IEC 62443: Industrial Cybersecurity in the CRA Era

IEC 62443 is the international standard series dedicated to the security of industrial automation and control systems (IACS). Although voluntary, it is becoming the most natural path to compliance with the Cyber Resilience Act for industrial products. However, an IEC 62443 certificate alone will not be enough: alignment with its upcoming harmonized version, EN IEC 62443, expected in late 2026 or early 2027, will be required.

A Series, Not a Single Standard

IEC 62443 is jointly developed by the ISA99 committee and the IEC. It covers the organizational and technical aspects of security across the entire industrial system lifecycle, structured into four families: general concepts (1-x), policies and procedures (2-x), system requirements (3-x), and component requirements (4-x) (IEC).

Each stakeholder only needs to focus on specific parts of the series:

Role	Key Parts to Master	Deliverables
Asset Owner	2-1, 3-2, 3-3, and 2-4 to supervise service providers	Security program, zone and conduit segmentation, target security levels
System Integrator or Maintenance Provider	2-4, 3-2, 3-3	System delivered and maintained at the level required by the asset owner
Product Manufacturer	4-1, 4-2	Secure product development lifecycle, components meeting stated capability levels

Source: BD Emerson, based on the ISA quick start guide.

Four Core Concepts to Know

• Seven Foundational Requirements (FRs): Identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability (IEC).
• Security Levels SL 1 to SL 4: Defined based on the adversary being countered, ranging from casual or coincidental violations (SL 1) to sophisticated, highly motivated attackers with extensive resources (SL 4). A distinction is made between target security level (SL-T), capability security level of a product (SL-C), and achieved security level in operation (SL-A) (BD Emerson).
• Zones and conduits: Part 3-2 segments the facility into zones of assets sharing the same risk profile, connected by conduits that enforce their own security controls.
• Compensating countermeasures: Legacy equipment unable to natively support a requirement can still achieve the intended security level through alternative safeguards, making the standard applicable to brownfield installations (IEC).

Key Editions in 2026

Part 2-1 (asset owner security program) was released in its 2nd edition in 2024: it is now structured around program elements, introduces a maturity model, and eliminates redundancies with ISO 27001-style ISMS frameworks. Part 2-4 (service providers) has been in its 2nd edition since 2023.

For manufacturers, 4-1 (2018) and 4-2 (2019) remain the benchmarks, with the IEC planning no revision prior to 2027 (BD Emerson).

IEC 62443 and the CRA: Close, but Not Equivalent

Under Article 27 of the CRA, only a harmonized standard cited in the Official Journal of the EU confers a presumption of conformity. An IEC 62443 certificate remains useful evidence within technical documentation, but nothing more.

A 2024 JRC-ENISA analysis confirms that 4-1 and 4-2 cover a significant portion of CRA requirements, but exclusively for industrial systems. Manufacturers still need to produce: the product cyber risk assessment, the SBOM, the support period determination, and the Article 14 incident and vulnerability reporting process (BD Emerson).

The harmonized standard is currently being drafted by CENELEC (TC65X WG3) as a "delta requirements" document detailing the necessary additions to 4-1 and 4-2. The publication of EN IEC 62443 is expected in late 2026 or early 2027, leaving manufacturers fewer than 12 months before December 2027.

An example of a debated delta: separating security updates from functional updates, a requirement that proves challenging for cloud-based applications (exida).

Certification

Certificates are issued by accredited certification bodies, primarily through the ISASecure scheme (SDLA for the development lifecycle, CSA for components, SSA for systems, ICSA for IIoT, ACSSA for asset owner facilities) and the IECEE Industrial Cyber Security Program (BD Emerson).

Where to Start

If you are a manufacturer:

1. Assess your development lifecycle against 4-1 and each product line against 4-2.
2. Build a per-product threat model that can be reused for the CRA cybersecurity risk assessment.
3. Define a target capability security level (SL-C) tailored to your customers' use cases.
4. Track the EN IEC 62443 "delta requirements" proactively rather than waiting for the final release.

If you are an asset owner:

1. Consolidate your industrial asset inventory.
2. Segment your facility into zones and conduits, and conduct the 3-2 risk assessment.
3. Integrate 2-4 requirements into your integration and maintenance service contracts.
4. Oversee the entire initiative through a 2-1 program aligned with your NIS 2 obligations.

How Domyno Can Help

Whether you are an asset owner, system integrator, or manufacturer, Domyno adapts to your industrial reality with exceptional flexibility. Through the custom framework, you can tailor IEC 62443 to the specific parts applicable to you, layer in internal or customer-specific requirements, and integrate EN IEC 62443 "delta requirements" as they evolve.

The control plan then structures execution: each requirement is mapped to a control with an assigned owner, due date, and audit trail of evidence, tracked all the way to certification. Around it, the complete platform supports your operations: asset inventory, risk assessments, vulnerability management, third-party risk management, incident response, and business continuity and disaster recovery plans.

Combine this with Domyno's AI and a dedicated compliance expert, and you can manage IEC 62443, ISO 27001, NIS 2, and the CRA from a single pane of glass.

Sources

• IEC SyC Smart Energy — IEC 62443 Background
• BD Emerson — IEC 62443 Explained: Parts, Security Levels, and Certification (October 25, 2026)
• exida — An insider's view on EN IEC 62443 harmonization (Mike Medoff, Co-Chair JT 62443-4-1)