ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The IEC 62443 vs NIST CSF question usually comes up when a board wants one cyber scorecard for the whole company and the plant engineers want concrete requirements they can design to. The short answer: they are not competitors. NIST CSF 2.0 describes security outcomes across the enterprise, while IEC 62443 sets requirements to engineer, run and supply an industrial automation and control system (IACS) at a defined security level.
Most asset owners we work with end up using both. CSF gives leadership a common language and a profile they can track year on year. IEC 62443 gives the control system owner, the integrator and the product supplier requirements specific enough to test, audit and, if needed, certify.
This IEC 62443 vs NIST CSF guide compares scope, audience, depth, certification and cost, gives an indicative mapping between the two, and closes with an operating model you can adopt this quarter.
Free gap assessment
Does your IACS programme match the 2024 restructure?
Score the eight security programme elements, free, with zones, conduits and target security levels assessed alongside them.
Run the free IEC 62443 gap assessment → or View premium report sample
The table summarizes IEC 62443 vs NIST CSF on eleven criteria. Versions and prices were checked in October 2026.
| Criterion | NIST CSF 2.0 | IEC 62443 |
|---|---|---|
| Publisher | NIST (US government) | IEC; ISA publishes US editions as ANSI/ISA-62443 |
| Document type | Voluntary outcome framework (NIST CSWP 29) | Series of standards, technical specifications and technical reports |
| Current version | CSF 2.0, published 26 February 2024 | Parts on separate cycles, e.g. 2-1:2024, 2-4:2023, 3-2:2020, 3-3:2013 |
| Scope | Any organization; outcomes apply to IT, IoT and OT | Industrial automation and control systems across their lifecycle |
| Primary audience | Executives, CISOs, risk and audit teams | Asset owners, service providers and product suppliers |
| Structure | 6 functions, 22 categories, 106 subcategories | 8 program elements (2-1), 7 risk assessment steps (3-2), 7 foundational requirements and 51 system requirements (3-3), plus supplier parts |
| Depth | States what to achieve, not how | Prescriptive requirements; 3-3 and 4-2 tie them to security levels SL 1 to SL 4 |
| Maturity measure | Four Tiers, Partial to Adaptive | 2-1:2024 defines a maturity model; 2-4 uses ML1 to ML4 |
| Certification | None | Voluntary ISASecure schemes for components, systems, development lifecycles and operating IACS |
| Cost of access | Free download | Sold per part; CHF 260 to CHF 405 list price per core asset-owner part |
| Best used for | Board reporting, enterprise risk, IT/OT alignment | Plant design, segmentation, procurement specs, supplier assurance |
CSF 2.0 organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0. It brings organizational context, risk strategy, roles, policy, oversight and supply chain risk management into one function a board can own.
For NIST CSF 2.0 OT programs, the strengths are breadth and readability. One profile can cover the ERP system, the plant historian and the safety network, so gaps are easy to show leadership. Organizational Profiles (Current and Target) and four Tiers (Partial, Risk Informed, Repeatable, Adaptive) give you a simple way to express ambition and progress.
The limits are just as clear. CSF says identities should be managed and networks protected. It does not say how to segment a control network, what authentication a remote engineering workstation needs, or what evidence a PLC vendor must provide. Its informative references, which point to more detailed standards, now sit on the CSF 2.0 website rather than inside the framework document.
IEC 62443 is written for the people who build, run and supply control systems. Our guide to every IEC 62443 part covers the full series; for this comparison, a handful of parts do most of the work:
The defining concept is the security level. You set a target (SL-T) for each zone, compare it with the capability of the system and components (SL-C), and verify what was actually achieved (SL-A). SL 2, for example, means protection against intentional violation using simple means with low resources, generic skills and low motivation. Nothing in CSF works at that resolution, and that is the core IEC 62443 vs NIST CSF difference.
NIST runs no certification scheme for CSF. You can self-assess or ask an auditor for an opinion, but there is no official CSF certificate, so treat any “CSF certified” badge with caution.
IEC 62443 has several voluntary schemes. ISASecure certifies components (CSA, against 4-2), systems (SSA, against 3-3), development lifecycles (SDLA, against 4-1) and IIoT components (ICSA). A recent addition, ISASecure ACSSA certification, evaluates a deployed IACS and the asset owner’s program against 2-1, 2-4, 3-2 and 3-3. Version 1.0.0 took effect on 17 February 2026. IECEE certificates are also issued under an Industrial Cyber Security Capability Scheme.
Cost of access differs too. CSF 2.0 is a free download from the NIST Cybersecurity Framework site. IEC 62443 parts are sold individually. At October 2026 list prices on the IEC webstore, 2-1:2024 lists at CHF 405, 3-3 at CHF 380 and 3-2 at CHF 260, so the three core asset-owner parts total CHF 1,045 before any implementation work.
