Which part of IEC 62443 applies to our industrial product?
IEC 62443 is a series, and the applicable combination depends on your role:
| Part | What it covers |
|---|---|
| 4-1 | The product's secure development process |
| 4-2 | Technical requirements for components |
| 3-3 | System security requirements and security levels |
| 2-1 | The asset owner's security programme |
| 2-4 | Service providers |
Asset owners, system integrators and service providers, and product manufacturers need different combinations, and the wrong combination is wasted effort. The product manager should first confirm whether the customer wants a component product certification, a system security level, or proof of the supplier's development process.
How long does 4-2 product certification take, and how do we fit it into the launch schedule?
Timeline as listed on the service page (Winners Consulting's experience, not a rule of the standard or certification bodies):
| Item | Timeline |
|---|---|
| 4-1 SDL organisational certification | Usually 6–9 months |
| 4-2 product certification | 4–8 months (excluding 4-1) |
| 2-1 management system | 4–6 months |
| 2-4 service provider certification | 3–5 months |
Sequence matters: before 4-2 product certification, the organisation must complete 4-1 SDL certification. If 4-1 is not yet in place, the product manager has to count both stages in the launch milestones.
With IEC 62443 certification, can our industrial product enter the EU?
Not by itself. The EU CRA does not require IEC 62443 certification, and certification is not a presumption of CRA conformity; that comes only from harmonised standards published in the Official Journal, common specifications or designated certification schemes (CRA Article 27). In industrial, energy and manufacturing fields, IEC 62443 can serve as a reference for implementing CRA Annex I and for gap analysis.
The product still follows the assessment route for its CRA class. For industrial products, for example:
- Default: PLCs, HMIs, industrial controllers
- Important, class I: industrial switches with a management plane, industrial routers
- Important, class II: industrial firewalls, intrusion detection or prevention systems
How do we set the security level (SL) in the product specification?
IEC 62443-3-3 distinguishes security levels by the attacker's means, resources, skills and motivation: SL 1 protects against casual or coincidental violation, SL 4 against intentional attacks using sophisticated means, extensive resources, IACS-specific skills and high motivation.
The target security level is set by customer specification or by risk assessment. The approach is to define zones and conduits under 3-2, assess risk and set the target security level, then assess the system's security capability level under 3-3. The product manager should keep the SL in the specification aligned with customer needs and avoid over-investing in levels nobody requires.
Which development gates does the 4-1 secure development process change?
4-1 requires security requirements, security architecture, code review, security testing and a vulnerability management process. The SDL work listed on the service page includes threat modelling, SAST/DAST testing, penetration testing and building an SBOM. Mapped to existing gates:
- Project approval and design review: security requirements, security architecture, threat modelling
- Development and test: code review, SAST/DAST, penetration testing
- Launch and maintenance: SBOM and vulnerability management
For products exported to the EU, these outputs can also serve as a reference for implementing CRA Annex I.
A customer wants to see our certificate. Who issues it, and what can a consultant do?
Depending on the target certification level, you can arrange a conformity self-assessment, or commission a certification body for third-party certification with a technical documentation package. The certification body performs certification testing and issues certificates but does not help build the system; under ISO/IEC 17065 clause 4.2.6, a certification body, the same legal entity and units under its organisational control shall not provide consultancy to its clients.
So the consultant builds the system and runs the pre-certification review; the certification body the company chooses issues the certificate. When the secure development process and documents are already mature and only third-party certification is missing, go straight to a certification body.
How does Winners Consulting help product managers with IEC 62443?
Winners Consulting diagnoses the minimum necessary combination of parts for the company's role and goals, avoiding certifications you do not need; the applicability diagnosis is free. Then:
- Before 4-2 product certification, build security requirements, security architecture, code review, security testing and vulnerability management under 4-1
- Prepare the technical documentation, run the pre-certification review and coordinate with the certification body
- Confirm the conformity assessment procedure the product needs under the CRA
Winners Consulting is a consultant and does not issue certificates; VP- and director-level consultants lead the work end to end, never outsourced. Read more: IEC 62443 consulting, Choosing an IEC 62443 consultant, CRA product classes. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- EU CRA for product managers: is my product in scope, and what must be ready before launch?
- EU AI Act for product managers: what must the AI in our product complete before launch?
- ISO/IEC 29147 and 30111 for product managers: what can we promise on vulnerability disclosure and fixes?
- ISO/SAE 21434 for product managers: how does an automotive product pass carmaker development audits?
- ISO 42001 for product managers: how do we answer customer demands on AI product governance?
- TISAX prototype protection for product managers: will a missing label block a carmaker project?
- ISO 27701 and GDPR for product managers: which privacy work comes first when selling into each market?