Sign in

IEC 62443

IEC 62443 Security for Industrial Automation and Control Systems — IEC TC 65 / ISA99

Also known as: IEC 62443, ISA/IEC 62443, ISA 99, IEC 62443-4-1, IEC 62443-4-2, IEC 62443-3-3, IEC 62443-2-1

Official site Official change log Subscribe to IEC 62443 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
IEC 62443-2-1:2024 (most recently revised part)
Published 7 August 2024. source
Status
In force
Next deadline
in 4 days
IEC 61508-1:2026 FDIS: Third edition of general requirements for functional safety of E/E/PE safety-related systems, with new provisions on AI, human factors, and security
Who must comply
Industrial automation and control systems (IACS): asset owners, integrators, product suppliers and service providers, in every sector that uses IACS. source
How it is assessed
Products, systems and development processes can be certified by ISO/IEC 17065-accredited bodies, for example under the ISASecure schemes. source
Written by
A series developed by the ISA99 committee with IEC TC 65 WG 10. IEC publishes it as IEC 62443-x-y and ISA as ISA-62443-x-y; both editions are identical. source source
Enforced by
IEC standards are always voluntary and do not seek to set public policy or regulations. source
Last change

Series covering security of industrial automation and control systems, addressed separately to asset owners, integrators and product suppliers; the usual reference for operational technology.

Recent changes

  1. High
    IEC publishes FDIS for railway cybersecurity standard IEC 63452:2026

    IEC has released the Final Draft International Standard IEC 63452:2026 for railway cybersecurity, available for purchase during its voting period (2026-10-30 to 2026-12-11), with the final …

    New document Deadline 2026-12-11 Action required

  2. Critical
    IEC 63116:2026 replaces TS 63116:2021, adding cybersecurity requirements for lighting systems

    IEC 63116:2026 is a paid FDIS (pre-release available 2026-10-16 to 2026-11-27) that elevates IEC TS 63116:2021 and its Amendment 1:2023 to a full International Standard covering …

    New version Deadline 2026-11-27 Action required

  3. Low
    BSI publishes cybersecurity recommendation for securing networked control systems

    The BSI has published a cybersecurity recommendation describing technical measures to secure control systems accessible from the Internet. The recommendation is particularly aimed at operators of …

    Guidance

  4. Critical
    IEC 61508-1:2026 FDIS published — third edition of functional safety general requirements

    IEC has released the Final Draft International Standard (FDIS) for IEC 61508-1:2026, the third edition of the general requirements standard for functional safety of electrical/electronic/programmable electronic …

    New version Deadline 2026-11-13 Action required

  5. Critical
    IEC 61508-2:2026 FDIS published with significant technical updates for E/E/PE safety-related systems

    IEC has released the Final Draft International Standard (FDIS) of IEC 61508-2:2026, covering requirements for electrical/electronic/programmable electronic (E/E/PE) safety-related systems, available for purchase during the voting …

    New version Deadline 2026-11-13 Action required

  6. Critical
    IEC 61508-3:2026 FDIS published — software requirements for E/E/PE safety-related systems

    IEC has released the Final Draft International Standard (FDIS) for IEC 61508-3:2026, the third edition covering software requirements for functional safety of E/E/PE safety-related systems, available …

    New version Deadline 2026-11-13 Action required

  7. Critical
    IEC 61508-4:2026 FDIS adds AI, cybersecurity, and diagnostic definitions

    IEC has released the Final Draft International Standard (FDIS) of IEC 61508-4:2026, the definitions and abbreviations part of the functional safety series, available for purchase and …

    New version Deadline 2026-11-13 Action required

  8. Critical
    IEC 61508-5:2026 FDIS published — examples of methods for determining safety integrity levels

    IEC has released the Final Draft International Standard (FDIS) for IEC 61508-5:2026, available for purchase during its voting period from 2 October to 13 November 2026. …

    New version Deadline 2026-11-13 Action required

  9. Critical
    IEC 61508-6:2026 FDIS published — third edition with new technical annexes

    IEC has released the Final Draft International Standard (FDIS) of IEC 61508-6:2026, available for purchase during its voting period (2026-10-02 to 2026-11-13); buyers also receive the …

    New version Deadline 2026-11-13 Action required

  10. Critical
    IEC 61508-7:2026 FDIS published — third edition with technical revisions to techniques and measures overview

    IEC has released the Final Draft International Standard (FDIS) for IEC 61508-7:2026, the third edition covering techniques and measures for functional safety of E/E/PE safety-related systems, …

