Meet IEC 62443-3-3 system requirements with evidence in one place

IEC 62443-3-3 is an international standard that defines the technical security requirements for an industrial automation and control system. Published in 2013, it sets out 51 system requirements under seven foundational requirements, such as identification and authentication control, use control and system integrity. Requirement enhancements map each requirement to capability security levels 1 to 4, so a system can be specified and assessed against a target level.

No law makes IEC 62443-3-3 mandatory on its own, but it is widely expected in operational technology. System integrators and control system suppliers use it to demonstrate the security capability of systems they deliver, and asset owners in energy, water, manufacturing and other critical sectors often require it in procurement. It is commonly referenced when defining target security levels for zones and conduits.

The seven foundational requirements are: identification and authentication control (FR 1), use control (FR 2), system integrity (FR 3), data confidentiality (FR 4), restricted data flow (FR 5), timely response to events (FR 6) and resource availability (FR 7). They come from IEC 62443-1-1, and IEC 62443-3-3 breaks them into 51 system requirements with enhancements for higher security levels.

Security levels describe how strong a system's protection is, from SL 1 (protection against casual or coincidental violation) up to SL 4 (protection against intentional attack using sophisticated means and extensive resources). IEC 62443-3-3 defines capability security levels (SL-C) for a system. Asset owners set target levels (SL-T) for each zone, and the achieved level (SL-A) is what is actually in place.

IEC 62443-3-3 covers technical requirements for a whole control system. IEC 62443-2-1 covers the security programme an asset owner runs, IEC 62443-4-1 covers the secure development lifecycle for product suppliers, and IEC 62443-4-2 covers technical requirements for individual components such as controllers and network devices. Together they form a layered approach, and 3-3 sits at the system level between them.

Yes. Control systems can be certified against IEC 62443-3-3 by accredited certification bodies, for example through the ISASecure System Security Assurance (SSA) scheme or the IECEE CB Scheme. A certificate states the capability security level achieved for each zone of the system. OneClickComply does not issue certificates, but it helps you organise the controls and evidence that an assessment will review.

IEC 62443-3-3 and ISO 27001 overlap but serve different purposes. ISO 27001 is a management system standard for information security across an organisation, while IEC 62443-3-3 sets technical requirements for industrial control systems. Controls such as account management, logging, backup and malware protection appear in both, so evidence collected for one can often support the other when controls are mapped together.

IEC 62443-3-3 is mapped in OneClickComply's control library and is available on request rather than live by default. Once enabled, its 51 system requirements sit alongside your other frameworks, with evidence for overlapping IT controls collected automatically from connected tools. Our in-house audit team can advise on scoping, zones and target security levels for your environment.