IEC 62443-2-4:2015

Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers

IEC 62443-2-4:2015 specifies requirements for security capabilities for IACS service providers that they can offer to the asset owner during integration and maintenance activities of an Automation Solution. The contents of the corrigendum of August 2015 have been included in this copy.

Sécurité des automatismes industriels et des systèmes de commande - Partie 2-4: Exigences de programme de sécurité pour les fournisseurs de service IACS

L'IEC 62443-2-4:2015 spécifie les exigences de capacités de sécurité pour les fournisseurs de service IACS qu'ils peuvent proposer au propriétaire d'actif pendant les activités d'intégration et de maintenance d'une Solution d'Automatisation. Le contenu du corrigendum d'août 2015 a été pris en considération dans cet exemplaire.

General Information

• Status: Published
• Publication Date: 23-Aug-2017
• ICS: 01 - GENERALITIES. TERMINOLOGY. STANDARDIZATION. DOCUMENTATION
• ICS: 25.040.40 - Industrial process measurement and control
• ICS: 35.100.05 - Multilayer applications
• Technical Committee: TC 65 - Industrial-process measurement, control and automation
• Drafting Committee: WG 10 - TC 65/WG 10

Relations

• Amended By: IEC 62443-2-4:2015/AMD1:2017 - Amendment 1 - Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers
• Effective Date: 05-Sep-2023
• Corrected By: IEC 62443-2-4:2015/COR1:2015 - Corrigendum 1 - Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers
• Effective Date: 05-Sep-2023
• Revised: IEC 62443-2-4:2023 - Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers
• Effective Date: 05-Sep-2023

Standards Content (Sample)

IEC 62443-2-4 ®
Edition 1.1 2017-08
CONSOLIDATED VERSION
INTERNATIONAL
STANDARD
colour
inside
Security for industrial automation and control systems –
Part 2-4: Security program requirements for IACS service providers

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form

or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from

either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or

your local IEC member National Committee for further information.

IEC Central Office Tel.: [phone]
3, rue de Varembé Fax: [phone]

CH-1211 Geneva 20 [e-mail]
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

IEC Catalogue - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
The stand-alone application for consulting the entire The world's leading online dictionary of electronic and
bibliographical information on IEC International Standards, electrical terms containing 20 000 terms and definitions in
Technical Specifications, Technical Reports and other English and French, with equivalent terms in 16 additional
documents. Available for PC, Mac OS, Android Tablets and languages. Also known as the International Electrotechnical
iPad. Vocabulary (IEV) online.

IEC publications search - www.iec.ch/searchpub IEC Glossary - std.iec.ch/glossary
The advanced search enables to find IEC publications by a 65 000 electrotechnical terminology entries in English and
variety of criteria (reference number, text, technical French extracted from the Terms and Definitions clause of
committee,…). It also gives information on projects, replaced IEC publications issued since 2002. Some entries have been
and withdrawn publications. collected from earlier publications of IEC TC 37, 77, 86 and

CISPR.
IEC Just Published - webstore.iec.ch/justpublished
Stay up to date on all new IEC publications. Just Published IEC Customer Service Centre - webstore.iec.ch/csc
details all new publications released. Available online and If you wish to give us your feedback on this publication or
also once a month by email. need further assistance, please contact the Customer Service
Centre: [e-mail].
IEC 62443-2-4 ®
Edition 1.1 2017-08
CONSOLIDATED VERSION
INTERNATIONAL
STANDARD
colour
inside
Security for industrial automation and control systems –

Part 2-4: Security program requirements for IACS service providers

INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
ICS 25.040.40; 35.110 ISBN 978-2-8322-4679-5

IEC 62443-2-4 ®
Edition 1.1 2017-08
CONSOLIDATED VERSION
REDLINE VERSION
colour
inside
Security for industrial automation and control systems –
Part 2-4: Security program requirements for IACS service providers

– 2 – IEC 62443-2-4:2015+AMD1:2017 CSV

© IEC 2017
CONTENTS
FOREWORD . 3

INTRODUCTION . 5

1 Scope . 6

2 Normative references . 7

3 Terms, definitions, abbreviated terms and acronyms . 7

3.1 Terms and definitions. 7

3.2 Abbreviations . 10
4 Concepts . 11
4.1 Use of IEC 62443-2-4 . 11
4.1.1 Use of IEC 62443-2-4 by IACS service providers . 11
4.1.2 Use of IEC 62443-2-4 by IACS asset owners . 12
4.1.3 Use of IEC 62443-2-4 during negotiations between IACS asset owners
and IACS service providers . 12
4.1.4 Profiles . 13
4.1.5 IACS integration service providers . 13
4.1.6 IACS maintenance service providers . 14
4.2 Maturity model . 14
5 Requirements overview . 16
5.1 Contents . 16
5.2 Sorting and filtering . 16
5.3 IEC 62264-1 hierarchy model . 16
5.4 Requirements table columns . 16
5.5 Column definitions . 17
5.5.1 Req ID column . 17
5.5.2 BR/RE column . 17
5.5.3 Functional area column . 18
5.5.4 Topic column . 19
5.5.5 Subtopic column . 20
5.5.6 Documentation column . 22
5.5.7 Requirement description column . 22
5.5.8 Rationale column . 22
Annex A (normative) Security requirements . 23

