IEC 62443

Last updated

IEC 62443 is a series of standards that address security for operational technology in automation and control systems. The series is divided into different sections and describes both technical and process-related aspects of automation and control systems security.

Contents

History

In 2002, the International Society of Automation (ISA), a professional automation engineering society and ANSI-accredited standards development organization (SDO) established a standards committee (ISA99). This committee developed a multi-part series of standards and technical reports addressing the cybersecurity of Automation and Control Systems. These standards were initially published as ANSI/ISA-99 or ISA99 standards.

Around 2010, ISA99 strengthened its relationship with the International Electrotechnical Commission (IEC), leading to the renaming of the standards to ANSI/ISA-62443. The available content was submitted to and used by IEC working groups. Since then, the series has been commonly referred to as IEC 62443.

Meanwhile, the German engineering associations VDI and VDE released the VDI/VDE 2182 guidelines in 2011. The guidelines describe how to handle information security in industrial automation environments and were also submitted to and used by the IEC working groups.

Current Situation

The IEC 62443 series of standards is maintained by the International Electrotechnical Commission (IEC) Technical Committee 65 Working Group 10 (IEC TC65 WG10). The IEC working group and ISA99 committee continue to collaborate, creating joint leadership and project teams to develop the standards in the IEC 62443 series. Their collaboration integrates the processes and procedures of both ISA and IEC Directives, ensuring alignment in the development process.

The resulting standards are published by ISA as ANSI/ISA 62443 in the United States and by IEC as IEC 62443 internationally. For any given part of the series, the technical content of the ISA and IEC editions is identical where both organizations have accepted the content.

Relationship between IEC and ISA

The relationship between IEC and ISA in the development of the IEC 62443 series is characterized by complementary roles. IEC serves as the global standardization body responsible for publishing and maintaining the IEC 62443 series, while ISA contributes significant technical expertise, industry insight, and foundational drafts through its ISA99 committee.

ISA primarily focuses on the U.S. market and publishes standards under the ANSI/ISA 62443 designation. IEC, on the other hand, ensures global adoption and harmonization of the standards as IEC 62443.

While both organizations collaborate on the majority of standards, they retain the independence to develop and publish standards separately when consensus cannot be reached. For example, IEC developed and published IEC 62443-6-1 [1] independently without ISA involvement.

Industry Application

The IEC has approved the IEC 62443 family of standards as 'horizontal standards'. This means that when sector specific standards for operational technology are being developed by subject matter experts, the IEC 62443 standards must be used at the foundation for requirements addressing security in those standards. This approach serves to avoid the proliferation of partial and/or conflicting requirements for addressing security of automation and control systems across industry sectors where the same or similar technology or products are deployed at operating sites.

Structure

IEC 62443 Industrial communication networks - Network and system security series of standards consists of several parts, which are divided into six areas:

  1. General: Parts in this category describe the basic terms, concepts and models.
  2. Policies and Procedures: This primarily describes a system for managing industrial IT security.
  3. System: Various specifications for security functions of control and automation systems are described here.
  4. Components and Requirements: The requirements for product development processes for components of an automation solution are described here.
  5. Profiles:This section is intended to define industry-specific cybersecurity requirements and provide a structured approach to implementing measures based on the cybersecurity profiles described in IEC 62443-1-5.
  6. Evaluation: This section describes assessment methodologies that ensure that assessment results are consistent and reproducible with regard to the requirements of the individual parts.

The following table lists the parts of the IEC 62443 series of standards published to date with their status and title.

