Direct answer: the first question to ask an IEC 62443 consultant is "given my role, which parts should I do?" IEC 62443 is a series of standards, and asset owners, system integrators and service providers, and product manufacturers need different combinations: 2-1 covers the asset owner's security program, 2-4 covers service providers, 3-3 covers system security requirements and security levels, 4-1 covers the product's secure development lifecycle, and 4-2 covers technical requirements for components. Pick the wrong combination and the work is wasted. Next, make sure the consultant does not present IEC 62443 certification as equivalent to complying with the EU CRA: under the CRA, presumption of conformity comes only from harmonised standards whose references are published in the Official Journal of the EU, common specifications, or European cybersecurity certification schemes adopted under the Cybersecurity Act, Regulation (EU) 2019/881 (CRA Article 27).
Three kinds of IEC 62443 helper on the market
| Role | What they mainly do | Best suited to |
|---|---|---|
| Certification and testing bodies | Testing of products and processes, third-party certification and issuing certificates | Certification once the system and the product are ready |
| Security tool and testing providers | OT asset inventory, vulnerability scanning, penetration testing | Producing technical evidence |
| Management consultants | Determining the combination of parts, building the secure development lifecycle and the management system, technical documentation and pre-certification review | End-to-end planning from determination to a system that can pass certification |
The three roles differ and most companies combine them. When choosing a consultant, confirm they know where they sit among the three.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Parts determined by role | Am I an asset owner, a system integrator or service provider, or a product manufacturer? Which of 2-1, 2-4, 3-3, 4-1 and 4-2 do I need? |
| Order of 4-1 and 4-2 | If I want 4-2 component certification, is my 4-1 secure development lifecycle already in place? |
| Setting security levels | Is the target security level (SL) set by customer specifications or by risk assessment? |
| Zoning and risk assessment | How are zones and conduits partitioned? How is the risk assessment done (IEC 62443-3-2)? |
| Clarity on the CRA | Can IEC 62443 certification serve as presumption of conformity under the CRA? Which CRA category does my product fall into? |
| Division of work with the certification body | Which body will issue the certificate? Are the consultant and the certification body the same legal entity, or one under its control? (Under ISO/IEC 17065 clause 4.2.6, a certification body, its legal entity and entities under its organisational control must not provide consultancy to its clients.) |
| Who leads, and is it outsourced | Who actually runs the engagement? What are their qualifications? Will it be subcontracted? |
| Clarity of the quote | Which deliverables are included, and is a pre-certification review included? Are certification fees charged separately? |
When you may not need a consultant
If your secure development process and documentation are already mature and only third-party certification is missing, go directly to a certification body. If you only need a vulnerability scan or a penetration test report, a testing provider may be more direct. If the product is exported to the EU, first confirm its CRA category and conformity assessment procedure, then decide how far to take IEC 62443.
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Parts determined by role: we diagnose the minimum necessary combination of parts from your role (equipment manufacturer, system integrator, service provider or asset owner) and your goals
- Order of 4-1 and 4-2: before 4-2 product certification, we first build the 4-1 processes for security requirements, security architecture, code review, security testing and vulnerability management
- Security levels and zoning: zones and conduits are partitioned, risk is assessed and target security levels are set under 3-2; system security capability levels are assessed under 3-3; the management system is built under 2-1 or 2-4
- Clarity on the CRA: we do not treat IEC 62443 certification as presumption of conformity under the CRA, and we confirm which conformity assessment procedure the product must follow under the CRA
- Division of work with the certification body: Winners is a consultant and does not issue certificates; certification is performed by the certification body you choose, and Winners handles the pre-certification review and coordination
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced
Related questions
- How does IEC 62443 relate to the CRA? The CRA does not require IEC 62443 certification, and certification does not give presumption of conformity with the CRA; in industrial, energy and manufacturing settings, IEC 62443 can serve as a reference for implementing the CRA's Annex I requirements and for gap analysis. How to choose a CRA consultant in Taiwan
- How long does IEC 62443 certification take? In Winners' consulting experience (these are not requirements of the standard or of certification bodies), a 4-1 secure development lifecycle usually takes six to nine months; 4-2 product certification four to eight months (excluding the time to build 4-1); a 2-1 management system four to six months; 2-4 for service providers three to five months. IEC 62443 industrial cybersecurity consulting
- What is the difference between SL 1 and SL 4? IEC 62443-3-3 distinguishes security levels by the attacker's means, resources, skills and motivation: SL 1 protects against casual or coincidental violation, and SL 4 against intentional violation using sophisticated means with extended resources, IACS-specific skills and high motivation. IEC 62443 industrial cybersecurity consulting
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.