Bibliography . 90

Figure 1 – Parts of the IEC 62443 Series . 5
Figure 2 – Scope of service provider capabilities . 6

Table 1 – Maturity levels . 15
Table 2 – Columns . 17
Table 3 – Functional area column values . 19
Table 4 – Topic column values . 20
Table 5 – Subtopic column values . 21
Table A.1 – Security program requirements . 23

© IEC 2017
INTERNATIONAL ELECTROTECHNICAL COMMISSION

____________
SECURITY FOR INDUSTRIAL AUTOMATION

AND CONTROL SYSTEMS –
Part 2-4: Security program requirements

for IACS service providers
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
in the subject dealt with may participate in this preparatory work. International, governmental and non-
governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
with the International Organization for Standardization (ISO) in accordance with conditions determined by
agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence
between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of

patent rights. IEC shall not be held responsible for identifying any or all such patent rights.
This consolidated version of the official IEC Standard and its amendment has been prepared
for user convenience.
IEC 62443-2-4 edition 1.1 contains the first edition (2015-06) [documents 65/545/CDV and
65/561A/RVC] and its corrigendum 1 (2015-08), and its amendment 1 (2017-08) [documents
65/637A/CDV and 65/661/RVC].
In this Redline version, a vertical line in the margin shows where the technical content is
modified by amendment 1. Additions are in green text, deletions are in strikethrough red text. A
separate Final version with all changes accepted is available in this publication.

– 4 – IEC 62443-2-4:2015+AMD1:2017 CSV

© IEC 2017
International Standard IEC 62443-2-4 has been prepared by IEC technical committee 65:

Industrial-process measurement, control and automation.

This publication contains an attached file in the form of an Excel 97-2003 spreadsheet version

of Table A.1. This file is intended to be used as a complement and does not form an integral

part of the publication.
This publication has been drafted in accordance with the ISO/IEC Directives, Part 2.

A list of all parts in the IEC 62443 series, published under the general title Security for

industrial automation and control systems, can be found on the IEC website.

Future standards in this series will carry the new general title as cited above. Titles of existing
standards in this series will be updated at the time of the next edition.
The committee has decided that the contents of the base publication and its amendment will
remain unchanged until the stability date indicated on the IEC web site under
"http://webstore.iec.ch" in the data related to the specific publication. At this date, the
publication will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
IMPORTANT – The 'colour inside' logo on the cover page of this publication indicates
that it contains colours which are considered to be useful for the correct
understanding of its contents. Users should therefore print this document using a
colour printer.
IEC
...

IEC 62443-2-4 ®
Edition 1.1 2017-08
CONSOLIDATED VERSION
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Security for industrial automation and control systems –
Part 2-4: Security program requirements for IACS service providers

Sécurité des automatismes industriels et des systèmes de commande –
Partie 2-4: Exigences de programme de sécurité pour les fournisseurs de
service IACS
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form

or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from

either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or

your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite
ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie

et les microfilms, sans l'accord écrit de l'IEC ou du Comité national de l'IEC du pays du demandeur. Si vous avez des

questions sur le copyright de l'IEC ou si vous désirez obtenir des droits supplémentaires sur cette publication, utilisez
les coordonnées ci-après ou contactez le Comité national de l'IEC de votre pays de résidence.

IEC Central Office Tel.: [phone]
3, rue de Varembé [e-mail]
CH-1211 Geneva 20 www.iec.ch
Switzerland
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigendum or an amendment might have been published.

IEC publications search - webstore.iec.ch/advsearchform Electropedia - www.electropedia.org
The advanced search enables to find IEC publications by a The world's leading online dictionary on electrotechnology,
variety of criteria (reference number, text, technical containing more than 22 000 terminological entries in English
committee,…). It also gives information on projects, replaced and French, with equivalent terms in 16 additional languages.
and withdrawn publications. Also known as the International Electrotechnical Vocabulary

(IEV) online.
IEC Just Published - webstore.iec.ch/justpublished
Stay up to date on all new IEC publications. Just Published IEC Glossary - std.iec.ch/glossary
details all new publications released. Available online and 67 000 electrotechnical terminology entries in English and
once a month by email. French extracted from the Terms and Definitions clause of
IEC publications issued since 2002. Some entries have been
IEC Customer Service Centre - webstore.iec.ch/csc collected from earlier publications of IEC TC 37, 77, 86 and
If you wish to give us your feedback on this publication or CISPR.

need further assistance, please contact the Customer Service

Centre: [e-mail].
A propos de l'IEC
La Commission Electrotechnique Internationale (IEC) est la première organisation mondiale qui élabore et publie des
Normes internationales pour tout ce qui a trait à l'électricité, à l'électronique et aux technologies apparentées.

