IEC 62443 and OT Security: Zones, Conduits, and Best Practices

Why OT security needs its own standard

IT security assumes you can patch, reboot, and replace systems regularly. Operational technology cannot: control systems must run continuously, legacy devices cannot be patched, and an interruption for maintenance can cost more than the attack it prevents. IEC 62443 (International Electrotechnical Commission standard 62443) was written specifically for industrial automation and control systems (IACS), and it has become the reference framework for OT security.

The zone and conduit model

The core architectural idea of IEC 62443 is segmentation:

• A zone is a group of assets with common security requirements — for example, "Level 1 control network" or "safety system."
• A conduit is a controlled communication path between zones — typically a firewall or a one-way gateway enforcing a strict allow-list of traffic.

Instead of "the plant network" as one flat space, you design several zones and decide, explicitly, which communication between them is permitted. This directly contradicts the common legacy setup where a PLC network and the office LAN share a flat subnet.

Security levels and requirements

IEC 62443 defines security levels (SL) from SL 0 (no special protection) to SL 4 (protection against intentional, sophisticated attacks). Each level raises the bar for authentication, authorization, integrity, and confidentiality requirements on the assets in a zone.

The standard is organized into parts covering the whole lifecycle: the foundational parts (62443-1) define concepts; system security requirements (62443-3-3) cover the technical controls for the system; and process requirements (62443-2-1) cover an organization's security management system for IACS.

Practical starting points

You do not need to implement the entire standard at once. The pragmatic first moves are:

1. Inventory: know every device on the control network, its firmware, and its open ports.
2. Segment: create at least three zones — control, process/plant, and IT — and route all inter-zone traffic through a conduit.
3. Allow-list: block everything except explicitly required protocols (for example, OPC UA on a specific port from specific IPs).
4. Harden endpoints: disable unused services, change default credentials, and remove direct internet exposure.
5. Monitor: collect and review logs from conduits and controllers; alert on unexpected connections.
6. Plan recovery: tested backups and a documented restore path for each controller type.