ISA/IEC 62443 Lead Implementer cheat sheet

Purdue model levels: 0 process, 1 basic control, 2 supervisory control, 3 site operations, 3.5 DMZ, 4 enterprise, 5 external; conduits exist only between adjacent or explicitly justified levels.

ISA/IEC 62443 defines four security requirements: FR1 identification and authentication control, FR2 use control, FR3 system integrity, FR4 data confidentiality, FR5 restricted data flow, FR6 timely response to events, FR7 resource availability - seven FRs total; memorise FR1–FR7 numbering.

Security Levels SL0–SL4 describe protection against increasing attacker capability: SL1 casual/unintentional, SL2 intentional with simple means and low resources, SL3 sophisticated with moderate resources, SL4 state-sponsored with extended resources.

Foundational Requirements map to Security Levels through system requirements (SR) and requirement enhancements (RE); a component's SL capability is not the same as its achieved SL in a given zone.

Zone = grouping of assets sharing common security requirements; Conduit = controlled communication path between zones. Zones are defined by risk, not by network topology alone.

IACS priority order is safety, availability, integrity, confidentiality - the inverse of typical IT ordering, which places confidentiality first.

The 62443 series structure: 1-x general (terminology, metrics, lifecycle), 2-x asset owner (policies, patch management), 3-x system integrator (system security requirements, SL verification), 4-x component supplier (component requirements, technical security requirements).

Defence in depth means independent, layered countermeasures so a single failed control does not expose the process; compensating controls must be documented when a required SR cannot be met.

OT constraints that drive design: long asset lifetimes (15–25 years), deterministic real-time behaviour, proprietary protocols, unpatchable legacy devices, and safety instrumented systems that must not be scanned intrusively.

Risk assessment per 62443-3-2 produces target SLs per zone and conduit; SL target is derived from consequence severity and threat likelihood, then compared against achieved SL from 62443-3-3 requirements.

The IACS security lifecycle (62443-2-4 / 4-1) has phases: assess, design, implement, operate, maintain, decommission - with verification evidence required at each transition.

Gap analysis output is a comparison of required SR/RE against implemented controls; unmet requirements are closed by remediation or by a formally risk-accepted compensating control.

SL verification (62443-3-3) uses four requirement types: SR, RE, capability (CL), and achieved - component capability must meet or exceed the zone target.

Patch management for OT: test in a representative lab, schedule within maintenance windows, maintain rollback images, and apply virtual patching or compensating controls when a vendor patch is unavailable.

Account and access controls: unique accounts, least privilege, role-based access, session lockout, and removal of shared and vendor-default credentials before commissioning.

Event monitoring must not degrade control traffic - use passive network monitoring, span ports, or unidirectional gateways rather than active scanning of Level 0–2 assets.

Business continuity for IACS requires documented manual fallback procedures and tested recovery of configuration backups, since restoring a control system is not equivalent to restoring an IT server.

Conduit design rules: terminate at a DMZ, deny by default, allow only required protocols and directions, and log all traffic crossing the conduit boundary.