The security programme for integrators, machine and plant builders with service and OT service providers, from the scope of services and system design to handover to the asset owner.
Compliance management in 20 secondsProject, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.
What is IEC 62443 integrator?
IEC 62443-2-4 is the part of the IEC 62443 series that describes requirements for the security programme of service providers who build or maintain industrial Automation Solutions. Each of the 123 requirements in twelve functional areas is assigned one of four maturity levels; the system requirements in the design come from IEC 62443-3-3.
Content as of:
Does it apply to me?
IEC 62443-2-4 is a standard, not a legal obligation. Asset owners increasingly require it in tenders and contracts, partly because NIS2 obliges them to address the security of their supply chain and their service providers.
The module is aimed at system integrators, machine and plant builders with commissioning and service, remote maintenance and OT service providers, and in-house automation departments.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
IEC 62443-2-4Security programme requirements for integration and maintenance service providers
IEC 62443-3-3System security requirements and security levels in the design
IEC 62443-3-2Security risk assessment, zones and conduits
Key dates
There are no statutory deadlines for IEC 62443-2-4. Schedules result from projects, maintenance contracts and your customers’ requirements; you maintain dates in the project plan.
How Complass helps
Nine phases for service providers
Role and scope of services, security programme and maturity levels, staff, system design, hardening and remote access, patch, malware and backup services, incident reporting, FAT/SAT and handover, audit.
Shared zone model with the asset owner
Zones, conduits and SL-T on the shared asset inventory, inventory register for patch and vulnerability management.
Catalogue IEC 62443-2-4
All 123 requirements of the functional areas SP.01 to SP.12 with base requirement, enhancements, status and evidence, each with an implementation guide from the service provider’s point of view.
Templates for service providers
Including security statement of work, security architecture document, remote access concept, patch approval process, incident reporting process, FAT/SAT test plan and handover documentation.
The phases in the module
Role and scope of services
Security programme of the service provider and maturity levels
Staff, qualification and confidentiality
Architecture and system design
Hardening, accounts and access, remote access
Patch, malware and backup management as a service
Event and incident management, reports to the asset owner
FAT/SAT, handover and documentation to the asset owner
Good to know: You can also meet the requirements without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information
Frequently asked questions
Do I also need the asset owner module as an integrator?+
Both modules belong to the IEC 62443 framework and use the same zone model. You carry out the gap analysis against the individual system requirements from 3-3 in the asset owner module, ideally together with your customer.
Are the texts of the standard included?+
No, IEC standards are protected by copyright. Complass explains the requirements in its own words and refers to the requirement number; you can store your own excerpts.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