StandardTitleStatusDescription
IEC 62443-1-1Concepts and modelsTechnical Specification, Edition 1.0, July 2009 [2] This standard introduces the set of main cybersecurity elements (e.g., terms, figures, requirements, and concepts) that apply across the series and notably those that appear in two or more parts of the series.
IEC 62443-1-5Scheme for IEC 62443 security profilesTechnical Specification, Edition 1.0, September 2023 [3]
IEC 62443-2-1Security program requirements for IACS asset ownersEdition 2.0, 2024 [4] This part of the standard is aimed at operators of automation solutions and defines requirements for how security during the operation of plants is to be considered (see ISO/IEC 27001).
IEC 62443-2-3Patch management in the IACS environmentTechnical Report, Edition 1.0, June 2015 [5]
IEC 62443-2-4Requirements for IACS service providersEdition 2.0, December 2023 [6] This part defines requirements ("capabilities") for integrators. These requirements are divided into 12 topics: Assurance, architecture, wireless, security engineering systems, configuration management, remote access, event management and logging, user management, malware protection, patch management, backup & recovery, and project staffing.
IEC 62443-3-1Security technologies for industrial automation and control systemsTechnical Report, Edition 1.0, July 2009 [7]
IEC 62443-3-2Security risk assessment and system designEdition 1.0, June 2020 [8]
IEC 62443-3-3System security requirements and security levelsEdition 1.0, August 2013 [9]
IEC 62443-4-1Secure product development lifecycle requirementsEdition 1.0, January 2018 [10] This part defines how a secure product development process should look like. It is divided into eight areas ("Practices"): management of development, definition of security requirements, design of security solutions, secure development, testing of security features, handling of security vulnerabilities, creation and publication of updates and documentation of security features.
IEC 62443-4-2Technical security requirements for IACS componentsEdition 1.0, February 2019 [11] This part defines technical requirements for products or components. Like the requirements for systems (Section -3-3), the requirements are divided into 12 subject areas and refer to them. In addition to the technical requirements, common component security constraints (CCSC) are defined, which must be met by components to be compliant with IEC 62443-4-2:
  • CCSC 1 describes that components must take into account the general security characteristics of the system in which they are used.
  • CCSC 2 specifies that the technical requirements that the component cannot meet itself can be met by compensating countermeasures at system level (see IEC 62443-3-3). For this purpose, the countermeasures must be described in the documentation of the component.
  • CCSC 3 requires that the "Least Privilege" principle is applied in the component.
  • CCSC 4 requires that the component is developed and supported by IEC 62443-4-1 compliant development processes.
IEC 62443-6-1Security evaluation methodology for IEC 62443-2-4Technical Specification, Edition 1.0, March 2024 [1]

Developments and Activities

The standards in the IEC 62443 series of standards evolve constantly. According to IEC guidelines, all published standards will be periodically reviewed and either be confirmed to be current, updated (resulting in a new edition), or withdrawn.In addition, several parts of the series are under development [12] , including new editions of:

Foundational Concepts

There are several concepts that form the foundation of the IEC 62443 series.

Principal Roles

Standards in the series addresses the implications for several principal roles, including:

The different roles each follow a risk-based approach to prevent and manage security risks in their activities.

Maturity Level

The standards describe different maturity levels for processes through so-called "maturity levels". To fulfill a certain level of a maturity level, all process-related requirements must always be practiced during product development or integration, i.e. the selection of only individual criteria ("cherry picking") is not standard-compliant.

The maturity levels are described as follows:

Security Level

Technical requirements for systems (IEC 62443-3-3) and products (IEC 62443-4-2) are evaluated in the standard by four so-called Security Levels (SL). The different levels indicate the resistance against different classes of attackers. The standard emphasizes that the levels should be evaluated per technical requirement (see IEC 62443-1-1) and are not suitable for the general classification of products.

The levels are:

System Segmentation

Application of this concept involves grouping the systems and components of the automation and control system into a set of zones and conduits.

Zones divide a system into homogeneous zones by grouping the (logical or physical) assets with common security requirements. The security requirements are defined by Security Level (SL). The level required for a zone is determined by the risk analysis. Zones have boundaries that separate the elements inside the zone from those outside. Information moves within and between zones. Zones can be divided into sub-zones that define different security levels (Security Level) and thus enable defense-in-depth.

Conduits group the elements that allow communication between two zones. They provide security functions that enable secure communication and allow the coexistence of zones with different security levels.

Conformance certification

Processes, systems and products used in automation and control environments can be certified as conforming to IEC 62443. Many testing, inspection, and certification (TIC) companies offer product and process certifications based on IEC 62443. By accrediting according to the ISO/IEC 17000 series of standards, the companies share a single, consistent set of requirements for IEC 62443 certifications which elevates the usefulness of the resulting certificates of conformance.

Accredited certification schemes

IEC 62443 certification schemes have been established by several global testing, inspection, and certification (TIC) companies. The schemes are based on the referenced standards and define test methods, surveillance audit policies, public documentation policies, and other specific aspects of their program. Security certification programs for IEC 62443 standards are being offered globally by many recognized Certification Bodies (CB), including Bureau Veritas, Intertek, SGS-TÜV Saar, TÜV Nord, TÜV Rheinland, TÜV SÜD and UL.

A global infrastructure of national accreditation bodies (AB) ensures consistent evaluation of the IEC 62443. The ABs operate per the requirements of ISO/IEC 17011, a standard that contains requirements for the competence, consistency, and impartiality of accreditation bodies when accrediting conformity assessment bodies. ABs are members of the IAF for work in management systems, products, services, and personnel accreditation or the ILAC for laboratory accreditation. A Multilateral Recognition Arrangement (MLA) between ABs will ensure global recognition of accredited CBs.

