cycle related to the security protection
scheme . 25
8.1 Overview. 25
8.2 Generation of the cybersecurity requirement specification (CRS) . 26
8.3 Design and implementation of the security measures . 27
8.4 Generation and documentation of the process security measures . 30
8.5 Validation of the security protection scheme . 30
8.5.1 Overview . 30
8.5.2 Validation of the technical security measures . 31
8.5.3 Validation of the process security measures . 32
8.5.4 Prediction of the SPR values, SPR-I . 32
8.6 Periodic revalidation of the SPS during operation . 33
Annex A (informative) Example of methodology for SPR verification . 34
A.1 Overview. 34
A.2 Detailed assessment, requirements-based . 34
A.3 Detailed assessment, risk-based . 35
A.4 Simplified evaluation, questions-based . 35
Annex B (informative) Maturity level assessment . 36
B.1 General . 36
B.2 Overall assessment work process . 36
B.3 Maturity level assessment procedure . 36
B.4 Security program maturity level assessment attributes . 39
B.5 ML assessment documentation . 42
Bibliography . 44
Figure 1 – Simplified asset owner security protection scheme (SPS) life cycle . 7
Figure 2 – Security program and security protection scheme . 12
Figure 3 – Process steps for generating a security protection scheme . 13
Figure 4 – Maturity model . 15
Figure 5 – Determination of the SPR value by using the maturity model of
IEC 62443-2-1 . 16
Figure 6 – Example of visualizing the fulfilment of a system security requirement with
an SPR value . 17
Figure 7 – Examples of alternative SPR matrix for internal purposes . 18
Figure 8 – Example of a dashboard for the generic view . 20
Figure 9 – Use of SPR and SL types in the IACS life cycle . 22
Figure 10 – Roles and responsibilities overview . 23
Figure 11 – Life cycle phases and roles . 26
Figure 12 – Iterations in the IACS life cycle . 26
Figure 13 – Activities and responsibilities for the generation of the CRS (simplified
view) . 27
Figure 14 – Activities and responsibilities for the design and implementation of the
technical security measures applied to the automation solution (simplified view). 28
Figure 15 – Activities and responsibilities for the documentation of process security
measures (simplified view) . 30
Figure 16 – Example of the determination of the SL value which can be met with
capabilities provided by the technical security measures . 31
Figure 17 – Example of the prediction of the SPR value . 32
Figure B.1 – Example ML assessment based on IEC 62443-2-1 . 43
Table B.1 – Assessment MLs . 36
Table B.2 – Maturity level assessment procedure . 37
Table B.3 – Security program maturity level assessment attributes . 39
– 4 – IEC PAS 62443-2-2:2025 © IEC 2025
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
SECURITY FOR INDUSTRIAL AUTOMATION AND CONTROL SYSTEMS –
Part 2-2: IACS security protection scheme
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international
co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and
in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports,
Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their
preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with
may participate in this preparatory work. International, governmental and non-governmental organizations liaising
with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for
Standardization (ISO) in accordance with conditions determined by agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence between
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.