The World’s Only Consensus-Based Automation and Control Systems Cybersecurity Standards
The ISA/IEC standards set cybersecurity benchmarks in all industry sectors that use IACS, including building automation, electric power generation and distribution, medical devices, transportation, and process industries such as chemicals and oil and gas.
Background
The International Society of Automation (ISA) established the ISA99 standards committee in 2002, recognizing the need to secure equipment and operations that make up U.S. critical infrastructure against cyberattacks. Since then, ISA99 has published a comprehensive family of standards and technical reports purpose-built to address securing automation and control systems.
The ISA/IEC 62443 standards are submitted to the International Electrotechnical Commission (IEC) for global adoption as international standards ISA/IEC 62443. The ISA/IEC 62443 series of standards are endorsed by the United Nations. With use cases from more than 20 different industries, the ISA/IEC 62443 series of standards have demonstrated their utility in all industry verticals that use operational technology. In 2021, IEC recognized the series as a horizontal standard, meaning that the standards have been proven to apply to a broad range of different industries.
Getting Started with the ISA/IEC 62443 Standards
A founding principle of the ISA/IEC 62443 standards is the concept of shared responsibility as an essential building block of automation cybersecurity. Key stakeholder groups must align to ensure the safety, integrity, reliability, and security of control systems.
The standards define requirements for key stakeholder groups who are involved in control system cybersecurity. Stakeholder groups include asset owners (end users), automation product suppliers, integrators who build and maintain control system solutions and their components, and service suppliers who support the operation of control systems.
People, processes, and technology all play critical roles in securing automation and control systems. The ISA/IEC 62443 series addresses the security of industrial automation and control systems (IACS) throughout their lifecycle (which applies to all automation and control systems, not only industrial).
The ISA/IEC 62443 standards provide guidance that includes:
- Defining common terms, concepts, and models that can be used by all stakeholders responsible for control systems cybersecurity
- Helping asset owners determine the level of security required to meet their unique business and risk needs
- Establishing a common set of requirements and a cybersecurity lifecycle methodology for product developers, including a mechanism to certify products and vendor development processes
- Defining the risk assessment processes that are critical to protecting control systems
For a complete overview of the series and its documents, download the ISA/IEC 62443 Quick Start Guide.
ISA99: The Mission Continues
The ISA99 committee, Industrial Automation and Control Systems Security, and IEC Technical Committee 65 Working Group 10 (TC 65 WG 10) have cooperated in the development of the ISA/IEC 62443 series of standards and technical reports that define the requirements for cybersecurity robustness and resilience at each stage of the IACS lifecycle.
The final published documents are available from both IEC and ISA. The ISA editions of the standards and reports in the series have a naming convention written as “ISA-62443-x-y,” while the IEC Editions appear as “IEC 62443-x-y.” The ISA and IEC editions of each document are identical, however, and both are released as concurrently as possible.
The ISA99 standards committee has been recognized by the United Nations, UNECE, and NATO. For details on the committee’s current work, visit the ISA99 section of the ISA website.
The ISA Global Cybersecurity Alliance: Advancing the Adoption of 62443
ISAGCA offers a comprehensive set of resources on the 62443 standards for free to the general public, many of which are linked in the sidebar on this page.
ISASecure®—Certifying Industrial Control System Components and Systems