TIC companies are accredited by an AB to provide inspection according to the ISO/IEC 17020, testing laboratories according to ISO/IEC 17025 and certification of products, processes, and services according to ISO/IEC 17065.

IECEE CB Scheme

The IEC System for Conformity Assessment Schemes for Electrotechnical Equipment and Components (IECEE) Certification Body Scheme (CB Scheme) is a multilateral agreement that facilitates market access for manufacturers of electrical and electronic products. Under the CB Scheme processes, products and systems can be certified according to IEC 62443.

The origin of the CB Scheme comes from the CEE (former European "Commission for Conformity Testing of Electrical Equipment") and was integrated into the IEC in 1985. Currently, 54 Member Bodies are in the IECEE, 88 NCBs (National Certification Bodies), and 534 CB Test Laboratories (CBTL). In the field of product certification, this procedure is used to reduce the complexity in the approval procedure for manufacturers of products tested and certified according to harmonized standards. A product that has been tested by a CBTL (certified testing laboratory) according to a harmonized standard such as the IEC 62443, can use the CB report as a basis for a later national certification and approval such as GS, PSE, CCC, NOM, GOST/R, BSMI.

ISCI ISASecure

The ISA Security Compliance Institute (ISCI), a wholly owned subsidiary of the ISA, created an industry consensus conformity assessment scheme that certifies to the IEC 62443 standards and operates under the ISASecure brand. This scheme is used to certify automation control systems, components and processes. ISASecure certifications were expanded to include the Industrial IOT component certification (ICSA) in December 2022. Certification Bodies in the ISASecure certification scheme are independently accredited by ISO 17011 Accreditation Bodies to the ISASecure technical readiness requirements and the ISO 17025 and ISO 17065 standards. Multilateral recognition agreements under the IAF ensure that the ISASecure certifications are mutually recognized by all global IAF signatories.

The ISCI offers multiple certifications under the ISASecure brand:

See also

Related Research Articles

<span class="mw-page-title-main">American National Standards Institute</span> American standards development organization

The American National Standards Institute is a private nonprofit organization that oversees the development of voluntary consensus standards for products, services, processes, systems, and personnel in the United States. The organization also coordinates U.S. standards with international standards so that American products can be used worldwide.

The Common Criteria for Information Technology Security Evaluation is an international standard for computer security certification. It is currently in version 3.1 revision 5.

<span class="mw-page-title-main">International Society of Automation</span> Non-commercial Organization

The International Society of Automation (ISA) Is a non-profit technical society for engineers, technicians, businesspeople, educators and students, who work, study or are interested in automation and pursuits related to it, such as instrumentation. Originally known as the Instrument Society of America, the society is more commonly known by its acronym, ISA. The society's scope now includes many technical and engineering disciplines.

IEC 61850 is an international standard defining communication protocols for intelligent electronic devices at electrical substations. It is a part of the International Electrotechnical Commission's (IEC) Technical Committee 57 reference architecture for electric power systems. The abstract data models defined in IEC 61850 can be mapped to a number of protocols. Current mappings in the standard are to Manufacturing Message Specification (MMS), GOOSE [see section 3, Terms and definitions, term 3.65 on page 14], SV or SMV, and soon to web services. In the previous version of the standard, GOOSE stood for "Generic Object Oriented Substation Event", but this old definition is still very common in IEC 61850 documentation. These protocols can run over TCP/IP networks or substation LANs using high speed switched Ethernet to obtain the necessary response times below four milliseconds for protective relaying.

Fieldbus Foundation was an organization dedicated to a single international, interoperable fieldbus standard. It was established in September 1994 by a merger of WorldFIP North America and the Interoperable Systems Project (ISP). Fieldbus Foundation was a not-for-profit trade consortium that consisted of more than 350 of the world's suppliers and end users of process control and manufacturing automation products. Working together those companies made contributions to the IEC/ISA/FDI and other fieldbus standards development.

In functional safety, safety integrity level (SIL) is defined as the relative level of risk-reduction provided by a safety instrumented function (SIF), i.e. the measurement of the performance required of the SIF.

Accreditation is the independent, third-party evaluation of a conformity assessment body against recognised standards, conveying formal demonstration of its impartiality and competence to carry out specific conformity assessment tasks.

Information security standards are techniques generally outlined in published materials that attempt to protect a user's or organization's cyber environment. This environment includes users themselves, networks, devices, all software, processes, information in storage or transit, applications, services, and systems that can be connected directly or indirectly to networks.

