IEC 62443 Industrial Cybersecurity Certification

Cybersecurity for cyber-physical systems

Across a variety of industries, from manufacturing and processing plants to energy suppliers and rail, cyber-physical systems are implemented to enable higher efficiencies, unmatched flexibility, and innovative business models. However, this also translates into a shift in the risk landscape, as cyber-attacks increase. Against this backdrop, suppliers and system integrators must optimize the cyber resilience of their components and systems by improving their development, integration, and support processes.

The IEC 62443 standard provides a structured approach to cybersecurity

Initially developed for the Industrial Automation and Control Systems supply chain, it has become the leading industrial cybersecurity standard for all types of plants, facilities, and systems across many industries.

The standard applies to component suppliers, system integrators, and asset owners.

The IEC 62443 standard doesn't solely address the technology that comprises a control system, but the work processes, countermeasures, and employees.

Through a set of defined process requirements, the standard ensures that all applicable security aspects are addressed in a structured manner.

Security aspects include a systematic approach to cybersecurity throughout the stages of:

• Specification 
• Integration
• Operation
• Maintenance 
• Decommissioning

Furthermore, the standard foresees that processes get established to facilitate all necessary technical security functions. Adapted to the relevant project scope, it lays the foundations for cybersecurity robustness throughout the product and system lifetime.

IEC 62443 certification can also boost the competitiveness of the supplier and system integrator: A third-party certification demonstrates to asset owners and operators that the purchased component or system is based on a methodized and coherent approach to cybersecurity, in line with industry best practice.

TÜV SÜD can help you achieve certification

TÜV SÜD was one of the first companies to provide IEC 62443 certification. Suppliers and system integrators worldwide partner with us to confirm their compliance to applicable process requirements as laid out in the standard.

Our extensive experience with industrial processes, combined with profound expertise in industrial cybersecurity, makes us uniquely positioned to assess your security processes and solutions. Our methodology for risk analysis, applying both security and safety aspects, is proven in the field. Our experts actively participate in international standardization committees, gaining valuable insights on the latest regulatory developments. Our experts’ relentless commitment to instill safe operations across industries, means that the TÜV SÜD certification mark has become a globally renowned symbol for safety, security, and trust.

Key documents in the iec 62443 series

Of the 14 separate documents in the IEC 62443 series, these cybersecurity requirements represent a good starting point for industrial organizations seeking to secure their automation control systems from cyber threats.

ISASECURE® IEC 62443 CONFORMANCE CERTIFICATION

The ISASecure® Certification program certifies products and supplier development practices to the ISA/IEC 62443 series of Industrial Automation and Control standards. The product evaluation process includes a security vulnerability scan using a commercially available scanning tool that evaluates the product against the US-CERT NVDB.

TÜV SÜD is an ISASecure® Chartered Laboratory (License No. ISCI-CL0006) authorized by ISA Security Compliance Institute (ISCI), a not-for-profit consortium that manages the ISASecure® conformance certification program.

We offer four types of certifications with security assurance levels (SAL) in alignment with ISA/IEC 62443 standards:

• ISASecure® Component Security Assurance (CSA) Certification, certifies to ISA/IEC 62443-4-1 and ISA/IEC 62443-4-2 at four security assurance levels.
• ISASecure® IIoT Component Security Assurance (ICSA) Certification, certifies to ISA/IEC 62443-4-1 and ISA/IEC 62443-4-2 with several requirement enhancements and four requirement exceptions to account for IIOT device characteristics. Two SAL’s are defined for this certification, along with market surveillance audits.
• ISASecure® System Security Assurance (SSA) Certification, certifies to ISA/IEC 62443-4-1 and ISA/IEC 62443-3-3.
• ISASecure® Security Development Lifecycle Assurance (SDLA) Certification, certifies product suppliers’ SDL to the ISA/IEC 62443-4-1 standard. Supplier must meet maturity level 3 or 4.

A product supplier’s development process, component, or system that passes evaluation according to the latest version of ISASecure® specifications will be granted with ISASecure® certification by TÜV SÜD. The ISASecure® mark may not be affixed on certified products and systems.