IACS Cybersecurity Lifecycle

The IACS Cybersecurity Lifecycle is a continuous process defined within the ISA/IEC 62443 series to ensure cybersecurity is effectively managed throughout the entire life of an Industrial Automation and Control System (IACS).

Introduction

Industrial control systems often remain in service for 20 years or more. During this time, cyber threats evolve, vulnerabilities are discovered, technology changes, and operational requirements continually develop. As a result, cybersecurity cannot be treated as a one-time engineering project—it must be continuously assessed, maintained, and improved.

The lifecycle provides a repeatable framework for identifying cyber risks, implementing appropriate security measures, maintaining the required level of protection, and continuously adapting to new threats. By following this lifecycle, organisations can improve the resilience, reliability, availability, and safety of their industrial operations while reducing cybersecurity risk.

Why a Cybersecurity Lifecycle?

Cybersecurity is never "complete." Every change to an industrial control system—whether installing new equipment, applying software updates, modifying network architecture, or changing operational procedures—can introduce new cybersecurity risks.

A structured lifecycle enables organisations to:

Continuously identify and manage cybersecurity risks.
Maintain compliance with ISA/IEC 62443.
Ensure security controls remain effective over time.
Support safe and reliable industrial operations.
Adapt to evolving cyber threats and vulnerabilities.
Integrate cybersecurity into normal engineering and maintenance activities.

The lifecycle follows a process of continual improvement rather than a fixed sequence of activities.

The Three Continuous Lifecycle Stages

1. Assess

The first stage evaluates the current cybersecurity posture of the system and determines what level of protection is required.

During the assessment phase organisations:

Identify the System Under Consideration (SUC).
Identify critical assets.
Identify cyber threats and vulnerabilities.
Evaluate existing technical and organisational controls.
Partition the system into Zones and Conduits.
Perform cybersecurity risk assessments.
Assign a Target Security Level (SL-T) for each zone.
Identify areas requiring improvement.

The assessment stage establishes the baseline for all future cybersecurity activities and produces the Cybersecurity Requirements Specification that guides implementation.

2. Develop & Implement

Once cybersecurity requirements have been identified, appropriate security measures are designed and implemented.

Activities typically include:

Designing secure system architecture.
Applying Defence in Depth.
Implementing technical security controls.
Configuring authentication and authorisation.
Applying network segmentation.
Installing current security updates.
Developing organisational security procedures.
Configuring monitoring and logging.
Validating security configurations.

The objective is to ensure each security zone achieves the Target Security Level established during the risk assessment.

Security controls should always remain aligned with evolving threats, operational requirements, and organisational policies.

3. Maintain

Cybersecurity must continue throughout the operational life of the system.

Maintenance activities include:

Continuous monitoring of threats and vulnerabilities.
Patch and firmware management.
Backup verification.
User and account reviews.
Security log monitoring.
Periodic cybersecurity risk reassessment.
Security testing and vulnerability assessments.
Management of Change (MoC).
Incident response and recovery.
Continuous improvement of security controls.

Maintenance ensures that security remains effective despite changes to technology, personnel, or the threat landscape.

Continuous Improvement

The IACS Cybersecurity Lifecycle is not a linear process—it is a continuous cycle.

After maintenance activities are completed, organisations reassess their cybersecurity posture and begin the assessment process again.

This continual improvement model allows organisations to:

Respond to newly discovered vulnerabilities.
Address emerging cyber threats.
Improve security controls.
Incorporate operational changes safely.
Maintain compliance with organisational policies and industry standards.

Continuous improvement is one of the fundamental principles of ISA/IEC 62443 and ensures cybersecurity remains effective throughout the entire operational life of the IACS.

Security Level Objective

One of the primary objectives of the lifecycle is maintaining the required level of security for every security zone.

Every zone is assigned a Target Security Level (SL-T) during the risk assessment process.

Following implementation and ongoing maintenance, the organisation measures the Security Level Achieved (SL-A).

The fundamental objective is:

Security Level Achieved (SL-A) ≥ Target Security Level (SL-T)

If the achieved security level falls below the target, additional technical or organisational security measures must be implemented until the required level of protection is restored.

Relationship with Risk Assessment

Risk assessment drives the entire cybersecurity lifecycle.

The process begins by identifying:

Threats
Vulnerabilities
Consequences
Existing security controls

These factors determine the acceptable level of risk and establish the Target Security Level required for each security zone.

As the system evolves, risk assessments are periodically repeated to ensure security controls remain appropriate.

Without regular risk assessments, security measures quickly become outdated and ineffective.

Key Principles

The IACS Cybersecurity Lifecycle is built upon several fundamental principles:

Cybersecurity is a continuous process, not a one-time activity.
Risk assessment drives all cybersecurity decisions.
Security controls must evolve as threats evolve.
Technical, organisational, and physical controls work together.
Defence in Depth provides multiple layers of protection.
Management of Change ensures modifications do not introduce unacceptable risk.
Continuous monitoring supports early detection and rapid response.
Cybersecurity supports safe, reliable, and resilient industrial operations.
Cybersecurity is a shared responsibility between all stakeholders.
The Asset Owner remains accountable for managing cybersecurity risk throughout the lifecycle.

Relationship to the Automation Solution Security Lifecycle

The IACS Cybersecurity Lifecycle provides the high-level framework for continuously managing cybersecurity throughout the life of an industrial control system.

The Automation Solution Security Lifecycle expands this concept into a structured engineering methodology consisting of eight phases:

Specification
Design
Implementation
Verification
Validation
Operations
Maintenance
Decommissioning

Together, these lifecycles ensure cybersecurity is considered from the earliest stages of system design through to final retirement.

Key Takeaways

Cybersecurity is a lifecycle, not a project.
Industrial control systems require continuous assessment, implementation, and maintenance of security controls.
Risk assessments determine the Target Security Level (SL-T) for each security zone.
Security Level Achieved (SL-A) should always be greater than or equal to the Target Security Level.
Continuous monitoring, Management of Change, and periodic reassessment are essential to maintaining an effective cybersecurity posture.
The lifecycle supports safer, more reliable, and more resilient industrial operations.

Standards Reference

Primary Standards

ISA/IEC 62443-2-1 – Establishing an IACS Security Program
ISA/IEC 62443-2-2 – Automation Solution Security Lifecycle (draft/evolving)
ISA/IEC 62443-2-3 – Patch Management in the IACS Environment
ISA/IEC 62443-2-4 – Security Program Requirements for IACS Service Providers
ISA/IEC 62443-3-2 – Security Risk Assessment for System Design
ISA/IEC 62443-3-3 – System Security Requirements and Security Levels

AEBOK Standards Reference: Refer to ISA/IEC 62443 Part 2-1, Part 2-2, Part 2-3, Part 2-4, Part 3-2 and Part 3-3 for the lifecycle processes, risk assessment methodology, service provider responsibilities, and security level concepts that underpin the IACS Cybersecurity Lifecycle.