OT
OPC UA security: modes, certificates and trust lists
Do not leave an OPC UA connection at “it works”. Treat security mode, certificate trust and user authentication as separate decisions.
What is IEC 62443 and what is it used for?
Short answer
IEC 62443 is a series of standards for the cybersecurity of industrial automation and control systems (IACS). It defines roles for the asset owner, the system integrator and the product supplier. It splits a system into zones and conduits and sets a target security level, from SL 1 to SL 4, for each zone.
How the standard is organised
IEC 62443 treats control-system security as a lifecycle with shared responsibilities, not as a single product feature or a checklist. Three roles are named: the asset owner, who runs the plant; the system integrator, who builds the system; and the product supplier, who makes the components.
Two core concepts organise the design. A zone is a group of assets that share the same security requirements. A conduit is the communication path between zones, and it is protected in its own right. Each zone is assigned a target security level from SL 1 to SL 4; a higher level means stronger controls.
The standard also defines seven foundational requirements, such as identification and authentication control. Its parts cover general concepts, policies and procedures, the system and the component.
Worked example: splitting a filling line
Hypothetical filling line. The line zone holds 6 devices: 2 PLCs, 1 drive, 2 remote I/O stations and 1 local HMI. The SCADA zone holds 3 servers. One conduit joins the two zones and allows two rules: OPC UA connections from the SCADA server to the PLCs (default port 4840), and the replies to them. All other traffic is denied.
Total assets are 6 + 3 = 9 across two zones, and one conduit carries two allowed rules. The target security level for each zone comes from a risk assessment. This example does not assign one, because the right level depends on the process and on the consequences of a failure.
Common mistakes
The first mistake is saying 'IEC 62443 compliant' without a scope. A claim should name the assets, zones and security levels it covers. A product certificate does not prove that a whole plant is compliant.
The second mistake is drawing zones from the network diagram rather than from function and risk. Devices with different functions and risks can share one VLAN. Also keep the target level (SL-T) separate from the level actually achieved (SL-A).
The third mistake is assuming SL 4 everywhere. It is not a default. Cost and operational impact should be weighed against the risk of each zone.
Follow-up questions
Is IEC 62443 certification mandatory?
The standard itself does not require certification. An obligation usually comes from a contract, a regulator or a customer requirement. Certification can verify a claim, but its scope must be clear, so define which assets and processes are covered first.
Where should I start reading?
Most plants should begin with the general concepts and the policy and procedure parts. Next, build an asset inventory and a zone and conduit diagram. The system and component requirements are most useful when selecting suppliers.
Sources
Example numbers are hypothetical, not measured field results.
Read the full guide.
Full library
OT
Define the access boundary of an OT AI pilot
A starting architecture that separates reading, recommendations and control authority.