A propos des publications IEC
Le contenu technique des publications IEC est constamment revu. Veuillez vous assurer que vous possédez l’édition la
plus récente, un corrigendum ou amendement peut avoir été publié.

Recherche de publications IEC - Electropedia - www.electropedia.org
webstore.iec.ch/advsearchform Le premier dictionnaire d'électrotechnologie en ligne au

La recherche avancée permet de trouver des publications IEC monde, avec plus de 22 000 articles terminologiques en
en utilisant différents critères (numéro de référence, texte, anglais et en français, ainsi que les termes équivalents dans
comité d’études,…). Elle donne aussi des informations sur les 16 langues additionnelles. Egalement appelé Vocabulaire
projets et les publications remplacées ou retirées. Electrotechnique International (IEV) en ligne.

IEC Just Published - webstore.iec.ch/justpublished Glossaire IEC - std.iec.ch/glossary
Restez informé sur les nouvelles publications IEC. Just 67 000 entrées terminologiques électrotechniques, en anglais
Published détaille les nouvelles publications parues. et en français, extraites des articles Termes et Définitions des
Disponible en ligne et une fois par mois par email. publications IEC parues depuis 2002. Plus certaines entrées
antérieures extraites des publications des CE 37, 77, 86 et
Service Clients - webstore.iec.ch/csc CISPR de l'IEC.

Si vous désirez nous donner des commentaires sur cette
publication ou si vous avez des questions contactez-nous:
[e-mail].
IEC 62443-2-4 ®
Edition 1.1 2017-08
CONSOLIDATED VERSION
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Security for industrial automation and control systems –

Part 2-4: Security program requirements for IACS service providers

Sécurité des automatismes industriels et des systèmes de commande –

Partie 2-4: Exigences de programme de sécurité pour les fournisseurs de

service IACS
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
INTERNATIONALE
ICS 25.040.40; 35.110 ISBN 978-2-8322-4679-5

IEC 62443-2-4 ®
Edition 1.1 2017-08
CONSOLIDATED VERSION
REDLINE VERSION
VERSION REDLINE
colour
inside
Security for industrial automation and control systems –
Part 2-4: Security program requirements for IACS service providers

Sécurité des automatismes industriels et des systèmes de commande –
Partie 2-4: Exigences de programme de sécurité pour les fournisseurs de
service IACS
– 2 – IEC 62443-2-4:2015+AMD1:2017 CSV

© IEC 2017
CONTENTS
FOREWORD . 4

INTRODUCTION . 6

1 Scope . 7

2 Normative references . 8

3 Terms, definitions, abbreviated terms and acronyms . 8

3.1 Terms and definitions. 8

3.2 Abbreviations . 11
4 Concepts . 12
4.1 Use of IEC 62443-2-4 . 12
4.1.1 Use of IEC 62443-2-4 by IACS service providers . 12
4.1.2 Use of IEC 62443-2-4 by IACS asset owners . 13
4.1.3 Use of IEC 62443-2-4 during negotiations between IACS asset owners
and IACS service providers . 13
4.1.4 Profiles . 14
4.1.5 IACS integration service providers . 14
4.1.6 IACS maintenance service providers . 15
4.2 Maturity model . 15
5 Requirements overview . 17
5.1 Contents . 17
5.2 Sorting and filtering . 17
5.3 IEC 62264-1 hierarchy model . 17
5.4 Requirements table columns . 17
5.5 Column definitions . 18
5.5.1 Req ID column . 18
5.5.2 BR/RE column . 18
5.5.3 Functional area column . 19
5.5.4 Topic column . 20
5.5.5 Subtopic column . 21
5.5.6 Documentation column . 23
5.5.7 Requirement description column . 23
5.5.8 Rationale column . 23
Annex A (normative) Security requirements . 24

Bibliography . 89

Figure 1 – Parts of the IEC 62443 Series . 5
Figure 2 – Scope of service provider capabilities . 6

Table 1 – Maturity levels . 15
Table 2 – Columns . 17
Table 3 – Functional area column values . 19
Table 4 – Topic column values . 20
Table 5 – Subtopic column values . 21
Table A.1 – Security program requirements . 23

© IEC 2017
INTERNATIONAL ELECTROTECHNICAL COMMISSION

____________
SECURITY FOR INDUSTRIAL AUTOMATION

AND CONTROL SYSTEMS –
Part 2-4: Security program requirements

for IACS service providers
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
in the subject dealt with may participate in this preparatory work. International, governmental and non-
governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
with the International Organization for Standardization (ISO) in accordance with conditions determined by
agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence
between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other
...