Guide — IEC 62443

1Overview

The IEC 62443 standard (formerly ISA-99) defines a cybersecurity framework for industrial control systems. It structures analysis around security zones that group OT equipment by risk level and protection needs.

📋

Contexte / SUC

Scope and objectives

🗄

ZCR1 — SUC

Inventaire, diagramme, CVE

⚠

ZCR2—Risks

Initial overall assessment

🗺

ZCR3 — Zones

Segmentation and SL-T levels

⚖

ZCR4 — Comparaison

Tolerable-risk threshold

🎯

ZCR5—Detailed

Menaces, MITRE, contre-mesures

📑

ZCR6 — CRS

Document normatif 9 sections

Workflow

Context → ZCR1 SUC → ZCR2 Initial Risks → ZCR3 Zones/SL-T → ZCR4 Comparaison → ZCR5 Detailed → ZCR6 CRS → Report page

2Create an IEC 62443 project

Project type	Use
Cyber OT	IEC 62443 only—pure OT cybersecurity analysis
Cyber OT + EBIOS	Combined IT/OT analysis—EBIOS for IS and IEC 62443 for OT
Multi-modules	IEC 62443 + Industrial Risk (e.g. a SEVESO site with SCADA)

The AI assistant can automatically generate context, initial risk scenarios, and an initial zone structure—see AI Scoping.

3Context and SUC

The Context defines the System Under Consideration (SUC) —the exact scope of the OT system under analysis. It has seven tabs: General, Scope & Objectives, Configuration, Team, Sessions, Documents, and Revalidation.

IEC 62443 Context — Context page—SUC identification, operator, scope, and applicable standards

Field	Description
Study title / SUC	Document identifier and name of the industrial control system under analysis
Operator / Integrator	Operating entity and engineering firm responsible for the assessment
Functional / physical scope	Equipment and networks included in or excluded from the analysis
Assessment objectives	Availability, integrity, confidentiality, and traceability—priorities depend on context
Applicable standards	Dynamic list—IEC 62443-3-2, ANSSI ICS, NIS2, and sector regulations
Team / Sessions / Documents	Working-group members, meetings with attendance, and reference documents

SUC diagram

The ✦ Fiche IA generates a structured document—SUC, proposed zones, business values, and regulations—that can be fed directly into AI Scoping.

4AI Scoping

The AI Scoping applies the same principle to IEC 62443 as to other modules: describe the OT/ICS context in natural language and let an AI engine pre-fill part of the analysis—here the Context, initial assessment ZCR2 and zones/conduits ZCR3.

Scoping worksheet

Text area for a Markdown SUC description—process, equipment, network, and exposure—with ready-made examples for chemicals, drinking water, and energy. Up to three images may be attached. Three sections can be pre-filled: IEC 62443 Context, ZCR2, and ZCR3.

A confirmation dialog warns that analysing the worksheet deletes existing data from selected sections before repopulating them.

Other targeted AI features exist in the module: CVE suggestions (ZCR1), SL-T suggestions by zone (ZCR2), threat-scenario generation (ZCR5), and gap analysis (Compliance).

5ZCR1 — Identify the SUC

ZCR1 models the System Under Consideration: equipment and network inventory, functions, users and roles, access points, visual system diagram, and known-vulnerability analysis (CVE).

ZCR1 actifs — ZCR1—OT asset list with type, location, and criticality

ZCR1 vulnerabilities — ZCR1—vulnerabilities identified by asset

Onglet	Content
Equipment	Tag, type (PLC/DCS, HMI, SCADA server, sensor, etc.), location, owner, and networks
Networks (optionnel)	Name, type, and connected equipment
Functions	Process functions—the equivalent of EBIOS business values
Users & Roles	Administrator, Operator, Maintenance Technician, etc., with SL1–SL4 access level
Access points	Physical/network/wireless/remote, external exposure, encryption, and authentication
SUC diagram	SVG graphical editor (zones, conduits, and equipment)—SVG export

Equipment CVE analysis

CSV/Nmap XML import, cross-analysis with public databases (NVD/ICS-CERT), CVSS severity filtering, and direct insertion of suggested scenarios into ZCR5.

The equipment/networks are actually EBIOS RM supporting assets filtered by category, while functions correspond to EBIOS business values; data is shared between the two modules.

