IEC 62443-4-1 for CTOs: what changes in secure development and how long?

Which IEC 62443 sub-standards does a CTO need to decide on first?

IEC 62443 is a series of standards, and asset owners, system integrators and service providers, and product manufacturers each need a different combination; the wrong combination is wasted work:

The CTO first answers: is the company an asset owner, a system integrator and service provider, or a product manufacturer? Then decide the minimum necessary combination of sub-standards for that role and the customer's goals, avoiding certifications you do not need.

What activities does the 4-1 secure development lifecycle add to the development process?

To obtain 4-2 product certification, first establish five processes under 4-1: security requirements, security architecture, code review, security testing and vulnerability management. Winners Consulting's EU CRA engagement process likewise implements the eight IEC 62443-4-1 secure development lifecycle practices, including threat modelling, SAST/DAST testing, penetration testing and SBOM construction.

The principle for fitting into existing processes: put the 62443-4-1 secure development activities into the existing design review and test gates, and keep R&D records and documents under the existing keeping rules rather than building a second system. A Taiwanese public company's internal control already covers the R&D cycle (Article 7, item 8 of the internal control regulations); companies that are not public companies are not covered by those regulations and can use them voluntarily.

How long does product certification take, and how do 4-1 and 4-2 fit into the launch schedule?

4-1 first, then 4-2: the organisation must complete 4-1 SDL certification before obtaining 4-2 product certification. Timeline as listed on the service page (Winners Consulting's engagement experience, not a requirement of the standard or of certification bodies):

When planning a product launch, count the 4-2 months after 4-1, not in parallel with it.

On what basis does R&D set the target security level (SL) and system zoning?

First confirm the basis for the target security level: the customer's specification or a risk assessment. IEC 62443-3-3 distinguishes security levels by the attacker's means, resources, skills and motivation:

• SL 1: protection against casual or coincidental violation.
• SL 4: protection against intentional attack using sophisticated means, extensive resources, IACS-specific skills and high motivation.

At system level, zones and conduits are defined under 3-2, a risk assessment is carried out and target security levels set, and the system's security capability level is then assessed under 3-3; asset owners or service providers establish their management system under 2-1 or 2-4. The CTO should make sure design documents state where the target level came from, so it can be explained at certification.

A customer wants IEC 62443 certification: how does that relate to the EU CRA?

The CRA does not require IEC 62443 certification, and certification is not a presumption of CRA conformity. Under Article 27 of the CRA, presumption of conformity comes only from harmonised standards published in the Official Journal, common specifications, or European cybersecurity certification schemes adopted under the Cybersecurity Act ((EU) 2019/881).

In industry, energy and manufacturing, IEC 62443 can serve as a reference for implementing the CRA Annex I requirements and for gap analysis. So the CTO plans two tracks: the 62443 certification the customer wants, and the conformity assessment procedure the product must follow under the CRA (including which CRA class the product falls into).

What does R&D prepare before certification, and how do the certification body and the consultant divide the work?

Depending on the target certification level, you either carry out a conformity self-assessment or commission a certification body for third-party certification, and prepare a technical documentation package.

• Certification body: runs the certification tests and issues certificates, but does not provide system-building consulting. Under ISO/IEC 17065 clause 4.2.6, a certification body, the same legal entity and units under its organisational control may not provide consultancy to its clients.
• Consultant: diagnoses the sub-standard combination, builds the SDL process, management system and technical documentation to the standard, runs a pre-certification review and coordinates with the certification body.

When choosing a certification body, the CTO should confirm that it and the consultant are not the same legal entity or a unit under its control.

How does Winners Consulting help a CTO with IEC 62443?

Vice-president and director-level consultants personally lead the work end to end, never outsourced. The five steps listed on the service page:

1. Role positioning and sub-standard applicability diagnosis, to find the minimum necessary combination.
2. Building 4-1 SDL secure development capability (an organisational prerequisite).
3. Establishing a 2-1/2-4 security management system.
4. Assessing and implementing 3-3/4-2 technical requirements.
5. Conformity assessment and third-party certification: preparing the technical documentation package, the pre-certification review and coordination with the certification body, and confirming the conformity assessment procedure the product must follow under the CRA.

Winners Consulting is a consultant and does not issue certificates, and does not treat IEC 62443 certification as a presumption of CRA conformity.

Go deeper: IEC 62443 industrial cybersecurity consulting, Choosing an IEC 62443 consultant, What a CTO builds into the R&D process, EU CRA compliance. Request a free mechanism diagnosis