ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
IEC 62443-2-1 is the part of the IEC 62443 series that tells asset owners what their security program for an operating industrial automation and control system (IACS) must contain. It sets policy and procedure requirements, not product features, and the “asset owner” explicitly includes the organization that operates the IACS.
IEC 62443-2-1:2024 (Edition 2.0), published on 7 August 2024, replaced the 2010 edition, and its foreword lists three significant technical changes. Requirements are now grouped into eight security program elements (SPEs), duplication with an information security management system (ISMS) was removed, and a maturity model was added for evaluating requirements.
If your OT program was written against the 2010 text, much of the content is still useful. Its structure and its evidence, however, will not line up with what an assessor now expects. Below we cover each SPE, the evidence auditors typically ask for, how the standard sits next to an ISMS, how ISASecure uses it, and a practical transition plan.
Free gap assessment
Does your IACS programme match the 2024 restructure?
Score the eight security programme elements, free, with zones, conduits and target security levels assessed alongside them.
Run the free IEC 62443 gap assessment → or View premium report sample
The scope is narrow on purpose: security program requirements for an IACS that is in operation. Design-phase risk assessment belongs to IEC 62443-3-2, system security requirements to 3-3, service providers to 2-4, and product suppliers to 4-1 and 4-2. Our guide to the IEC 62443 parts shows where each one fits.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
In practice, the asset owner must define, document and run a set of policies and procedures that keep IACS risk at a tolerable level for the whole operating life of the system. Three features matter most when you plan the work:
In the US, the standard is published as ANSI/ISA-62443-2-1-2024.
The 2010 edition (Edition 1.0) was titled “Establishing an industrial automation and control system security program” and defined the elements of a cyber security management system (CSMS). The 2024 edition is titled “Security program requirements for IACS asset owners,” and the new title reflects a new approach. The IEC lists the 2010 edition as withdrawn on the day the new one was published.
Requirements are now organized into eight SPEs that follow operational topics rather than management-system clauses. That makes ownership easier to assign. In a typical plant, network engineering owns most of SPE 3, the identity team most of SPE 6, and the control systems team most of SPE 2 and SPE 8.
The foreword states that requirements were revised to eliminate duplication of an ISMS. In practice, organization-wide management-system content generally need not be restated for OT, so the IACS program can concentrate on what is specific to control systems.
Edition 2.0 defines a maturity model for evaluating requirements. We deliberately do not list level names here; check them in the standard itself rather than relying on secondary summaries. The practical effect is that “we have a procedure” is no longer the finish line. In our experience, assessors look for evidence that the procedure is followed and repeated, not just written.
The SPE names below come from IEC 62443-2-1:2024. The scope and evidence columns are our practitioner summary of what each element typically involves during an assessment, not text from the standard.
| SPE | What it typically covers | Example evidence |
|---|---|---|
| SPE 1 Organizational security measures | Governance, roles, IACS security policy, awareness and training, links to enterprise risk and the ISMS | Approved OT security policy, RACI chart, training records, management review minutes |
| SPE 2 Configuration management | Asset inventory, configuration baselines, change control, network documentation | Asset register, baseline records, approved change tickets, current network drawings |
| SPE 3 Network and communications security | Segmentation, zone boundaries, remote and wireless access, secure communications | Zone and conduit drawings, firewall rule reviews, remote access register |
| SPE 4 Component security | Hardening and protection of hosts, controllers and network devices, including updates and malware protection | Hardening standards, patch status reports, compensating measure records for legacy devices |
| SPE 5 Protection of data | Classification and protection of IACS data such as configurations, recipes, logic and credentials | Data classification scheme, storage and encryption controls, media disposal records |
| SPE 6 User access control | Accounts, authentication, least privilege, privileged and shared accounts | Account inventories, access review records, joiner-mover-leaver tickets |
| SPE 7 Event and incident management | Logging, monitoring, detection, response and lessons learned | Log source list, alert triage records, incident response plan, exercise reports |
| SPE 8 System integrity and availability | Backup, restore, recovery and keeping the process running | Backup schedules, restore test results, recovery plans |
Across all eight elements of IEC 62443-2-1, assessors want three things: a documented requirement, people who know it, and records showing it happened more than once. Here is where we typically find gaps.
