ISMS CopilotIEC 62443 Copilot
Without IEC 62443-specific context, a general AI answer can blur who a part is written for, confuse target and capability security levels, or lose the part a requirement comes from. This assistant works part by part.
What the IEC 62443 Copilot Can Do
Help working out which parts matter for you as asset owner, service provider, system integrator, or product supplier
Support for the asset owner security program under the 2024 edition of part 2-1, including policies and compensating measures for legacy IACS that lack native technical capabilities
Zone and conduit partitioning and per-zone risk assessment for the system being designed (part 3-2)
Target security levels (SL-T) per zone and conduit, compared with the capability level (SL-C) a control system offers (parts 3-2 and 3-3)
Process documentation for product suppliers on building security into a product from first design through maintenance and retirement (part 4-1)
Comparison between an existing ISO 27001 ISMS and the IACS security program of part 2-1
About IEC 62443 Copilot
IEC 62443 assistant for asset owners, integrators, and product suppliers working on IACS security programs, zones, security levels, and secure development.
Part 2-1 (Ed. 2.0, 2024): the asset owner's program
Policies and procedures for operating an IACS securely, grouped into security program elements
Written for systems that can stay in service for more than twenty years, so legacy gaps are handled through policy and compensating measures rather than new technical features
The second edition adds a maturity model for assessing the requirements and drops what duplicated an ISMS
Part 3-2 (Ed. 1.0, 2020): risk for system design
Define the system under consideration, then split it into zones and the conduits between them
Assess risk zone by zone and conduit by conduit
Set a target security level (SL-T) for each zone and conduit and document the resulting requirements
Part 3-3 (Ed. 1.0, 2013, 2014 corrigendum): what the system can do
Technical requirements for the control system, organised under seven foundational requirements defined in part 1-1
Defines capability security levels (SL-C): the level a system can reach as designed
Read together with part 3-2: use the system requirements and capability levels of part 3-3 when designing the controls for each zone and conduit against its SL-T
Part 4-1 (Ed. 1.0, 2018): how suppliers build products
Secure development lifecycle requirements for hardware, software, and firmware
Covers the product from security requirements and design through implementation, verification, defect and patch handling, to retirement
Applies to the developer and maintainer of the product, not to whoever integrates or operates it
Cross-framework mappings
Working across IEC 62443 and another standard? ISMS Mappings is a free public directory of control maps (ISO 27001, SOC 2, NIST, GDPR, and more). A Better ISMS tool, separate from the chat assistant.
Browse free mappingsFrequently Asked Questions
What is IEC 62443?
IEC 62443 is the international standard series for the security of industrial automation and control systems (IACS). It began in ISA's ISA99 committee and was adopted by IEC, hence the name ISA/IEC 62443. It is a multi-part series that assigns different responsibilities to asset owners, service providers, system integrators, and product suppliers. Among its parts: the asset owner security program (part 2-1, second edition 2024), risk work for system design (part 3-2, 2020), technical system safeguards and security levels (part 3-3, 2013 with a 2014 corrigendum), and secure processes for developing products (part 4-1, 2018). It is a standards series, not legislation in itself: whether conformity is required depends on your contracts, procurement conditions, certification scheme, or sector rules.
Which parts apply to my organisation?
It depends on what you do with the system. An asset owner running an IACS starts with part 2-1 for its security program. For system design, part 3-2 covers defining the system being assessed, dividing it into zones and conduits, assessing risk, and setting target security levels, and part 3-3 describes what the control system must be capable of at each level. Part 4-1 is aimed at organisations that create or maintain a product, rather than those that integrate or operate it.
How does the Copilot help with IEC 62443?
Its curated IEC 62443 coverage is parts 2-1 (2024 edition), 3-2, 3-3, and 4-1. Within that scope it helps you draft security program documentation, work through zone and conduit risk assessment, separate target from capability security levels, and write development lifecycle procedures, naming the part each requirement comes from. Treat its output as a draft for your own review, and buy the parts you rely on from IEC or ISA: the Copilot is not a copy of the standard.
Can the Copilot certify us against IEC 62443?
No. ISMS Copilot cannot certify an organisation, system, or product. Certification runs through schemes such as ISASecure, which ISA states assures conformance to the ISA/IEC 62443 family for components, systems, and secure development lifecycles, and only an authorised certification process under the applicable scheme can issue one. The Copilot helps you prepare the documentation and evidence beforehand.
Ask it from your AI.
Connect ISMS Copilot to the assistant you already use and send it your IEC 62443 questions: zone models, security levels, development lifecycle procedures.