    New version Deadline 2026-11-13 Action required

Key dates

Add these dates to your calendar
  1. in 4 days IEC 61508-1:2026 FDIS: Third edition of general requirements for functional safety of E/E/PE safety-related systems, with new provisions on AI, human factors, and security
  2. in 4 days IEC 61508-7:2026 FDIS (third edition): revised Annex D on proven-in-use and relocation of Annexes E and H to IEC 61508-2-1
  3. in 4 days IEC 61508-6:2026 (FDIS): Guidelines on the application of IEC 61508-2 and IEC 61508-3 — third edition replaces 2010 version with new annexes on diagnostics, failure rate estimation, and robust safety
  4. in 4 days IEC 61508-5:2026 FDIS: Examples of methods for determination of safety integrity levels in E/E/PE safety-related systems
  5. in 4 days IEC 61508-4 third edition (FDIS 2026): revised and new definitions cover AI software classes, tool impact, diagnostic functions, and security alignment
  6. in 4 days IEC 61508-3:2026 FDIS: Third edition of software requirements for functional safety of electrical/electronic/programmable electronic safety-related systems
  7. in 4 days IEC 61508-2:2026 FDIS — Requirements for E/E/PE safety-related systems: clarified SIL/SC differentiation, semiconductor content relocated, updated interfaces to other parts
  8. in 18 days IEC 63116:2026 – General requirements for lighting systems: first full International Standard replacing IEC TS 63116:2021, with expanded information security and cybersecurity provisions
  9. in 32 days IEC 63452:2026 FDIS — Cybersecurity management, zoning, risk, supply chain, and assurance requirements for railway applications across the full system lifecycle
  10. IEC PAS 62443-1-6:2025 is published, applying the series to the Industrial Internet of Things (IIoT)
  11. IEC PAS 62443-2-2:2025, the IACS security protection scheme, is published
  12. IEC TS 62443-6-2:2025, the evaluation methodology for IEC 62443-4-2, is published
  13. IEC 62443-2-1:2024 is published and the 2010 edition is withdrawn
Show 3 earlier dates
  1. IEC TS 62443-6-1:2024, the evaluation methodology for IEC 62443-2-4, is published
  2. IEC 62443-2-4:2023 is published and the 2015 edition with Amendment 1 is withdrawn
  3. IEC TS 62443-1-5:2023, the scheme for IEC 62443 security profiles, is published

Version history

  1. IEC 62443-2-1:2024 (most recently revised part) Major versionCurrent

    Second edition of Part 2-1, security program requirements for IACS asset owners; replaced the 2010 edition. source

    More
    • Requirements were restructured into security program elements (SPEs).
    • Requirements that duplicated an information security management system were removed.
    • A maturity model for evaluating requirements was defined.
  2. IEC 62443-2-4:2023 Major version

    Second edition of Part 2-4, security program requirements for IACS service providers; replaced the 2015 edition with Amendment 1. source

  3. IEC 62443-4-2:2019/Cor 1:2022 Errata

    Corrigendum 1 to Part 4-2. source

  4. IEC 62443-3-2:2020 Major version

    First edition of Part 3-2, security risk assessment for system design. source

  5. IEC 62443-4-2:2019 Major version

    First edition of Part 4-2, technical security requirements for IACS components, with component security capability levels. source

Show 7 older versions
  1. IEC 62443-4-1:2018 Major version

    First edition of Part 4-1, secure product development lifecycle requirements for product developers and maintainers. source

  2. IEC 62443-2-4:2015/Amd 1:2017 Amendment

    Amendment 1 to Part 2-4. source

  3. IEC 62443-2-4:2015/Cor 1:2015 Errata

    Corrigendum 1 to Part 2-4. source

  4. IEC 62443-2-4:2015 Major version

    First edition of Part 2-4, requirements for IACS service providers. source

  5. IEC 62443-3-3:2013/Cor 1:2014 Errata

    Corrigendum 1 to Part 3-3; its content is included in the current copy of Part 3-3. source

  6. IEC 62443-3-3:2013 Major version

    First edition of Part 3-3, system security requirements and security levels; still the current edition. source

  7. IEC 62443-2-1:2010 Major version

    First edition of Part 2-1; withdrawn on 7 August 2024. source

Who it applies to

Everyone who owns, integrates, builds or services industrial automation and control systems. IEC standards are voluntary.

Stakeholders
Asset owners (end users), automation product suppliers, integrators who build and maintain control system solutions, and service suppliers. source
Sectors
All sectors that use IACS, including building automation, electric power, medical devices, transportation and process industries such as chemicals and oil and gas. source
Asset owners
Part 2-1 sets security program policy and procedure requirements for an IACS in operation; asset owner includes the operator. source
Service providers
Part 2-4 sets requirements for security-related processes of IACS service providers. source
Product suppliers
Part 4-1 applies only to the developer and maintainer of a product, not to the integrator or user; Part 4-2 sets technical requirements for IACS components. source source
Legal status
International standards of the IEC are always voluntary. source

How compliance is assessed

Products, systems and development processes can be certified by ISO/IEC 17065-accredited bodies, for example under the ISASecure schemes.

ISASecure schemes
CSA and ICSA certify components to 62443-4-2, SSA systems to 62443-3-3, SDLA development processes to 62443-4-1, and ACSSA covers 62443-2-1, 2-4, 3-2 and 3-3. source
Certification bodies
ISASecure requires its certification bodies to be accredited to ISO/IEC 17065. source
Evaluation methods
IEC TS 62443-6-1 gives the evaluation methodology for Part 2-4, and IEC TS 62443-6-2 for Part 4-2. source source
Asset owner maturity
Part 2-1:2024 defines a maturity model for evaluating its requirements. source

Enforcement and penalties

IEC standards are always voluntary and do not seek to set public policy or regulations.

Voluntary
IEC standards are always voluntary and do not seek to establish, drive or motivate public policy or regulations. source

Documents

  1. Standard IEC 62443-2-1:2024 Security program requirements for IACS asset owners (catalogue entry)
  2. Standard IEC 62443-2-4:2023 Security program requirements for IACS service providers (catalogue entry)
  3. Standard IEC 62443-3-2:2020 Security risk assessment for system design (catalogue entry)
  4. Standard IEC 62443-3-3:2013 System security requirements and security levels (catalogue entry)
  5. Standard IEC 62443-4-1:2018 Secure product development lifecycle requirements (catalogue entry)
Show 4 more documents
  1. Standard IEC 62443-4-2:2019 Technical security requirements for IACS components (catalogue entry)
  2. Standard IEC TS 62443-1-1:2009 Terminology, concepts and models (catalogue entry)
  3. Guidance ISA/IEC 62443 series overview (ISA)
  4. Guidance ISASecure certification schemes

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to IEC 62443 (RSS)