Application of ISA/IEC 62443 Standards for Uptime, Resilience, and Critical Infrastructure Protection
What this domain tests
This domain moves from vocabulary to implementation: using the ISA/IEC 62443 series to keep critical processes running while reducing risk. Questions ask how to establish a security management system, perform a risk assessment, set target security levels, select compensating controls, and protect uptime when patching or remote support is unavoidable.
Core rules and concepts
- 62443-2-1 defines requirements for an IACS security management system (CSMS): risk assessment, policy, organization, asset inventory, training, incident response, and continuous improvement. 62443-3-2 covers risk assessment and zone/conduit design; 62443-3-3 supplies system security requirements and SLs.
- Start from criticality: identify safety, production, environmental, and regulatory consequences. A zone’s SL-T should reflect the credible threat and consequence, not a blanket “SL 4.”
- Resilience is designed, not bolted on: segmentation and DMZs, controlled remote access, backups tested by restore, spare hardware, redundant networks where justified, and documented manual operating procedures.
- 62443-2-3 treats patching as risk-managed. When a patch cannot be applied, use compensating controls: virtual patching, allowlisting, network restriction, enhanced monitoring, and a dated risk acceptance.
- Supplier and component requirements flow through 62443-2-4, 4-1, and 4-2. Ask for SL-C evidence and secure development practices, but verify that component capability supports the zone’s SL-T.
Worked example
A substation RTU is supported by a vendor over a persistent VPN from the internet. The critical service is protection and control; loss of view or unauthorized control could cause physical damage. The team defines a substation control zone and a separate vendor support zone, with a conduit through a jump host. Because consequence is high and the threat is targeted, SL-T 3 is plausible. Controls: MFA, allowlisting, session recording, time-limited access, no direct PLC route, and an out-of-band patch process. The residual risk and manual fallback are documented.
Traps that cost marks
Treating SL 4 as mandatory for critical infrastructure; using a firewall as the only conduit control; patching without rollback or compensating controls; assuming backups are valid without restore tests; and ignoring manual operations during a cyber incident.