Build an IEC 62443-4-1 secure development lifecycle you can evidence

IEC 62443-4-1 is an international standard that sets process requirements for a secure product development lifecycle for industrial automation and control system products. Published by the IEC in 2018, it defines 47 requirements across eight practices, including security management, threat modelling, secure design, secure coding, security testing, vulnerability handling, security updates and user security guidelines. It applies to product developers and maintainers rather than integrators or asset owners.

IEC 62443-4-1 is aimed at manufacturers and suppliers that develop hardware, software or firmware for industrial automation and control systems, such as PLCs, HMIs, controllers, industrial network devices and control software. It is voluntary, but asset owners, system integrators and procurement teams in sectors such as energy, manufacturing, water and process industries increasingly ask suppliers to demonstrate it.

The eight practices are: security management (SM), specification of security requirements (SR), secure by design (SD), secure implementation (SI), security verification and validation testing (SVV), management of security-related issues (DM), security update management (SUM) and security guidelines (SG). Together they contain 47 requirements, from SM-1 Development process to SG-7 Documentation review.

IEC 62443-4-1 covers the process a supplier uses to develop and maintain products, while IEC 62443-4-2 covers the technical security capabilities of the components themselves, such as authentication and logging. In short, 4-1 asks whether your development lifecycle is secure, and 4-2 asks whether the product is. Component certification under 4-2 typically expects the product to have been developed under a 4-1 compliant process.

Yes. Suppliers can obtain voluntary third-party process certification against IEC 62443-4-1 from accredited certification bodies, for example through the IECEE conformity assessment scheme or the ISASecure Security Development Lifecycle Assurance (SDLA) programme. The assessment examines whether the defined process meets the requirements and how maturely it is applied, using the standard's four-level maturity model.

IEC 62443-4-1 uses a four-level maturity model to describe how well a supplier applies its development process. Level 1 is initial, where practice is ad hoc. Level 2 is managed, with a documented process. Level 3 is defined, where the process is repeatable and practised across the organisation. Level 4 is improving, where performance is measured and the process is continuously improved.

IEC 62443-4-1 and ISO 27001 complement each other but are not interchangeable. ISO 27001 is an organisation-wide information security management system, while IEC 62443-4-1 focuses on the secure development of industrial products. Controls such as access management, development environment security, supplier management and continual improvement overlap, so an existing ISO 27001 programme gives a useful head start.

IEC 62443-4-1 is mapped in OneClickComply's control library and is available on request. Once enabled, you can generate policies, collect evidence from your development and identity tools, and reuse controls you already meet for frameworks such as ISO 27001. OneClickComply does not issue certifications, but our auditors can help you prepare for an assessment by an accredited certification body.