IEC 62443 Roles

Asset Owner

The Asset Owner is the organisation that owns or operates the Industrial Automation and Control System.

This role has the overall accountability for cybersecurity and is ultimately responsible for ensuring the IACS remains secure throughout its operational life.

Typical responsibilities include:

• Defining cybersecurity objectives and policies.
• Performing cyber risk assessments.
• Determining the required Security Levels (SLs).
• Specifying security requirements for suppliers and integrators.
• Managing cybersecurity throughout the system lifecycle.
• Maintaining security patches, backups and recovery plans.
• Monitoring security events and responding to incidents.
• Ensuring personnel receive appropriate cybersecurity awareness training.

Although many security tasks may be delegated to contractors or service providers, accountability always remains with the Asset Owner.

Maintenance Service Provider

A Maintenance Service Provider performs operational support and maintenance activities on behalf of the Asset Owner.

This may include:

• Preventative maintenance.
• Corrective maintenance.
• Remote support.
• Software updates and patch deployment.
• Equipment replacement.
• Troubleshooting and diagnostics.

Because maintenance personnel often require privileged access to control systems, they represent both a valuable resource and a potential cybersecurity risk.

Security expectations typically include:

• Using secure remote access methods.
• Following change management procedures.
• Protecting passwords and privileged accounts.
• Using approved portable media and engineering workstations.
• Recording maintenance activities for auditing.
• Complying with the Asset Owner's cybersecurity policies.

Integration Service Provider

The Integration Service Provider designs, builds and commissions the Industrial Automation and Control System by combining products from multiple vendors into a complete operational solution.

Typical responsibilities include:

• System architecture design.
• Network segmentation and zoning.
• Installation of hardware and software.
• Configuration of controllers, servers and network devices.
• Security hardening.
• Factory Acceptance Testing (FAT).
• Site Acceptance Testing (SAT).
• Commissioning.
• Documentation and handover.

The integrator plays a critical role in implementing cybersecurity requirements defined by the Asset Owner and ensuring products are securely configured before entering service.

Product Supplier

The Product Supplier develops, manufactures and supports the products that make up the Industrial Automation and Control System.

Products may include:

• PLCs and controllers.
• HMIs and SCADA software.
• Industrial servers.
• Networking equipment.
• Safety systems.
• Engineering software.
• Embedded devices.

Supplier responsibilities generally include:

• Developing products using secure development practices.
• Identifying and managing vulnerabilities.
• Releasing firmware and software updates.
• Publishing security advisories.
• Providing secure default configurations.
• Supporting authentication, logging and encryption capabilities where appropriate.
• Maintaining products throughout their supported lifecycle.

A secure product provides the foundation upon which secure systems can be built.

Shared Responsibility

One of the key messages of IEC 62443 is that cybersecurity is a shared responsibility.

Each organisation has different responsibilities:

Strong cybersecurity depends on all four roles working together. Weaknesses in any one organisation can increase the risk to the entire Industrial Automation and Control System.