Fundamental Principles and Concepts of IACS
What this domain tests
Domain 1 asks you to reason about industrial automation and control systems (IACS) as operational technology, not as office IT. The exam tests whether you can explain the 62443 model-zones, conduits, security levels (SL), foundational requirements (FRs)-and apply it without sacrificing safety or process availability. Expect terminology questions and short scenarios that expose IT-centric assumptions.
Core rules and concepts
- IACS includes PLCs, RTUs, DCS, SIS, HMIs, historians, and engineering workstations. Many are legacy, long-lived, real-time, and resource-constrained.
- The Purdue model separates enterprise (Level 4/5), DMZ (3.5), site operations (3), supervisory control (2), basic control (1), and physical process (0). Segmentation supports defense in depth, but the model is descriptive, not a compliance checklist.
- ISA/IEC 62443-1-1 defines the security model; 62443-3-3 defines seven FRs: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.
- Zones group assets with common security requirements; conduits are controlled communication paths between zones. Target SL (SL-T) is a zone/conduit property; capability SL (SL-C) is a component property. Do not confuse SL with SIL, the safety integrity level of a safety function.
- Security objectives must be balanced with safety, availability, integrity, and confidentiality. In IACS, an unplanned outage or unsafe action can be worse than a data disclosure.
Worked example
A SIS shares an Ethernet switch with the BPCS. A proposal would apply corporate “confidentiality first” controls and remote patching to the SIS. Reasoning: the SIS exists to bring the process to a safe state; its integrity and availability dominate. Sharing the switch creates an unnecessary conduit. The correct move is to document the SIS as its own zone, remove or tightly control the shared path, assess consequence, and select controls that do not delay the safety function. Patching needs a maintenance window, rollback, and compensating controls-not an IT-style weekly push.
Traps that cost marks
Equating SL 4 with “best”; treating a VLAN as a full zone boundary; assuming 62443 requires the Purdue model; confusing SL-T, SL-A, and SL-C; and applying IT confidentiality priorities to safety functions without a risk assessment.