IEC 62443: SDLC-Security Defect and Update Management

Date: 2026-10-15
Location: Online
Host: Zach L

About this event

A live 30-minute expert session on SDLC-Security Defect and Update Management, part of the IEC 62443 track from Critical Systems Analysis. Recurs monthly. Related topics: sdlc-security defect and update management · sdlc-security · defect · update · management · industrial cybersecurity · OT security · security level · secure development lifecycle · SDLC · risk assessment · threat modeling · zones and conduits · foundational requirements · PLC security · ICS security. Browse the whole track: IEC 62443](https://luma.com/critical-systems-analysis?tag=iec-62443)) All IEC 62443 sessions (14 more): IEC 62443: Security Level](https://luma.com/critical-systems-analysis?tag=iec-62443-security-level)) · IEC 62443: SDLC-Software Design](https://luma.com/critical-systems-analysis?tag=iec-62443-sdlc-s

Topics

Registration

View event page

About IEC 62443 (Industrial Cybersecurity)

This online session delivers expert-led instruction on the regulatory landscape and implementation approach for IEC 62443.

IEC 62443 is the leading standard series for cybersecurity of industrial automation and control systems (IACS). It addresses secure system architecture, security levels, component development, and the responsibilities of asset owners, integrators, and product suppliers across the plant lifecycle.

What it regulates

Security programs, secure development lifecycles, zone-and-conduit architectures, and technical security capabilities of components and systems in operational technology environments.

Who must comply

Asset owners operating industrial facilities, system integrators building control systems, and product suppliers of controllers, network gear, and software used in OT environments; increasingly referenced by regulation and by customers as a procurement requirement.

Key requirements of IEC 62443

62443-1-x: Concepts, terminology and metrics

62443-2-1: Security program requirements for asset owners

62443-2-4: Security requirements for service providers

62443-3-2: Risk assessment and system partitioning into zones and conduits

62443-3-3: System security requirements and Security Levels (SL 1-4)

62443-4-1: Secure product development lifecycle (SDL)

62443-4-2: Technical security requirements for components

Key concepts: IEC 62443

Security PHA / cyber risk assessment

The 62443-3-2 process of assessing cyber risk to determine target security levels for each zone and conduit.

Defense in depth

Layered, complementary security measures so that compromise of one layer does not defeat the system.

Security Level (SL 1-4)

Graded protection targets against increasingly capable attackers, from casual violation (SL 1) to sophisticated, well-resourced adversaries (SL 4).

Zones and conduits

The partitioning of a system into groupings of assets with common security requirements (zones) connected by controlled communication channels (conduits).

Foundational Requirements (FR1-FR7)

The seven requirement families — identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

Frequently asked questions: IEC 62443

How does IEC 62443 relate to functional safety standards?

Safety and security are complementary: a cyber attack can defeat a safety function. IEC TR 63069 gives guidance on aligning IEC 61508-based safety with 62443-based security, including protecting safety instrumented systems within appropriately secured zones.

Can a component be certified to IEC 62443?

Yes — component suppliers certify products against 62443-4-2 with development processes per 62443-4-1; schemes such as ISASecure operate accredited certification programs.

What is the difference between SL-T, SL-A and SL-C?

SL-T is the target level from risk assessment, SL-C is the capability a component or system can provide when properly configured, and SL-A is the level actually achieved in the deployed installation.