<span class="mw-page-title-main">Certification</span> Formal attestation of certain characteristics of an object, person, or organization

Certification is part of testing, inspection and certification and the provision by an independent body of written assurance that the product, service or system in question meets specific requirements. It is the formal attestation or confirmation of certain characteristics of an object, person, or organization. This confirmation is often, but not always, provided by some form of external review, education, assessment, or audit. Accreditation is a specific organization's process of certification. According to the U.S. National Council on Measurement in Education, a certification test is a credentialing test used to determine whether individuals are knowledgeable enough in a given occupational area to be labeled "competent to practice" in that area.

<span class="mw-page-title-main">Product certification</span> Performance and quality assurance

Product certification or product qualification is the process of certifying that a certain product has passed performance tests and quality assurance tests, and meets qualification criteria stipulated in contracts, regulations, or specifications.

IEC 61508 is an international standard published by the International Electrotechnical Commission (IEC) consisting of methods on how to apply, design, deploy and maintain automatic protection systems called safety-related systems. It is titled Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems.

The Common Criteria model provides for the separation of the roles of evaluator and certifier. Product certificates are awarded by national schemes on the basis of evaluations carried by independent testing laboratories.

An independent test organization is an organization, person, or company that tests products, materials, software, etc. according to agreed requirements. The test organization can be affiliated with the government or universities or can be an independent testing laboratory. They are independent because they are not affiliated with the producer nor the user of the item being tested: no commercial bias is present. These "contract testing" facilities are sometimes called "third party" testing or evaluation facilities.

ISO/IEC 27006 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Part of the ISO/IEC 27000 series of ISO/IEC Information Security Management System (ISMS) standards, it is titled Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems.

ISO/IEC 17024: Conformity assessment - General requirements for bodies operating certification of persons is an ISO/IEC standard which specifies criteria for the operation of a certification body for persons. The standard includes requirements for the development and maintenance of the certification scheme for persons upon which the certification is based.

Functional safety is the part of the overall safety of a system or piece of equipment that depends on automatic protection operating correctly in response to its inputs or failure in a predictable manner (fail-safe). The automatic protection system should be designed to properly handle likely systematic errors, hardware failures and operational/environmental stress.

ISO 26262, titled "Road vehicles – Functional safety", is an international standard for functional safety of electrical and/or electronic systems that are installed in serial production road vehicles, defined by the International Organization for Standardization (ISO) in 2011, and revised in 2018.

Control system security, or automation and control system (ACS) cybersecurity, is the prevention of interference with the proper operation of industrial automation and control systems. These control systems manage essential services including electricity, petroleum production, water, transportation, manufacturing, and communications. They rely on computers, networks, operating systems, applications, and programmable controllers, each of which could contain security vulnerabilities. The 2010 discovery of the Stuxnet worm demonstrated the vulnerability of these systems to cyber incidents. The United States and other governments have passed cyber-security regulations requiring enhanced protection for control systems operating critical infrastructure.

Cantata++, commonly referred to as Cantata in newer versions, is a commercial computer program designed for dynamic testing, with a focus on unit testing and integration testing, as well as run time code coverage analysis for C and C++ programs. It is developed and marketed by QA Systems, a multinational company with headquarters in Waiblingen, Germany.

<span class="mw-page-title-main">Standardisation Testing and Quality Certification</span> Science and technology agency of the Government of India

Standardisation Testing and Quality Certification (STQC) Directorate, established in 1980, is an authoritative body offering quality assurance services to IT and Electronics domains.

References

  1. 1 2 "IEC TS 62443-6-1:2024". webstore.iec.ch. Retrieved 2024-12-27.
  2. ↑ "IEC TS 62443-1-1:2009". webstore.iec.ch. Retrieved 2024-12-27.
  3. ↑ "IEC TS 62443-1-5:2023". webstore.iec.ch. Retrieved 2024-12-27.
  4. ↑ "IEC 62443-2-1:2024". webstore.iec.ch. Retrieved 2024-12-27.
  5. ↑ "IEC TR 62443-2-3:2015". webstore.iec.ch. Retrieved 2024-12-27.
  6. ↑ "IEC 62443-2-4:2023". webstore.iec.ch. Retrieved 2024-12-27.
  7. ↑ "IEC TR 62443-3-1:2009". webstore.iec.ch. Retrieved 2024-12-27.
  8. ↑ "IEC 62443-3-2:2020". webstore.iec.ch. Retrieved 2024-12-27.
  9. ↑ "IEC 62443-3-3:2013". webstore.iec.ch. Retrieved 2024-12-27.
  10. ↑ "IEC 62443-4-1:2018". webstore.iec.ch. Retrieved 2024-12-27.
  11. ↑ "IEC 62443-4-2:2019". webstore.iec.ch. Retrieved 2024-12-27.
  12. ↑ "TC 65 Project Plans".
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.