The analysis sequences NVD requests (~700 ms apart, public limit of five requests per 30 seconds), so full analysis of a large inventory may take several minutes.

6ZCR2—Initial risk assessment

ZCR2 performs a preliminary cyber-risk assessment at overall SUC level before zone segmentation. Each row links an asset to a feared event and risk rating (likelihood × severity).

ZCR2 initial risks — ZCR2—initial risk scenarios by asset with likelihood and severity

Loss type	Description	Exemple OT
Availability	Process shutdown or disruption	Pump unavailability, turbine shutdown
Integrity	Unauthorised modification of data or commands	Pressure-setpoint modification, sensor falsification
Confidentiality	Disclosure of process data	Exfiltration of production recipes
Traceability	Loss of event history	Deletion of alarm logs

The ✦ Suggest scenarios proposes four to seven directly importable initial risk scenarios.

Every ZCR2 row is reused in ZCR4 (comparison with tolerable threshold) and the ZCR6 CRS document (section 6.8).

7ZCR3—Zones and conduits

ZCR3 segments the SUC into security zones connected by conduits, following IEC 62443-3-2 segmentation rules. Every zone receives a SL-T (Security Level Target).

IEC metrics — Metrics—SL levels and rating scales

Niveau SL	Protection contre
SL0	No particular requirement
SL1	Attaquant non intentionnel (erreur humaine)
SL2	Intentional attacker with limited resources
SL3	Sophisticated attacker with substantial resources
SL4	Attacker with nation-state resources

A conduit inherits an SL-T at least equal to the higher of the two connected zones. Six IEC 62443 reference rules—IT/OT separation, safety systems, temporary/wireless devices, and external connections—are documented in the dedicated tab.

A conduit between zones with different SLs must be protected at the higher level of the two zones.

Zones created here also appear in the SUC Diagram (ZCR1) and form the basis for ZCR4, ZCR5, and sections 6.3/6.4 of the CRS document (ZCR6).

8ZCR4—Comparison with tolerable threshold

ZCR4 compares every initial risk identified in ZCR2 with a tolerable-risk threshold, to decide which risks require detailed analysis (ZCR5).

Element	Description
Tolerance threshold	Set globally and overridable by row
Decision	Tolerable or Detailed analysis required, calculated from initial risk and applicable threshold
Risk matrix	Clickable L×S matrix—every cell displays a T (Tolerable) or ! (Analysis required) badge

Every risk marked Detailed analysis required is automatically used as the starting point for a ZCR5 scenario.

9ZCR5—Detailed analysis & MITRE ATT&CK

ZCR5 performs detailed risk analysis for every scenario selected by ZCR4: threat, vulnerabilities, severity, likelihood, risk, SL-T, countermeasures, and residual risk, in eight stages (5.1 to 5.12) through session documentation (5.13).

Step	Content
5.1 Menaces	Source, motivation/capability, analysed zones, attack vectors, and MITRE ATT&CK for ICS stages
5.2 Vulnerabilities	ICV rating (0 to 4) by supporting asset, common/cross-cutting vulnerabilities
5.3-5.5	Severity, unmitigated likelihood, and automatically calculated unmitigated cyber risk
5.6 SL-T	SL-T set for the relevant zone/conduit
5.7-5.8 Contre-mesures	Selection from a library filterable by Foundational Requirement, status, and effectiveness
5.9–5.12 Residual	Residual likelihood/impact, comparison, and analysis status

MITRE ATT&CK for ICS framework

The MITRE ATT&CK for ICS framework is integrated into threat analysis: select intermediate attack-chain stages (5.1), use reference tables for final tactics and Feared Event ↔ MITRE mappings in the Guide, and manage the full framework in the dedicated library.

The ✦ Generate scenarios proposes detailed threat scenarios, using CVEs identified by ZCR1 where needed.

10ZCR6 — Document CRS

ZCR6 consolidates the entire analysis into the document CRS (Cybersecurity Requirements Specification) required by IEC 62443-3-2 (§4.7.2): nine numbered sections from SUC description to regulatory requirements.

