Our IEC 62443 consulting helps the operators and suppliers of industrial control systems turn the standard into decisions: which zones you have, how they connect, what security level each one needs, and how to get there without putting safety or production at risk. Security Solution Consultants (SSC) provides IEC 62443-3-2 risk assessments, zone and conduit design, OT security assessments and security program reviews for energy, water, transport, mining and manufacturing, and gap assessments for product suppliers preparing for certification. We work across Australia, New Zealand and the Gulf, where IEC 62443 sits alongside the SOCI Act, the AESCSF and Saudi Arabia’s OTCC.
ISA/IEC 62443 is a series of standards for securing industrial automation and control systems (IACS). Its parts are written for different roles: the asset owner who runs the plant, the integrator or service provider who builds and maintains it, and the supplier who makes the components. The parts most engagements use are:
| Part | Title | Written for | How we use it |
|---|---|---|---|
| 62443-2-1 | Security program requirements for IACS asset owners (Edition 2.0, 2024) | Asset owners and operators | Design or assess your OT security program. The 2024 edition restructures requirements into program elements and adds a maturity model. |
| 62443-2-4 | Security program requirements for IACS service providers | Integrators and maintenance providers | Set and check requirements for the integrators and vendors who work on your systems. |
| 62443-3-2 | Security risk assessment for system design | Asset owners and integrators | Define the system, partition it into zones and conduits, assess risk and set a target security level for each. |
| 62443-3-3 | System security requirements and security levels | Integrators and asset owners | System requirements under seven foundational requirements, FR 1 to FR 7, at security levels 1 to 4. |
| 62443-4-1 | Secure product development lifecycle requirements | Product suppliers | Gap assessment of your secure development lifecycle. |
| 62443-4-2 | Technical security requirements for IACS components | Product suppliers | Gap assessment of a component’s security capability. |
A zone groups assets that share the same security requirements; a conduit groups the communication channels that connect two or more zones and share common security requirements. IEC 62443-3-2 sets out the process: define the system under consideration, partition it into zones and conduits, assess the risk of each, set a target security level for each, and document the resulting security requirements.
The series uses three views of a security level, and the gaps between them are where the work is:
Where SL-A falls short of SL-T, you have a remediation plan. Where SL-C falls short of SL-T, no amount of configuration will close the gap, and compensating countermeasures, such as a tighter conduit, are needed.
| Security level | Protects against |
|---|---|
| SL 1 | Casual or coincidental violation |
| SL 2 | Intentional violation using simple means, with low resources, generic skills and low motivation |
| SL 3 | Intentional violation using sophisticated means, with moderate resources, IACS-specific skills and moderate motivation |
| SL 4 | Intentional violation using sophisticated means, with extended resources, IACS-specific skills and high motivation |
Most of our engagements are for asset owners: the utilities, ports, mines and plants that own the risk. We also work with system integrators who need to show that what they deliver meets a specified SL-T, and with product suppliers whose customers now ask for evidence against 62443-4-1 and 62443-4-2 before they buy.
Operational technology controls physical processes, so availability and safety come first. Our OT security assessments are passive by default:
We map every finding to the obligations it supports, so one body of evidence serves several regimes.
| Obligation | Where IEC 62443 work helps |
|---|---|
| SOCI Act CIRMP | The enhanced CIRMP rules require an inventory of critical systems and how they connect, and network segregation so critical systems can operate independently, by about June 2028. A zone and conduit model is a direct way to evidence both. IEC 62443 is not itself one of the recognised CIRMP cyber frameworks, so we map the work into the framework you have chosen. |
| AESCSF version 2 | Supports practices in the cyber security architecture domain added in version 2, and in asset, threat and vulnerability, and access management. |
| Saudi NCA OTCC-1:2022 | The National Cybersecurity Authority’s extension of the Essential Cybersecurity Controls for industrial control systems. We map zone, conduit and remote access findings to OTCC controls for Saudi operators. |
| NIST SP 800-82 Rev. 3 | NIST’s guide to OT security, often used alongside IEC 62443 for architecture and monitoring. |
We advise; we do not certify. SSC is an independent consultancy, not a certification body. We are not an IECEE or ISASecure certification body and we do not issue IEC 62443 certificates. We prepare asset owners and suppliers for assessment by an accredited body, and keeping the adviser separate from the certifier protects the value of the certificate.
Related services: energy sector security assessments and AESCSF, SOCI Act compliance and CIRMP audit, penetration testing and OT assessments and critical infrastructure and OT security training.
A series of international standards, published jointly as ISA/IEC 62443, for securing industrial automation and control systems. It covers security programs for asset owners and service providers, risk assessment and system design using zones and conduits, and security requirements for systems, products and components.
SL-T is the target security level a zone or conduit needs, set by the risk assessment. SL-C is the level a system or component can provide when properly configured. SL-A is the level actually achieved in operation, which is what an assessment measures.
A zone is a group of assets that share the same security requirements. A conduit is a group of communication channels that connect zones and share common security requirements. Together they give each part of the plant a defined boundary and a target security level.
Not by default. We rely on documentation, interviews, offline configuration review and passive traffic analysis. Any active testing is agreed in writing with operations and done in a maintenance window or on a test bench.
No. SSC is an independent consultancy, not an IECEE or ISASecure certification body, and does not issue IEC 62443 certificates. We prepare asset owners and suppliers for assessment by an accredited body.
Not on its own. The CIRMP rules name specific recognised frameworks, such as ISO/IEC 27001, the Essential Eight, the NIST Cybersecurity Framework, C2M2 and the AESCSF. IEC 62443 work provides strong evidence for the OT parts of the program, and we map it into the framework you have chosen.
Asset owners usually start with a 62443-3-2 risk assessment of one important system, which produces the zone and conduit model and target security levels, then build the 62443-2-1 program around it. Product suppliers start with 62443-4-1 for the development lifecycle, then 62443-4-2 for each component.
Yes. For Saudi operators we map IEC 62443 findings to the National Cybersecurity Authority's Operational Technology Cybersecurity Controls (OTCC-1:2022), the extension of the Essential Cybersecurity Controls for industrial control systems.
Tell us where you are today and what you need to achieve. We will come back with a clear scope, timeline and fixed quote.
Secure your cloud environments & ensure safe migration with compliance-ready.
Stay informed with the latest cybersecurity news and expert tips.
Copyright © 2026 Security Solution Consultants. ABN 87 616 212 063. Tarneit, Victoria 3029, Australia. All Rights Reserved.