The two have been linked for years. CSF 1.1 (April 2018) listed ISA 62443-2-1:2009 and ISA 62443-3-3:2013 as informative references against many subcategories, including asset inventory and access control. The practical side of IEC 62443 vs NIST CSF is still the crosswalk, so below is our function-level IEC 62443 NIST CSF mapping. It is indicative, not an official NIST or IEC crosswalk.
| CSF 2.0 function | Main IEC 62443 anchors | What to watch |
|---|---|---|
| Govern | 2-1 SPE 1 Organizational security measures; 3-2 tolerable risk (ZCR 6) and asset owner approval (ZCR 7) | Enterprise risk appetite must become per-zone targets |
| Identify | OT asset inventory; 3-2 ZCR 1 to ZCR 5 (system under consideration, zones and conduits, risk assessment) | 62443 risk work is per system, not per enterprise |
| Protect | 3-3 FR 1 to FR 5; 2-1 SPE 2 to SPE 6 | Control strength follows SL-T, not a single baseline |
| Detect | 3-3 FR 6 Timely response to events; 2-1 SPE 7 | Monitoring design must suit the process network |
| Respond | 2-1 SPE 7 Event and incident management | Operations and safety roles belong in the plan |
| Recover | 3-3 FR 7 Resource availability; 2-1 SPE 8 System integrity and availability | Restores must be tested against process constraints |
Two cautions. First, the mapping is many-to-many: a single CSF subcategory can touch a dozen 62443 requirements. Second, coverage is not equivalence. You can satisfy a CSF outcome with a policy and a spreadsheet, while the matching 62443 requirement at SL 2 or SL 3 needs a specific technical capability.
NIST released the CSF 2.0 Manufacturing Profile (NIST IR 8183 Rev. 2) as an initial public draft on 29 September 2025. It realigns the earlier manufacturing profile to CSF 2.0, including Govern, and adds guidance on supply chain risk management, platform security and technology infrastructure resilience. The comment period closed on 17 November 2025, and as of October 2026 the document is not final.
For manufacturers, it narrows the IEC 62443 vs NIST CSF gap by putting CSF outcomes in plant terms. NIST positions it as a supplement to existing standards, not a replacement. Use it to shape your Target Profile, but do not cite a draft as a contractual or audit baseline.
Most IEC 62443 vs NIST CSF debates end once each framework has one job. In our experience, the cleanest setup links them through a single risk register:
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
This keeps executives on six functions and engineers on requirements they can test. If you already run an enterprise program, our NIST Cybersecurity Framework guide covers profiles and tiers in more depth.
In practice, the IEC 62443 vs NIST CSF choice depends on your role in the supply chain more than on preference.
Sometimes budget forces a choice. If a customer or regulator wants evidence about a specific control system, IEC 62443 is the stronger answer. If the request is for an enterprise-wide view of maturity across IT and OT, CSF is faster and cheaper. US federal guidance can also shape the decision, so compare IEC 62443 and NIST SP 800-82 if that applies to you.
For the plant-side documentation, the IEC 62443 Toolkit ($149) provides 117 editable templates (82 Word, 35 Excel) in 16 sections, written against IEC 62443-2-1:2024. It covers program governance, asset inventory, zones and conduits, the 3-2 risk assessment and CRS, an SL-T/SL-C/SL-A gap workbook and SPE 1 to 8 procedures, and its Mapping and Currency section includes a mapping to NIST CSF 2.0. It suits asset owners and service providers, not suppliers pursuing 4-1. It cannot certify anyone: your team still operates the processes and keeps the records.
CSF is enough to govern and report on OT risk, but not to engineer it. It states outcomes such as protecting networks and managing identities without setting control strength for a specific zone. For technical depth, pair it with IEC 62443 or NIST SP 800-82.
CSF 1.1 listed ISA 62443-2-1:2009 and ISA 62443-3-3:2013 as informative references. In CSF 2.0, informative references are published on the CSF 2.0 website rather than inside the framework document, so check there for current mappings.
Not officially. CSF 2.0 is voluntary and NIST runs no certification scheme, which is one of the clearest IEC 62443 vs NIST CSF differences. If you need third-party certification for OT, look at the voluntary ISASecure programs for IEC 62443, which now include ACSSA for deployed control systems.
In our experience, a single-site manufacturer can build a first CSF Current Profile in a few weeks, while a first IEC 62443-3-2 risk assessment typically takes two to four months, depending on drawing quality and engineering availability. Treat these as practitioner estimates, not benchmarks.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026