ISA/IEC 62443 Lead Implementer study plan

Map the Purdue Enterprise Reference Architecture levels 0-5 to the zones and conduits model, and explain in your own words where a safety instrumented system and a basic process control system sit relative to each other.

Distinguish the CIA triad priorities in IACS from enterprise IT by writing a short rationale for why availability and safety typically outrank confidentiality on the plant floor.

Define the seven foundational requirements (FR 1-7) from memory and give one concrete IACS example of a control gap for each.

Differentiate IT security controls from OT security controls across patching cadence, asset lifetime, and change management, citing at least three structural reasons for the difference.

Trace the ISA/IEC 62443 series structure (62443-1 through 62443-4) and identify which parts address general concepts, policies and procedures, system requirements, and component requirements.

Explain the difference between the zone/conduit model and a flat network, and justify why segmentation is the primary architectural control in IACS.

Describe the security levels SL 1-4 and map each to a threat actor capability profile (casual, intentional low-resource, sophisticated, nation-state).

Identify the roles in the 62443 ecosystem (asset owner, service provider, product supplier, integrator) and state which parts of the standard bind each role.

Explain the difference between target SL (SL-T), achieved SL (SL-C), and capability SL (SL-Cap), and construct a worked example where SL-C falls short of SL-T and a compensating control closes the gap.

Walk through the risk assessment process: asset inventory, threat modeling, vulnerability identification, consequence and likelihood scoring, and risk treatment options (avoid, mitigate, transfer, accept).

Apply the zone and conduit design process to a hypothetical plant with a DMZ, a control zone, and a safety zone, and justify each conduit's allowed traffic.

Describe the IACS security lifecycle (assess, design, implement, operate, maintain, decommission) and identify the feedback loops between phases.

Review the week 1-3 material and close recall gaps on foundational requirements, security levels, and the zone/conduit model.

Explain the difference between a patch management program and a vulnerability management program in OT, and describe how compensating controls (virtual patching, network segmentation, monitoring) bridge the gap when patching is infeasible.

Describe the role of the CSMS (cyber security management system) and how it differs from an information security management system under ISO/IEC 27001.

Identify common IACS threat vectors (removable media, remote access, supply chain, wireless, human error) and match each to a control family.

Apply the 62443-3-3 system requirements (SR 1-7) to a control zone and select the appropriate requirement enhancements for a target SL 3 zone.

Explain how the 62443-4-2 component requirements differ from the 62443-3-3 system requirements, and identify which component requirements apply to a PLC, an HMI, and a network switch.

Describe the 62443-4-1 secure development lifecycle requirements and explain what an asset owner should ask a product supplier to demonstrate.

Interpret the concept of a security requirements specification and draft one for a new control system procurement.

Explain how uptime and resilience objectives shape the selection of security controls, and identify controls that improve both security and availability versus those that trade one for the other.

Describe the incident response lifecycle for IACS (prepare, detect, contain, eradicate, recover, lessons learned) and explain how containment decisions differ when a process is running.

Explain the role of monitoring and detection in an IACS environment, including what is normal baseline behavior and why anomaly detection is difficult in deterministic control networks.

Describe backup, restore, and disaster recovery considerations for control systems, and explain the concept of a validated restore.

Explain how critical infrastructure protection frameworks (national and sector-specific) interact with 62443, and identify where 62443 provides the technical detail that higher-level frameworks reference.

Describe the assessment and certification landscape for 62443 (self-assessment, certification bodies, component and system certification) and explain what each attestation actually proves.

Apply the concept of defense in depth to a multi-zone architecture and identify at least four layers where a control failure would be caught by a subsequent layer.

Explain supply chain security requirements in 62443 and how an asset owner verifies supplier claims.

Synthesize domain 1 and domain 2 concepts by walking a complete scenario from asset inventory through zone design, SL-T assignment, gap analysis, control selection, and residual risk acceptance.

Review all self-assessment gaps from week 4 and later and confirm each is closed.

Practice scenario-based reasoning for at least ten exam-style situations where the correct answer depends on the asset owner role, the security level, and the uptime constraint.

State the key distinctions between 62443-3-3 and 62443-4-2, between SL-T and SL-C, and between IT and OT security priorities without reference material.