Build an IEC 62443-2-1 security program for your OT estate

IEC 62443-2-1 is the part of the IEC 62443 series that defines security program requirements for asset owners and operators of industrial automation and control systems in operation. The 2024 edition groups 87 requirements into eight security program elements, from organisational security and network segmentation to access control, event management and backup. It specifies the policies and procedures an asset owner needs, rather than technical product features.

The 2024 second edition replaced the 2010 first edition with a technical revision. According to IEC, it restructured the requirements into security program elements (SPEs), removed requirements that duplicated an information security management system, and introduced a maturity model for evaluating how well each requirement is implemented. It also includes informative cross-references to IEC 62443-2-4, 3-3, 4-2, ISO/IEC 27001:2013 and the NIST Cybersecurity Framework.

IEC 62443-2-1 is written for asset owners, which includes the operators of an IACS. Typical adopters are manufacturers, energy and water utilities, oil and gas and other critical infrastructure organisations running operational technology. It is a voluntary standard, but organisations use it to demonstrate a recognised OT security approach to regulators, insurers and customers, and to set expectations for their service providers and suppliers.

IEC 62443-2-1 covers the asset owner's security program: policies, procedures and organisational measures for running an IACS. IEC 62443-3-3 sets technical security requirements and security levels for a control system, IEC 62443-4-1 covers a product supplier's secure development lifecycle, and IEC 62443-4-2 sets technical requirements for individual components. Part 2-1 relies on those capabilities and helps asset owners specify them to suppliers.

IEC 62443-2-1 complements ISO 27001 rather than replacing it. The 2024 edition was revised to avoid duplicating an information security management system, and its first requirement, ORG 1.1, addresses the ISMS itself. Annex A cross-references the requirements to ISO/IEC 27001:2013. Organisations with an ISO 27001 ISMS can extend it with the OT specific requirements in part 2-1, such as zone segmentation, safety system protection and patch validation.

Start by identifying which requirements apply to each IACS in its operating environment, since wireless, remote access or legacy constraints change the scope. Then assess the current maturity level for each applicable requirement, set target levels based on risk, write the required policies and procedures, implement controls or compensating measures, and keep conformity evidence. Third party assessment against the standard is available from certification bodies.

Yes, with limits. The standard recognises that an IACS can operate for more than twenty years and that unsupported hardware or software may be unable to meet some requirements, such as security patching or backup. In those cases the asset owner documents policies and procedures that use compensating security measures, and the security program for most legacy systems addresses only a subset of the requirements.

Yes, on request. IEC 62443-2-1:2024 is mapped in OneClickComply's control library and available on request rather than as a live self-serve framework. Once enabled, you can generate policies, manage risks and suppliers, and collect evidence against its requirements, with controls shared with ISO 27001 and other frameworks. OneClickComply does not issue IEC 62443 certification; assessment is carried out by an independent certification body.