How does a CISO decide which IEC 62443 parts the company needs?
IEC 62443 is a series of standards, and asset owners, system integrators and service providers, and product manufacturers need different combinations; the wrong combination is wasted effort:
| Part | What it covers |
|---|---|
| 2-1 | The asset owner's security programme |
| 2-4 | Service providers |
| 3-3 | System security requirements and security levels |
| 4-1 | The product secure development process |
| 4-2 | Technical requirements for components |
The CISO first confirms whether the company acts as an equipment manufacturer, system integrator, service provider or asset owner, then identifies the minimum set of parts needed for its goals.
Once we hold IEC 62443 certification, do our EU exports comply with the CRA?
No. The CRA does not require IEC 62443 certification, and certification is not a presumption of CRA conformity; that comes only from harmonised standards published in the Official Journal, common specifications, or European cybersecurity certification schemes adopted under the EU Cybersecurity Act (CRA Article 27).
In industry, energy and manufacturing, IEC 62443 can serve as a reference for implementing and gap-checking CRA Annex I requirements. For EU exports, first confirm the product's CRA category: ordinary products may use internal control (Module A); important Class I products not fully applying harmonised standards, Class II and critical products need a third-party procedure. The CRA has no standalone certificate; products complete conformity assessment and bear the CE mark.
How is the target security level (SL) set, and how does the CISO explain it to management?
IEC 62443-3-3 distinguishes security levels by the attacker's means, resources, skills and motivation: SL 1 protects against casual or coincidental violation; SL 4 protects against intentional attacks using sophisticated means, extensive resources, IACS-specific skills and high motivation.
The first practical question is whether the target SL comes from the customer's specification or from a risk assessment. Under 3-2, define zones and conduits, assess risk and set target security levels; then assess the system's capability levels under 3-3. Presenting the SL basis together with the risk assessment gives management a sound basis for approving the investment.
How long does IEC 62443 take, and how should budget and timing fit the annual plan?
Timelines listed on the service page (from Winners' consulting experience, not set by the standard or certification bodies):
| Item | Timeline |
|---|---|
| 4-1 SDL organisational certification | Usually 6–9 months |
| 4-2 product certification | 4–8 months (excluding 4-1) |
| 2-1 management system | 4–6 months |
| 2-4 service provider certification | 3–5 months |
Sequence affects the total: before 4-2 product certification, the organisation must complete 4-1 certification. When budgeting, ask which deliverables a quote includes, whether a pre-certification review is included, and whether certification fees are separate.
System integrators and equipment vendors maintain our factory OT remotely. How should the CISO manage these suppliers?
IEC 62443-2-4 is the part for service providers and can serve as the basis for security requirements on integration and maintenance providers; equipment vendors can be asked whether their products are developed under the 4-1 secure development process.
Listed companies must regularly audit internal and outsourced vendors' security under Article 38 of the TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies; ESG evaluation indicator S-15 asks whether the company discloses a supplier management policy requiring suppliers to follow rules on cybersecurity or privacy. In practice, write the requirements into supplier evaluation items and contract clauses and fold them into the annual evaluation cycle. Companies that are not public companies are not covered by these rules and can use them voluntarily.
Malware stops a factory line through OT. How does the CISO connect response and reporting?
- Own procedure: listed companies set response and reporting procedures under Article 34 of the Control Guidelines; OT line-stoppage scenarios belong in that same procedure.
- Business continuity: BCM covers an equipment network isolation SOP (OT separated from IT), recovery priorities and a customer communication SOP, exercised by combining ISO 22301 and IEC 62443.
- EU law: an entity covered by NIS2 must give an early warning within 24 hours, notification within 72 hours and a final report within one month for significant incidents; if your own product's vulnerability is actively exploited, CRA Article 14 reporting also applies.
- Critical infrastructure: the related Cyber Security Management Act duties apply only after designation by the competent authority and approval by the Executive Yuan.
Companies that are not public companies are not covered by the Control Guidelines and can use them voluntarily.
How does Winners Consulting help a CISO with IEC 62443?
Winners Consulting's approach (test us with the questions above too):
- VP- and director-level consultants lead in person; nothing is outsourced
- We diagnose the minimum set of parts for your role; the applicability diagnosis is free
- Before 4-2, we build the 4-1 security requirements, architecture, code review, security testing and vulnerability management processes
- We do not treat IEC 62443 certification as CRA presumption of conformity; Winners consults and does not certify, handling pre-certification review and coordination
IEC 62443 consulting, Choosing an IEC 62443 consultant, EU CRA compliance consulting. Apply for a free mechanism diagnosis
How other roles see this service
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing DORA: serving EU financial clients, what to prepare for contracts, reporting and testing
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO implementing ISO/IEC 29147: reporting channel, CVD policy and CRA reporting
- CISO guide to ISO/IEC 30111: linking vulnerability handling to CRA reporting
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO/SAE 21434: product security beyond TISAX
- CISO guide to ISO 22301: ICT recovery, RTO and exercises
- CISO guide to ISO 42001: what AI governance shares with ISO 27001
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up