Compliance management in 20 secondsProject, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.
What is IEC 62443?
IEC 62443 is an international series of standards on the cybersecurity of industrial automation and control systems (OT). It describes requirements for asset owners, integrators and manufacturers, including the division into zones and conduits, security levels and the asset owner’s security programme.
Content as of:
Does it apply to me?
IEC 62443 is a series of standards, not a legal obligation. It is the recognised framework for OT security in industry and is often referenced by customers or in the context of NIS2 and the Machinery Regulation.
The module is aimed at asset owners as well as integrators and OT service providers supporting them.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
IEC 62443-2-1Security programme requirements for asset owners
IEC 62443-3-2Security risk assessment, zones and conduits
IEC 62443-3-3System security requirements and security levels
Anhang III Abschn. 1.1.9 MaschinenVOAnnex III Section 1.1.9 Machinery RegulationProtection against corruptionThe machinery or related product shall be designed and constructed so that the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with the machinery or related product does not lead to a hazardous situation. A hardware component transmitting signal or data, relevant for connection or access to software that is critical for the compliance of …As of: 06.10.2026 · Source: EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026Open original (EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026) ↗Protection against corruption, often implemented with IEC 62443
Key dates
There are no statutory deadlines for IEC 62443. Schedules result from your projects, customer requirements or obligations under NIS2 and the Machinery Regulation; you maintain dates in the project plan.
How Complass helps
Nine phases for asset owners
System under consideration, asset inventory, initial and detailed risk assessment, zones and conduits, target security levels, security programme, gap analysis and action plan.
Connected with asset management
Zones, conduits and SL-T are derived from the shared asset inventory, including a zone proposal from the networks.
Catalogue IEC 62443-3-3
System requirements by foundational requirements FR1–FR7 with status and evidence.
OT templates
Including cybersecurity requirements specification, remote maintenance concept, patch and vulnerability process, backup and recovery concept and OT incident response plan.
Good to know: You can also meet the requirements without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information
Frequently asked questions
Does Complass also support manufacturers under IEC 62443-4-1/4-2?+
The module is aimed at asset owners and integrators. Manufacturers currently implement product requirements via the CRA module, which is linked with IEC 62443.
Are the texts of the standard included?+
No, IEC standards are protected by copyright. Complass explains the requirements and refers to the source; you can store your own excerpts.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