Section	Content
6.1 CRS Metadata	Title, version, status, authors, and scope
6.2 SUC Description	High-level description and SUC boundaries
6.3-6.4 Zones and conduits	Import from ZCR3, normative characteristics (a) to (n)
6.5 Environnement d'exploitation	Physical and logical assumptions
6.6 Threat environment	Current and emerging threats
6.7 Politiques organisationnelles	Applicable security policies
6.8 Tolerable risk	Threshold imported from ZCR4
6.9 Regulatory requirements	Regulations, clauses, and applicability status

A status badge (Draft / In review / Approved / Archived) and progress bar track drafting before export.

11Rating and security levels

Two structural settings affect entry across several pages. Set them before starting to avoid rerating an advanced study.

Rate likelihood: Vc alone or Vp × Vc

The mode applies to ZCR2 and ZCR5 together —the standard (§4.6.1) requires the same rating scale for initial and detailed analyses.

Mode	Principle
Vc seule	One likelihood value combined with severity. The consequence-only approach in §4.6.5.2 is a special case.
Vp × Vc	Two combined dimensions: Vp, process robustness given an attacker is present—it represents non-cyber barriers, which §4.6.5.2 explicitly allows to be credited; Vc, structural exposure to the adversary.

Vp is the only dimension that can be populated automatically from an existing LOPA through cyber-LOPA. Vc is always entered manually.

The SL-T → SL-C → SL-A chain

Three levels share the acronym SL and are read in this order: what is targeted, what equipment can deliver, and what is actually achieved.

Level	Signification	Where
SL-T —target	Required level for a zone, derived from risk. Suggested automatically by zone, then confirmed.	ZCR3 / ZCR5.6
SL-C —capability	What equipment can deliver: declared (ISASecure certificate) or derived from IEC 62443-4-2 requirements, filtered by component type.	Annexe 4-2
SL-A —achieved	Calculated using the IEC 62443-3-3 SR catalogue: an FR reaches level N when every SR at level ≤ N is compliant or compensated.	Compliance

The gap SL-T vs SL-C shows what must be purchased or replaced; the SL-T vs SL-A shows what remains to implement. The Components & development points appendix provides one prioritised, exportable row per missing requirement.

Two optional study profiles

Profil	Apport
Analyse SIS (IEC 61511 / ISA TR84.00.09)	Essential functions in ZCR1, cyber-LOPA tab in ZCR2, six-factor likelihood calculator and CRRF/CIPL crediting in ZCR5, and CSA review in ZCR6.
Lifecycle (IEC 62443-2-3)	IAONA-model cyber lifecycle records, CFAT / CSAT / PSSR acceptance checklists, periodic SL-A assessments, and patch/alert register.

The two profiles are independent and disabled by default: they add tabs and pages without removing or modifying existing content.

12Compliance and steering

The Compliance measures, zone by zone, coverage of security requirements (SRs from IEC 62443-3-3, implemented as CRs in IEC 62443-4-2) by countermeasures assessed in ZCR5, organised around seven Foundational Requirements (FR1 to FR7) plus an organisational category (ORG).

ZCR4 compliance — Compliance—requirement achievement rate by zone and foundation

Pilotage IEC — Steering—treatment-plan dashboard by zone

FR	Name
FR1	Identification and authentication control (IAC)
FR2	Use control (UC)
FR3	System integrity (SI)
FR4	Data confidentiality (DC)
FR5	Restricted data flow (RDF)
FR6	Timely response to events (TRE)
FR7	Resource availability (RA)

The ✦ Analyse gaps automatically identifies uncovered or partially covered SRs in the selected zone and proposes a status, corrective action, and note.

The IEC 62443 library provides a catalogue of preformatted security measures by foundation and SL—import them directly into your treatment plan.

13Generate the report

The module provides three report formats, from the most comprehensive to the most concise.

IEC 62443 report—summary by zone and Word-exportable treatment plan

Format	Use
CRS report	Full customisable report, Markdown-editable sections, configurable Word styles, and Word/Excel export
Lightweight CRS	Automatic summary of applicable requirements without detailed analysis (ZCR5), Excel export only
Risk Analysis Report	Internal working document with a fixed ten-section structure for checking completeness before the final CRS

Generate the Word report

Open the CRS report from the navigation menu
Check data in the Data Preview tab
Select sections to include in the Editor tab (context, zones, ZCR5, compliance, etc.)
Click ⬇ Word report

Excel export is available for the asset inventory, zones/conduits, and treatment plan—use the 📊 Export Excel button on every relevant page.