Secure development lifecycle and technical component requirements for manufacturers of controllers, gateways, operating software and network components.
Compliance management in 20 secondsProject, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.
What is IEC 62443 manufacturer?
IEC 62443-4-1 describes how manufacturers of industrial automation components set up a secure development lifecycle: from security management through threat model, design and testing to vulnerability handling, updates and security guidelines. IEC 62443-4-2 defines which technical security capabilities a component must provide per security level (SL-C).
Content as of:
Does it apply to me?
IEC 62443-4-1 and 4-2 are standards, not a legal obligation. Customers increasingly require them in tenders, and they are an obvious technical basis for the obligations under the Cyber Resilience Act and the cybersecurity requirements of the Machinery Regulation.
The module is aimed at manufacturers of components for industrial automation and at machine builders with their own controller or software development. Asset owners and integrators use the modules for their role.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
IEC 62443-4-1Secure product development lifecycle
IEC 62443-4-2Technical security requirements for components
Anhang I Teil I CRAAnnex I Part I Cyber Resilience ActCybersecurity requirements relating to the properties of products with digital elements(1) Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks. (2) On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall: - (a) be made available on the market without known exploitable vulnerabilities; - (b) be made available on …As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗Essential cybersecurity requirements for products, closely related to 4-2
Anhang I Teil II CRAAnnex I Part II Cyber Resilience ActVulnerability handling requirementsManufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products; (2) in relation to the risks posed to products with digital elements, address and remediate …As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗Vulnerability handling, closely related to the DM and SUM practices of 4-1
Anhang III Abschn. 1.1.9 MaschinenVOAnnex III Section 1.1.9 Machinery RegulationProtection against corruptionThe machinery or related product shall be designed and constructed so that the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with the machinery or related product does not lead to a hazardous situation. A hardware component transmitting signal or data, relevant for connection or access to software that is critical for the compliance of …As of: 06.10.2026 · Source: EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026Open original (EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026) ↗Protection against corruption, often implemented for components with 4-2
Key dates
There are no statutory deadlines for IEC 62443 itself. For manufacturers, the deadlines of the CRA (reporting obligations since 11 September 2026, full application from 11 December 2027) and of the Machinery Regulation (from 20 January 2027) apply; you maintain dates in the project plan.
How Complass helps
Nine phases for manufacturers
Product goal and maturity level, security management, threat model, secure design, security testing, PSIRT, security updates, security guidelines and component requirements per SL-C.
Two catalogues
All 47 practice requirements of 4-1 and the component requirements of 4-2 with SL mapping and links to the CRA and the Machinery Regulation. Every requirement has an implementation guide with steps, evidence and industrial examples; 4-2 can be filtered by component type.
SBOM, vulnerabilities and CSAF
SBOM per product version, automatic matching with NVD, KEV, EPSS and EUVD, VEX assessment and vendor advisories in CSAF format.
Manufacturer templates
Including SDL description, threat model, security test plan, PSIRT process, update concept, hardening guide, SL-C statement and mapping to CRA Annex I.
The phases in the module
Product, role, target market and certification target
Security management in the development process (SM-1 to SM-13)
Security requirements and threat model (SR-1 to SR-5)
Secure design and secure implementation (SD-1 to SD-4, SI-1 and SI-2)
Verification and validation, security testing (SVV-1 to SVV-5)
Vulnerability handling and PSIRT (DM-1 to DM-6)
Security updates (SUM-1 to SUM-5)
Security guidelines for users and hardening guide (SG-1 to SG-7)
Technical component requirements under 62443-4-2 and proof of conformity
Catalogue: IEC 62443-4-1 – requirements for the secure development process (practices)
Good to know: You can also meet the requirements without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information
Frequently asked questions
Does IEC 62443-4-2 replace the conformity assessment under the CRA?+
No. Harmonised standards for the CRA are in preparation; as long as their references are not published in the Official Journal, IEC 62443 does not give rise to a presumption of conformity. You can, however, describe 4-1 and 4-2 as the chosen technical solution in the technical documentation; the module contains a mapping template for this.
Are the texts of the standard included?+
No, IEC standards are protected by copyright. Complass explains the requirements in its own words and refers to the numbers; you can store your own excerpts from your licensed edition.
Do I need a certificate?+
Not necessarily. Many manufacturers start with a self-declaration of the SL-C and support the process with their own evidence. A process or product certificate from an independent body strengthens customer trust; the module helps you collect the evidence for it.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
