ISA/IEC 62443 Services

Accelerate your cyber readiness and gain visibility on your security posture with ISA/IEC 62443 services  

Digital technologies have successfully penetrated the manufacturing sector and continue to do so at an ever-increasing rate. This merging of the cyber and physical worlds offers improved efficiency but also exposes your critical manufacturing infrastructure to cyber risk.    

Testing to the ISA/IEC 62443 standard for industrial control system (ICS) manufacturers, integrators and asset owners

The international standard ISA/IEC 62443 was created to lay a cybersecurity foundation for a wide range of industries. It aims to mitigate risks for industrial communication networks by defining procedures for implementing electronically secure plants, facilities and systems across industries. 

The various ISA/IEC 62443 standards are developed for ICS manufacturers, integrators and end users. 

For component and product manufacturers

Compliance with ISA/IEC 62443 can help demonstrate the security of your systems and components and enhance your market position. We can support each step of the cybersecurity lifecycle, from qualified educational services to assessments, design support, certification readiness and operation and maintenance of your cybersecurity posture.

We offer educational, advisory and assessment services. We support ISA/IEC 62443-4-1 as well as on the security functionalities and the robustness of individual product components following ISA/IEC 62443-4-2.

For ICS integrators and users of control systems

Compliance with ISA/IEC 62443 is a powerful way to increase brand protection and gain a competitive advantage.

We help support those efforts with assessments of your procedures and policies, following ISA/IEC 62443-2-4. Moreover, we offer multiple services for organizations integrating ICS systems and components by verifying the secure way in which these products are deployed within the network, following ISA/IEC 62443-3-3.

Security services from every angle

UL Solutions offers end-to-end services to help you address the changes and challenges in the industrial OT ecosystem and to support your organization from strategy to compliance, leading to a better industrial cybersecurity posture. Learn more about each service below.

Market enablement

As regulations evolve, it is important to understand all their applicable requirements and how you can achieve and sustain compliance. UL Solutions has expertise in cybersecurity standards development, conformity assessment and understanding regulations for industrial applications. We can support market enablement and cybersecurity scoping for your organization globally to help you take the first step on your cybersecurity journey.

Training and workshops

During an interactive training or tailored workshop, we will empower you to make educated choices based on the ISA/IEC 62443 family of standards, tailoring the training content and approach according to your organizational role and addressing issues related to control and automation systems. The course will dive into industry best practices and how expected requirements can be applied to your products, making it possible to define a certification road map and next steps for your organization if necessary or requested.

OT risk assessment

We can help your organization assess the threat likelihood and evaluate the worst-case scenario if a cyber asset is compromised, supporting your company in determining the current maturity level of your OT systems. We can identify the risks to your designed industrial automation and control systems. Our OT cybersecurity experts can provide a holistic perspective, including a detailed risk assessment report based on ISA/IEC 62443-3-2. OT risk assessment services include:

• Methodology overview.
• Vulnerability overview for the OT environment.
• Gap analysis between the plant’s existing state and security requirements.
• Mitigation plan for the exposed risk level.
• Evaluation of existing countermeasures.
• Recommendation of additional countermeasures.
• Road map on how to develop or improve the security program.

Gap analysis for certification readiness

We offer a constructive review that will detail the differences between your current and desired state for meeting ISA/IEC 62443 sub-standards requirements, considering your organization’s security-level goals. We can also customize your gap analysis report to include testing.

Documentation review and support

We can provide ISA/IEC 62443-oriented documentation reviews to support you in achieving your desired security level. We use a four-level metric to indicate the level of readiness of the defined processes and technical documentation. We can propose security-relevant changes to make the document support the essential requirements and enhancements. Our team can advise you on the following activities before and after you submit your project documentation to the auditors:

• Writing conformity statements.
• Conformity evidence.
• Reviewing the final documentation.
• Supporting the team in closing any gaps.
• Preparing the team for interviews with auditors.

Penetration testing

Our penetration tests provide clear insights into the security level of your product, system and infrastructure. After the penetration test, you will receive a report with the test results, including demonstrated vulnerabilities within your product, system and infrastructure.

Building the control system cybersecurity management system (CSMS) for IACS

We can support your organization in building your IACS cybersecurity management system to align with your CSMS related to ISA/IEC 62443-2-1. This service includes various elements from four main categories:

• Risk analysis.
• Addressing risk with the CSMS.
• Monitoring and improving the CSMS.
• Mapping between ISO/IEC 27001 and ISA/IEC 62443-2-1.

Certification

We can assess and certify system integrators and maintenance service providers to give confidence to plant owners and operators. We offer assessment and certification options to respond efficiently and sustainably to your needs.

Surveillance and inspection

Our surveillance and inspection services help verify if you took sufficient security measures to maintain your certification status. At the end of the inspection, you will receive a report with the results you can use to determine the right actions to help demonstrate the maturity and security level meets the set goals.