CRS & Risk Analysis Reports

The IEC 62443 module offers 3 report formats, from the richest to the most condensed: the CRS Report (full and customisable), the light CRS (derived automatically, without detailed risk analysis) and the Risk Analysis Report (a fixed, synthetic working document).

CRS Report — full (/iec62443/rapport)

The main report, editable section by section, with Word and Excel export.

Buttons

Button	Function
⬇ Word Report	Generates the Word document (.docx)
📊 Excel Export	Generates the Excel workbook (.xlsx)
Grid	Shows/hides cell borders

Tabs

⬇ Export · 🗂️ Editor · 🎨 Styles · 👁 Data preview.

Export

Summarises the document (title, version, status, zones, ZCR2 risks, active sections), lists the enabled Word sections and the generated Excel tabs (CRS Coverage, Zones, Conduits, ZCR2 – Initial risk, ZCR4 – Comparison, ZCR5 – Detailed evaluation, Threats, Policies, Regulatory, Environment assumptions, Risk matrix).

Editor

Tree of document sections (checkboxes to enable/disable, ZCR reference badge, modification indicator, reset button):

cover Cover page · gestion Document management · resume Executive summary · zcr6-1 to zcr6-9 (CRS overview, SUC description, Zones and conduits, Characteristics, Environment assumptions, Threat environment, Security policies, Tolerable risk, Regulatory requirements) · zcr5 Detailed risk analysis · synthese Summary and recommendations.

For the selected section: displayed title, narrative fields linked to the project's data, clickable variables to insert, and a two-mode Markdown editor (✎ Markdown / 👁 Preview).

Available table placeholders: TABLE-ZONES, TABLE-CONDUITS, TABLE-ZONES-DETAIL, TABLE-CONDUITS-DETAIL, TABLE-RISQUES-ZCR2, TABLE-ZCR4-COMPARAISON, TABLE-ZCR5, TABLE-MENACES-CURRENT, TABLE-MENACES-EMERGING, TABLE-POLITIQUES-*, TABLE-REG-REQS, TABLE-ENV-PHYSICAL, TABLE-ENV-LOGICAL, MATRICE-RISQUE-ZCR2, MATRICE-RISQUE-ZCR5, DIAGRAMME-SUC, TABLE-SLT-ZONES, TABLE-HISTORIQUE-CRS.

Styles

Primary colour (H1), secondary colour (H2), accent colour (H3), font (Calibri, Arial, Times New Roman, Helvetica, Georgia), body text size (9 to 14 pt), cover title and subtitle — with a live rendering preview.

Data preview

Data check before export: CRS metadata, SUC description, zones (Name, Type, SL-T, Score, Organisation), ZCR2 risks, summary risk matrix, threats, policies, regulatory requirements, ZCR4 comparison.

Appendix sections to enable

Two content sets are only output if the corresponding section is checked in the editor:

• Appendix – Components & points to develop — the evaluated IEC 62443-4-2 requirements, the SL-C per component and the list of points to develop (see SL-C Components). Included in both the Word and Excel exports.
• Appendix – SIS mode & lifecycle — the tables of the two optional profiles: cyber-LOPA, IAONA life records, CFAT/CSAT/PSSR checklists, SL-A evaluations and the patch register.

The SL-A calculated in Compliance Analysis is also included in the CRS report.

The most complete of the 3 formats

This is the only one of the three reports where the text of each section is editable and the Word document's visual style can be customised.

CRS Report — light (/iec62443/crs-leger)

A 100% summary format, with no data entry, automatically deriving the applicable requirements without going through the detailed risk analysis (ZCR5): a requirement is retained if its required SL is less than or equal to the zone's SL-T.

• 4 key figures: Zone(s), Conduit(s), Average SL-T, Derived requirements.
• An Applicable requirements by zone block: name, target SL, number of requirements, and an FR / Requirement / Required SL table.
• A single button: ⬇ Export the light CRS (Excel).

When to use it

Useful for a quick baseline of applicable requirements before starting the detailed ZCR5 analysis, or for a customer who does not need the full CRS.

Risk Analysis Report (/iec62443/rapport-analyse)

A synthetic working document, with a fixed, non-customisable 10-section structure:

1. Cover page
2. Study context
3. SUC description
4. Equipment inventory
5. SUC diagram
6. Vulnerabilities and CVEs
7. Initial risks (ZCR2)
8. Zones and conduits (ZCR3)
9. Risk/tolerance threshold comparison (ZCR4)
10. Detailed analysis and countermeasures (ZCR5)

A summary at the top of the page counts the available data (equipment, retrieved CVEs, ZCR2 risks, ZCR3 zones/conduits, ZCR4 risks exceeding the threshold, ZCR5 scenarios), and each section shows a status badge: ✓ data present, ~ partial/optional, ! missing.

Buttons: ⬇ Word Report, 📊 Excel Export.

Project follow-up report

Unlike the CRS Report, this format is not meant to be delivered as-is to the client but to serve as an internal checkpoint to verify the completeness of the analysis before producing the final CRS.