Build IEC 62443-4-2 secure components with less manual effort

IEC 62443-4-2 is an international standard that sets the technical security requirements for individual components of industrial automation and control systems. Published by the IEC in 2019, it turns the seven foundational requirements of the IEC 62443 series into component requirements, with additional requirements for software applications, embedded devices, host devices and network devices, each graded by capability security level from SL-C 1 to SL-C 4.

IEC 62443-4-2 is voluntary, but it is widely expected of manufacturers supplying components to industrial and critical infrastructure operators. Makers of PLCs, RTUs, HMIs, industrial PCs, network switches, gateways and control software use it to show their products meet a stated security level. Asset owners and system integrators often cite it in procurement and tenders.

IEC 62443-4-1 covers the secure development lifecycle a supplier follows, while IEC 62443-4-2 covers the security capabilities of the finished component. In short, 4-1 is about how you build products and 4-2 is about what the product itself can do, such as authentication, logging, integrity checks and secure updates. Many suppliers pursue both, since component certification schemes typically expect a 4-1 compliant process behind the product.

IEC 62443-3-3 defines security requirements for a complete control system, while IEC 62443-4-2 defines them for the individual components that make up that system. Both are built on the same seven foundational requirements, and the 4-2 component requirements largely mirror the 3-3 system requirements. Integrators use 3-3 for the overall system, and component suppliers use 4-2 to show their products can support the system's target security level.

IEC 62443-4-2 uses capability security levels, SL-C 1 to SL-C 4, to describe how well a component can resist attack. SL 1 protects against casual or accidental misuse, while SL 4 targets sophisticated attackers with extended resources and specific industrial knowledge. Each higher level adds requirement enhancements, such as multifactor authentication or hardware-backed key protection, on top of the base component requirements.

IEC 62443-4-2 certification is gained through an independent assessment of a specific product against a chosen security level. Recognised routes include the ISASecure Component Security Assurance (CSA) programme and certification bodies operating under the IECEE scheme. The assessor reviews documentation and tests the component's security capabilities, and usually also checks that the supplier's development process meets IEC 62443-4-1.

IEC 62443-4-2 and ISO 27001 address different things, so one does not replace the other. ISO 27001 certifies an organisation's information security management system, while IEC 62443-4-2 assesses the security capabilities of an industrial product. Suppliers often hold both, and controls such as access management, logging, cryptography and vulnerability handling overlap, so evidence for one can support the other.

Yes, IEC 62443-4-2 is mapped in OneClickComply's control library and is available on request rather than as a standard live framework. It shares controls with IEC 62443-4-1, ISO 27001 and other frameworks you may already run, so evidence is reused. Our audit team can help you prepare for a component assessment, though certification itself is issued by an independent certification body.