> iec_62443-3-3:2013
IEC 62443-3-3:2013
Security for Industrial Automation and Control Systems — Part 3-3: System Security Requirements and Security Levels
IEC 62443-3-3 specifies detailed technical cybersecurity requirements for industrial automation and control systems. Built upon seven Foundational Requirements (FRs)—Identification & Authentication, Use Control, Data Integrity, Data Confidentiality, Restricted Data Flow, Timely Response to Events, and Resource Availability—it outlines progressive System Requirements (SRs) and Requirement Enhancements (REs) required to achieve SL 1 through SL 4.
Scope & Applicability
System-level technical evaluation of integrated control system architectures, DCS clusters, and SCADA implementations.
Non-Coverage Boundaries
Does not evaluate individual hardware components in isolation (which is covered by 4-2) or service provider personnel (2-4).
Key Clauses & Control Requirements
FR 1: Identification and Authentication Control
Unique user identification, multifactor authentication on untrusted interfaces, credential management, and strength verification.
FR 5: Restricted Data Flow (Conduit Enforcement)
Network segmentation, stateful inspection, and deep packet inspection of industrial protocols traversing zones.
FR 7: Resource Availability (DoS Defense)
Defending process controllers from network broadcast storms, buffer exhaustions, and denial-of-service degradation.
Required Regulatory & Audit Evidence Artifacts
- [✓]IACS System Security Requirements Specification (SSRS)
- [✓]Security Level Verification Test Matrix demonstrating compliance with SL-A
- [✓]Network Packet Capture (PCAP) showing encrypted or authenticated industrial sessions
“Do not accept vendor claims of 'cyber-secure DCS' without a formal IEC 62443-3-3 certificate stating the exact achieved Security Level (SL-A).”
Cross-Surface Ecosystem Relationships
- IEC 62443-3-3:2013 System security requirements and security levels ↗(International Electrotechnical Commission)
Frequently Asked Questions
What are the 7 Foundational Requirements (FRs) in IEC 62443-3-3?
1. Identification & Authentication, 2. Use Control, 3. System Integrity, 4. Data Confidentiality, 5. Restricted Data Flow, 6. Timely Response, 7. Resource Availability.