SPE 1 Organizational security measures. Auditors check that someone with authority owns OT security, that the IACS policy is approved and current, and that operators, engineers and contractors were trained for their roles. A policy signed years ago and never reviewed is a common finding.
SPE 2 Configuration management. Expect a sample test. The auditor picks devices on the floor and asks you to find them in the inventory with firmware version and owner, then traces recent changes back to approved change records.
SPE 3 Network and communications security. Assessors compare drawings to reality. They look for firewall rules with a business justification, periodic rule reviews, and one controlled path for vendor remote access instead of ad hoc connections.
SPE 4 Component security. The question is not “is everything patched?” but “do you know the status and decide deliberately?” Patch assessments, hardening baselines and documented compensating measures for devices that cannot be patched carry real weight.
SPE 5 Protection of data. Many sites have never classified OT data. Auditors look for a scheme that covers project files, controller logic and backups, and for proof those files are not sitting on shared drives or personal laptops.
SPE 6 User access control. Shared operator accounts are often unavoidable, so assessors focus on how they are controlled and attributed. They sample leavers to confirm access was removed and check that privileged accounts are inventoried and reviewed.
SPE 7 Event and incident management. A plan on its own is weak evidence. Auditors want to see which logs are collected, who reviews alerts, and records of at least one exercise that involved operations staff, not just IT.
SPE 8 System integrity and availability. Backups that were never restored are the classic gap. Expect requests for restore test records, recovery targets agreed with operations, and proof that backups are protected from the incident they are meant to recover from.
The 2024 foreword talks about an ISMS in general terms rather than naming a specific ISMS standard in that statement. Many asset owners already run an ISO/IEC 27001 certified ISMS for IT, and that is where the overlap shows up in practice.
Our working approach is to let the ISMS carry the organization-wide machinery (risk methodology, document control, internal audit, management review) and let the IACS program carry the OT-specific practices across the eight SPEs. Cross-reference rather than copy. Two checks are worth doing early:
Our IEC 62443 vs ISO 27001 comparison covers the boundary between the two in more detail.
The ISASecure ACSSA program evaluates a deployed control system together with the asset owner’s related policies and procedures. It draws on four parts: 2-1 for the asset owner security program, 2-4 for service providers, 3-2 for risk assessment and 3-3 for system requirements. Version 1.0.0 became effective on 17 February 2026.
There are two routes. An inspection ends with a letter confirming the evaluation plus a formal report, while a certification attests to conformity, is valid for a set period and requires periodic surveillance. Eligibility submissions include a risk assessment performed under IEC 62443-3-2, so that work needs to be in place before you apply. Where a maintenance provider holds a suitable 2-4 certification at ML 3, ISASecure says it can contribute evidence, although more may be required. Our IEC 62443 certification guide compares the other schemes.
In our experience, the crosswalk and gap assessment typically take four to eight weeks for a single-site program. Building the operating records that demonstrate maturity takes longer, often several months of normal operation.
If you would rather not start from blank pages, the IEC 62443 Toolkit was written against IEC 62443-2-1:2024 and includes procedures for SPE 1 to SPE 8, alongside asset inventory, zones and conduits, and 3-2 risk assessment templates. It is built for asset owners and service providers, not product suppliers pursuing 4-1. It supplies the documented layer; your team still has to run the processes and keep the records an assessor will sample.
Not by itself. It is a voluntary international standard, and certification against it is voluntary too. It becomes binding when a regulator, customer contract or other agreement requires it, so check those obligations first.
The IEC lists the 2010 edition as withdrawn on 7 August 2024. Plan new assessments against the 2024 edition, and confirm the edition with your assessor or certification body when you agree on scope.
It is written for asset owners, including IACS operators. Integrators and maintenance providers are addressed by IEC 62443-2-4, and product suppliers by 4-1 and 4-2, although asset owners often pass relevant expectations to them through contracts.
Not on its own. An ISMS can supply shared management processes, but the eight SPEs address OT-specific areas such as configuration management, network and communications security, and system integrity and availability. Expect an assessor to look for evidence of those practices directly.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026