Compliance Analysis
The Compliance page (menu Compliance Analysis) measures, zone by zone, how far security requirements (SR — System Requirements from IEC 62443-3-3, broken down into CR — Component Requirements from IEC 62443-4-2) are covered by the countermeasures actually evaluated in ZCR5, and drives the associated corrective actions.
The 7 Foundational Requirements (FR)
The full set of requirements is organised around the standard's 7 Foundational Requirements, plus an organisational category:
| FR | Title |
|---|---|
| FR1 | Identification and Authentication Control (IAC) |
| FR2 | Use Control (UC) |
| FR3 | System Integrity (SI) |
| FR4 | Data Confidentiality (DC) |
| FR5 | Restricted Data Flow (RDF) |
| FR6 | Timely Response to Events (TRE) |
| FR7 | Resource Availability (RA) |
| ORG | Organisational measures |
Two tabs, two different questions
| Tab | Question |
|---|---|
| Coverage | Do the countermeasures activated in ZCR 5 cover the requirements applicable to the zone's SL-T? |
| SL-A | What security level is actually achieved, per FR? |
The SL-A tab rates each SR/RE requirement from the IEC 62443-3-3 catalogue and derives the level achieved: an FR reaches level N if all SR at level ≤ N are compliant or compensated. The result is capped at the SL-T and compared to both the SL-T and the SL-C.
Reading the two gaps
SL-T vs SL-C shows what needs to be bought or replaced — see SL-C Components. SL-T vs SL-A shows what remains to be implemented.
This page changes role as the study progresses
Before the detailed analysis, compliance is a baseline assessment: it measures the gap between the protections already in place and the targeted level. This is the observation that feeds the light CRS.
After ZCR 5, it becomes a verification: do the selected countermeasures actually meet the SL-T requirements of each zone? To be iterated until the residual risk is acceptable.
Zone selection and indicators
A navigation bar offers one button per zone, with the target SL and the % coverage of the zone. A global "rollup" shows the average coverage rate and the counters by component status.
For the selected zone: target SL, number of relevant SRs (those whose required SL ≤ the zone's SL-T), number covered / partial / not covered, % coverage (display thresholds: ≥80% green, ≥50% orange, otherwise red).
Combinable filters: by FR (FR1-FR7 + ORG) and by status (Covered / Partial / Not covered).
Table
| Column | Description |
|---|---|
| FR | Foundational Requirement concerned |
| SR (3-3) | IEC 62443-3-3 system requirement |
| CR (4-2) | Corresponding IEC 62443-4-2 component requirement |
| Countermeasure | Library measure associated with the SR |
| ZCR5 coverage | Status derived from ZCR5 evaluations (deployed = covered, partial otherwise, absent = not covered) |
| Component status | Status selector (deployed, planned, not applicable…) |
| Action / Workshop decision | Editable inline text field |
| Notes | Editable inline text field |
Rows are grouped by FR, with a group header showing the FR's % coverage.
✦ Analyse gaps button
The AI button automatically identifies the uncovered or partial SRs of the selected zone and suggests a status, a corrective action and a note — to be validated before import into the table.
Workshop page, not a report
This page is a working tool (entry/consultation), with no dedicated export. The compliance summary per zone and the SL-A are included in the CRS Report, and corrective actions feed the action plan.