Security for Industrial Automation and Control Systems — Part 2-1: Security Program Requirements for IACS Asset Owners
Specifies the security programme an asset owner must operate for an industrial automation and control system in service, covering governance, risk management, asset inventory, access control, patching, monitoring and incident response. Developed jointly by ISA and IEC and commonly cited as ISA/IEC 62443.
What this does not cover
stated in the document's own scope- It specifies the asset owner’s programme, not technical requirements for IACS components; it says the asset owner needs policies and procedures, not that the IACS has particular technical capabilities.
- System-level technical requirements and security levels sit in IEC 62443-3-3, and technical requirements for IACS components in IEC 62443-4-2, not in this standard.
- It does not address GMP validation of control systems; qualification and data-integrity expectations remain those of the applicable GMP framework.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
IEC 62443-2-1 specifies the policies and procedures an asset owner’s security programme must contain for an industrial automation and control system (IACS) in operation. In the standard, "asset owner" includes the operator of the IACS — in a regulated plant, the site that runs the control systems, as distinct from the suppliers who build them. It recognises that an IACS can stay in service for more than twenty years and that legacy hardware and software may no longer be supported, so for older systems the programme may address only a subset of its requirements and use compensating security measures where native technical capability is missing.
Scope & applicability
The operator of the control system, not its supplier — the manufacturing site running the PLCs, DCS, SCADA and historians. This is the part of the 62443 series a regulated manufacturer owns directly; Part 4-1 and 4-2 place obligations on the product supplier instead.
Legal basis & how it acquires force
It is a voluntary International Standard of the International Electrotechnical Commission, developed by IEC TC 65 (industrial-process measurement, control and automation). The current text is edition 2.0, IEC 62443-2-1:2024, published on 7 August 2024, which revised the first edition of 10 November 2010. It has no legal force of its own; it applies where an asset owner adopts it or a contract requires it. The IEC’s conformity-assessment system IECEE publishes a test report form for it (IECEE TRF 62443-2-1A:2024).
Document structure
| Part | Covers |
|---|---|
| Scope and terminology | Asset-owner security-programme requirements for an IACS in operation, using the IACS definition and scope in IEC TS 62443-1-1 |
| Security programme elements (SPEs) | The requirement structure introduced in edition 2.0: the policies and procedures the programme must contain, grouped into security programme elements |
| Maturity model | A model, new in edition 2.0, for evaluating how fully each requirement has been implemented |
| Legacy systems and compensating measures | How a programme handles systems that cannot meet technical requirements such as patching or backup, through policy and compensating controls |
| Relationship to an ISMS | Edition 2.0 revised the requirements to eliminate duplication of an information security management system |
Key requirements
- A documented security programme with defined organisational roles and accountability
- Inventory of IACS assets, including the systems and connections that are easy to forget
- Risk assessment driving zone and conduit definition rather than a flat network
- Access control including remote and third-party access, granted per session rather than standing
- Patch, backup, restore and incident-response arrangements suited to systems that cannot simply be rebooted
Implementation tips
- Edition 2.0 (2024) restructured the requirements around a maturity model — check which edition a supplier or auditor is working to.
- The zone and conduit model is the practical bridge between this standard and GMP: it makes explicit which systems a GxP-critical control depends on.
- Vendor remote access is the control most often granted informally and never revoked; treat it as a named requirement rather than an IT convenience.
Revision notes
Edition 2.0 (2024-08) replaced the 2010 first edition, restructuring asset-owner requirements and aligning them with the wider 62443 series.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
IEC 62443-2-1 is the asset-owner part of the IEC 62443 series, which IEC TC 65 maintains as a family: IEC TS 62443-1-1 supplies the terminology, concepts and models, IEC 62443-3-3 sets system security requirements and security levels, and IEC 62443-4-2 sets technical security requirements for IACS components. Because edition 2.0 removed requirements that duplicated an information security management system, it can sit alongside an ISMS such as one certified to ISO/IEC 27001, covering what is specific to operating industrial control systems.
IEC 62443-2-1:2024: frequently asked questions
Quick answers to common questions about IEC 62443-2-1:2024.
What changed in IEC 62443-2-1:2024?
IEC lists three significant technical changes from the 2010 edition: the requirements were restructured into security programme elements (SPEs), they were revised to eliminate duplication of an information security management system, and a maturity model was defined for evaluating them.
Who is the "asset owner" in IEC 62443-2-1?
The organisation that owns the industrial automation and control system, and in this standard also its operator. It is the party that runs the IACS in operation, as opposed to the system integrator or the product supplier.
How does the standard treat legacy systems?
It recognises that many legacy IACS cannot meet requirements such as security patching or backup. For those systems the programme may address only a subset of requirements, and compensating security measures can form part of the policies and procedures it specifies.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.