Insights / ISA/IEC 62443

IEC 62443: From Security Levels to Real OT Security

Security levels are not a number you pick. They come from the risk, the consequences of compromise, and an honest measurement of what is actually in place today. Here is the path we walk with plant operators.

Por Arquitecto Principal OT y Líder Técnico

SL-T Target
The level a zone needs, set by risk assessment.
SL-C Capability
The level your systems are designed to reach.
SL-A Achieved
The level actually in place right now.

Want the short version? Read the companion post: IEC 62443 Security Levels Are Not a Number You Pick.

The Eight-Step Path

Every step feeds the next. Steps four and five are where most programs go wrong: they set a target and never measure reality against it.

  1. 1Step 1 of 8

    Start with the Risk

    • What are we protecting?
    • What happens if it is compromised?
    • What threat are we facing?
  2. 2Step 2 of 8

    Assess the Environment

    • How capable are existing systems?
    • What controls exist already?
    • Where are the gaps?
  3. 3Step 3 of 8

    Target Security Level

    SL-T

    Derived from the risk and the consequences of compromise.

  4. 4Step 4 of 8

    Achieved Security Level

    SL-A

    What is actually in place today: configuration, patching, and operational practice.

  5. 5Step 5 of 8

    Gap Analysis

    Compare SL-T against SL-A. Identify the gaps between target and reality.

  6. 6Step 6 of 8

    Requirements and Controls

    Define and select the right controls to close each gap.

  7. 7Step 7 of 8

    Implementation

    Deploy the controls and update the architecture.

  8. 8Step 8 of 8

    Verification

    Verify effectiveness, re-measure SL-A, and continuously improve.

Example OT Environment

Zones group assets that share a security level. Conduits are the controlled paths between them.

How outside traffic reaches the plant

  1. 1Internet
  2. 2Remote Access (Controlled)
  3. 3Enterprise Network
  4. 4DMZ
  5. 5Operations Network

The zones, from the office down to the process

  1. 1/4Site Business

    Where the enterprise touches the plant. Email, ERP, and business applications.

    • Business Systems
    • Applications
  2. Conduit: a controlled, monitored path

    2/4Operations

    Supervisory systems that watch and tune the process. This is where engineers work.

    • Historian
    • HMI
    • Engineering Workstation
  3. Conduit: a controlled, monitored path

    3/4Control

    The controllers that actually run the process. A compromise here changes physical behavior.

    • SCADA
    • PLC
    • RTU
    • I/O Devices
  4. Conduit: a controlled, monitored path

    4/4Process

    The physical equipment itself. No security features of its own; it depends on the zones above.

    • Sensors
    • Actuators
    • Field Devices
    • Robots
    • Process Equipment

Every boundary between zones is a conduit. Each zone gets its own SL-T from the consequence of losing it, so the target usually rises as you move down toward the process.

Where the Capability Comes From

  • From the Component

    Built-in security features in devices and systems: a component's SL-C.

  • From the Network Architecture

    Segmentation, firewalls, zones and conduits.

  • From a Combination

    Technical and organizational controls working together to reach SL-A.

Use the Right Controls

  • Network Segmentation (Zones and Conduits)
  • Firewalls
  • Controlled Remote Access
  • Jump Servers
  • Strong Authentication
  • Monitoring and Logging
  • Vulnerability and Patch Management
  • Backup and Recovery
  • Compensating Controls

Key Principle

The security level is driven by the risk and the required security capability, not simply selected as a target number.

  • Reduce Risk
  • Protect Operations
  • Improve Resilience
  • Ensure Compliance
  • Deliver Long-Term Value

Pick your SL-T from risk, measure your SL-A honestly, and close the gap with the right controls. That is a real OT security program, not a number on a page.

Not sure what your SL-A actually is?

We measure it on site, zone by zone, and hand you the gap analysis against the target your risk demands. OEM-independent, no platform to sell.

Agende una Conversación

Start with the readiness assessment

Ten minutes, no email required. It tells you which of the eight steps your plant is stuck on.

Take the Assessment