IACS Security Program

ISA/IEC 62443-2-1:2024 specifies the requirements for establishing, implementing, maintaining, and continually improving an Industrial Automation and Control System (IACS) Security Program (SP).

IEC62443 Security Program — Figure – The eight Security Program Elements (SPEs) that form the IACS Security Program.

Overview

ISA/IEC 62443-2-1:2024 provides a risk-based management framework that enables organizations to protect industrial control systems against evolving cybersecurity threats while supporting safe and reliable operations.

The standard applies primarily to Asset Owners and is designed to integrate with broader organizational Information Security Management Systems (ISMS), such as ISO/IEC 27001.

Relationship with ISO/IEC 27001

Although ISA/IEC 62443-2-1 and ISO/IEC 27001 both adopt a risk-based approach to cybersecurity, they focus on different environments.

ISA/IEC 62443-2-1	ISO/IEC 27001
Industrial Automation and Control Systems (OT)	Enterprise Information Technology (IT)
Industrial operations and process control	Information Security Management System (ISMS)
Safety, availability and operational resilience	Confidentiality, integrity and availability of information
Industrial-specific cybersecurity requirements	Organization-wide information security management

ISA/IEC 62443-2-1 complements ISO/IEC 27001 by extending information security principles into industrial control environments.

What's New in the 2024 Edition

The 2024 edition replaces the original 2010 publication and introduces several significant improvements:

Introduces Security Program Elements (SPEs) as the primary requirement structure.
Aligns more closely with Information Security Management Systems (ISMS).
Removes duplicated ISMS management requirements.
Introduces a cybersecurity maturity model.
Places greater emphasis on supply chain cybersecurity.
Supports continual improvement throughout the IACS lifecycle.

Security Management System vs Security Program

The standard distinguishes between two related concepts:

Security Management System (SMS)

A management framework that establishes:

Security policies
Security objectives
Governance
Risk management
Continual improvement

Typically aligned with ISO/IEC 27001.

IACS Security Program (SP)

The operational cybersecurity program for protecting industrial systems, including:

Policies
Procedures
Technical controls
Security services
Operational practices

The Security Program is normally implemented within the organization's broader Security Management System.

Security Program Elements (SPEs)

The Security Program is organised into eight Security Program Elements, each addressing a major area of industrial cybersecurity.

SPE	Focus Area
SPE 1	Organization Security Measures
SPE 2	Configuration Management
SPE 3	Network and Communication Security
SPE 4	Component Security
SPE 5	Protection of Data
SPE 6	User Access Control
SPE 7	Event and Incident Management
SPE 8	System Integrity and Availability

Together, these elements implement a defense-in-depth cybersecurity strategy across the entire IACS lifecycle.

SPE 1 – Organization Security Measures

Establishes the organizational foundation for cybersecurity.

Key topics include:

Information Security Management System (ISMS)
Background checks
Security roles and responsibilities
Security awareness training
Security responsibilities training
Supply chain security
Security assessments and reviews
Physical access control

SPE 2 – Configuration Management

Maintains accurate documentation and controlled system configurations.

Key topics include:

Asset inventory baseline
Infrastructure drawings
Configuration settings
Change control

SPE 3 – Network and Communication Security

Protects industrial communications and network infrastructure.

Key topics include:

System segmentation
Security zones and conduits
Secure wireless access
Remote access security
Network access control
Secure communications

SPE 4 – Component Security

Protects hardware, software and embedded devices from cyber threats.

Key topics include:

Component hardening
Portable media management
Malware protection
Patch management
Security patch validation
Security patch mitigation

SPE 5 – Protection of Data

Protects operational information against unauthorized disclosure and modification.

Key topics include:

Data classification
Data confidentiality
Data integrity
Cryptographic mechanisms
Key management
Data retention
Safety system reconfiguration controls

SPE 6 – User Access Control

Ensures only authorized users, devices and software processes can access IACS resources.

Key topics include:

Identification
Authentication
Authorization
Least privilege
Password management
Multi-Factor Authentication (MFA)
Privileged access management
Session management

SPE 7 – Event and Incident Management

Provides the capability to detect, record, investigate and respond to cybersecurity events.

Key topics include:

Event detection
Event reporting
Logging
Log management
Event analysis
Incident response
Vulnerability handling

SPE 8 – System Integrity and Availability

Maintains reliable operation of the IACS and supports system recovery following failures or cyber incidents.

Key topics include:

Continuity management
Resource availability
Fail-safe states
Backup
Backup verification
Backup restoration
Disaster recovery

Security Program Maturity Levels

ISA/IEC 62443-2-1 introduces a maturity model that enables organizations to measure how effectively their Security Program has been implemented.

Rather than simply determining whether a requirement exists, the maturity model evaluates the consistency, effectiveness and sustainability of cybersecurity practices.

Typical maturity progression includes:

Level	Description
Level 0	Not Performed
Level 1	Initial / Ad Hoc
Level 2	Managed
Level 3	Defined
Level 4	Quantitatively Managed
Level 5	Optimizing / Continual Improvement

Higher maturity levels demonstrate increasingly consistent implementation, measurement and continuous improvement.

Conformance and Assessment

Conformance assessments determine whether an organization's Security Program satisfies the requirements of ISA/IEC 62443-2-1.

Assessments typically review:

Policies and procedures
Organizational governance
Technical controls
Risk management processes
Security documentation
Training records
Audit evidence
Security testing results

Objective evidence is used to demonstrate that requirements have been implemented and are operating effectively.

Typical evidence includes:

Configuration records
Asset inventories
Network diagrams
Security assessments
Test reports
Policies and procedures
Training records
Audit logs
User documentation

Assessment results identify areas requiring improvement and support continual enhancement of the Security Program.

Key Takeaways

ISA/IEC 62443-2-1:2024 defines the requirements for establishing and maintaining an Industrial Automation and Control System Security Program.
The standard integrates with ISO/IEC 27001 while providing industrial-specific cybersecurity guidance.
The 2024 edition introduces Security Program Elements (SPEs) and a formal maturity model.
Eight Security Program Elements provide comprehensive coverage of organizational, technical and operational cybersecurity.
Organizations demonstrate compliance through documented processes, objective evidence and continual improvement.
The ultimate objective is to reduce cybersecurity risk to a tolerable level while supporting the safe, secure and reliable operation of industrial automation systems.

Standards Reference

Primary Standard

ISA/IEC 62443-2-1:2024 – Security for Industrial Automation and Control Systems – Part 2-1: Requirements for an IACS Security Program.

Related Standards

ISO/IEC 27001 – Information Security Management Systems (ISMS)
ISO/IEC 27002 – Information Security Controls
ISA/IEC 62443 Series – Industrial Automation and Control System Cybersecurity Standards

AEBOK Standards Reference: Refer to ISA/IEC 62443-2-1:2024 for the Security Program Elements, maturity model, and conformance assessment requirements that underpin the IACS Security Program.