Industrial Communication Networks — Network and System Security — Part 3-3: System Security Requirements and Security Levels
Defines system security requirements against the seven foundational requirements of the 62443 series and assigns security levels, so that the protection a control system needs can be stated as a target rather than argued case by case.
What this does not cover
stated in the document's own scope- It specifies technical system capabilities, not the asset owner’s security management programme, which is Part 2-1.
- It does not set the target security level for a given system; that comes from the risk assessment in Part 3-2.
- Component-level requirements for products are in Part 4-2.
- It does not address GMP validation of the control system; a security capability is not evidence of fitness for intended use.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
IEC 62443-3-3 sets out the detailed technical security requirements for an industrial automation and control system. It translates the seven foundational requirements described in IEC 62443-1-1 into system requirements and requirement enhancements, and uses them to define the security level a control system is capable of, SL-C. Asset owners, integrators and suppliers use it together with the zones and conduits defined for the system under consideration to set a target security level, SL-T, for a specific asset and to show how the system meets it.
Scope & applicability
The control system as an integrated whole, at the design stage. It is the part that turns a risk assessment into testable system requirements, which is why it is the natural counterpart to a GMP user-requirement specification for an automated system.
Legal basis & how it acquires force
An International Standard published by the IEC, edition 1.0, dated 7 August 2013, with a corrigendum in 2014. It is voluntary: it acquires force through contracts, procurement specifications, certification schemes and, in some jurisdictions and sectors, regulatory reference. In regulated manufacturing it is used to specify and assess the security of the control systems that run GMP processes, alongside GMP requirements for computerised systems.
Document structure
| Part | Covers |
|---|---|
| Introduction and scope | The place of Part 3-3 in the 62443 series and the system under consideration |
| Common control system security constraints | Assumptions that apply across the requirements |
| Foundational requirements | System requirements grouped under the seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability |
| Requirement enhancements and security levels | Enhancements that raise a requirement’s strength, mapped to capability security levels 1 to 4 |
Key requirements
- Seven foundational requirements: identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability
- Security levels 1 to 4 expressing the capability required against the threat assumed
- Requirements stated so they can be verified during system acceptance rather than asserted
- Zone-level target security levels derived from risk assessment
Implementation tips
- Target security level per zone is the decision that matters; it is set by risk assessment under Part 3-2, not by this part.
- Map the seven foundational requirements onto the automation user-requirement specification so security is tested at FAT and SAT rather than retrofitted.
- This part dates from 2013 and predates much current OT practice — use it for the requirement structure, and read it alongside the 2024 asset-owner edition.
Revision notes
Edition 1.0 (2013-08) remains the current edition of this part; later work in the series has extended rather than replaced it.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
Part 3-3 is the system-level member of the IEC 62443 series. IEC 62443-3-2:2020 sets the method for partitioning a system into zones and conduits, assessing risk and assigning the target security level that Part 3-3 is then measured against. Part 4-2 sets equivalent technical requirements for individual components, and Part 2-1 addresses the asset owner’s security programme.
IEC 62443-3-3:2013: frequently asked questions
Quick answers to common questions about IEC 62443-3-3:2013.
What is the difference between SL-C and SL-T?
SL-C is the security level a control system is capable of achieving when properly configured, defined through the requirements and enhancements in Part 3-3. SL-T is the target security level set for a specific zone or conduit, which Part 3-2 establishes from a risk assessment.
Which edition of IEC 62443-3-3 is current?
Edition 1.0 of 7 August 2013, with Corrigendum 1 of 2014, as listed on the IEC Webstore.
How does Part 3-3 relate to the rest of the series?
It uses the seven foundational requirements from Part 1-1, is measured against targets set by the Part 3-2 risk assessment, and has a component-level counterpart in Part 4-2.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.