IEC 62443: A Practical Guide for French Manufacturers in 2026

· 11 min read
11 min read
Eziwan Team
Eziwan Team
IoT Infrastructure

The IEC 62443 standard has become the international benchmark for cybersecurity in industrial control systems (ICS/SCADA/OT). With the entry into force of the NIS2 Directive in France, it is now explicitly cited as the technical standard applicable to critical and important entities.

However, the standard is considered complex and extensive. This practical guide distills the essentials for French manufacturers: what the standard actually requires, how to comply with it, and the priorities for 2026.

What is IEC 62443?​

IEC 62443 (formerly ISA-99) is a family of standards developed by the ISA (International Society of Automation) and published by the IEC. It covers the cybersecurity of industrial automation and control systems (IACS).

The Structure of the Standard​

The standard is organized into four series:

SeriesTitleTarget Audience
62443-1.xGeneral (concepts, models, terminology)All
62443-2.xPolicies & ProceduresIndustrial operators, CISOs
62443-3.xSystem (architecture, security levels)Architects, integrators
62443-4.xComponents (product security)Equipment manufacturers

For a French manufacturer seeking to comply with NIS2, the most relevant sections are:

  • IEC 62443-2-1: security policies and procedures
  • IEC 62443-3-3: system security requirements
  • IEC 62443-4-2: component requirements (for evaluating your equipment)

Security Levels (SL): Understanding Security Levels​

The central concept of IEC 62443 is the Security Level—the level of protection required based on the system's criticality.

The 4 Levels​

Security LevelDescriptionAgainst what threat?
SL 0No specific protection— (offline systems)
SL 1Protection against accidental attacksHuman error, non-targeted malicious acts
SL 2Protection against deliberate attacks using limited resourcesHacktivists, opportunists
SL 3Protection against attacks using sophisticated methodsOrganized criminal groups
SL 4Protection against state-sponsored attacksState-sponsored APTs

For the vast majority of French manufacturers: Level SL 2 is the appropriate target. SL 3 is reserved for operators of vital importance (OIV) with highly critical systems. SL 4 is almost exclusively for military and nuclear infrastructure.

How do you determine the required SL for your system?​

The process consists of three steps:

1. Identify Zones and Conduits (IEC 62443-3-2)

Start by mapping your OT systems into security zones:

  • Production zone (PLCs, sensors, local HMIs)
  • Monitoring zone (SCADA, historian servers)
  • OT DMZ (IT/OT interface)
  • Remote access zone

Next, identify the pipes (Conduits)—the communication paths between zones (remote access VPNs, SCADA links, IT/OT gateways).

2. Assess the criticality of each zone (CASC)

For each area, assess the consequences of a compromise based on the CASC criteria:

  • Confidentiality: Does the data need to remain confidential?
  • Integrity: Could a change to the data or commands cause damage?
  • Davailability: Would a system outage cause significant harm?
  • Safety: Could a malfunction endanger lives?

3. Define the target SL by zone

The assessed criticality determines the target safety level (SL): an area with safety-related logic controllers (SIL) in a SEVESO facility will aim for SL 3, while a control room at a drinking water pumping station generally aims for SL 2.

The 7 Foundational Requirements of IEC 62443-3-3​

The IEC 62443-3-3 standard defines 7 fundamental requirements (FR) for systems. Each FR is broken down into detailed requirements based on the SL level.

FR 1 — Identification and Authentication Checks​

What this means in practice:

  • Each user and device must be uniquely identified (no shared accounts)
  • Default passwords on OT devices must be changed
  • For SL 2: two-factor authentication (MFA) for remote access

Eziwan App: Each technician has an individual OpenVPN/IPSec VPN key. MFA authentication is available on the cloud platform.

FR 2 — Usage Monitoring​

What this means:

  • Each user has access only to the resources necessary for their role (principle of least privilege)
  • Actions on critical equipment require explicit authorization

Application: Eziwan RBAC allows you to define access rights by site, by piece of equipment, and by time slot for each technician.

FR 3 — Data Integrity​

What this means:

  • Data transmitted between devices must not be alterable in transit
  • The integrity of the PLC configurations must be verifiable

Application: All Eziwan communications are encrypted using OpenVPN (authentication + encryption). The configurations are digitally signed.

FR 4 — Data Confidentiality​

What this means:

  • Sensitive data (recipes, production parameters, personal data) must be encrypted in transit and at rest

Implementation: AES-256-GCM encryption of all communications; stored data is encrypted on the French cloud infrastructure.

FR 5 — Limited Data Flow​

What this means:

  • Communications between security zones must be controlled and limited to the minimum necessary
  • No direct communication between the office IT zone and OT controllers without a DMZ

Eziwan App: zero-inbound-port architecture—the OT network is never directly exposed. Traffic passes through the Eziwan cloud, which acts as a centralized control point.

FR 6 — Response to Events​

What this means:

  • Security incidents must be detected, recorded, and addressed
  • For NIS2: mandatory notification within 24 hours for critical entities

Application: Comprehensive logging of all security events, configurable alerts for connection anomalies, and log export for SIEM.

FR 7 — Availability of Resources​

What this means:

  • The system must remain available even in the event of an attempted attack (DoS protection)
  • Backup and recovery mechanisms must be in place

Application: Dual SIM failover, multi-AZ cloud infrastructure, automatic backups of gateway configurations.

The 6-Step IEC 62443 Compliance Process​

Here is a practical approach for French manufacturers who must comply with NIS2 by referencing IEC 62443.

Step 1: Inventory of OT Assets (3–5 days)​

List all your OT systems:

  • Controllers (PLCs, DCSs, RTUs)
  • HMIs and operator stations
  • SCADA servers and historians
  • OT network equipment (switches, routers, firewalls)
  • Gateways and connectivity equipment

For each asset: firmware/software version, network connectivity, date of the last security update, existing remote access capabilities.

Step 2: Mapping Areas and Ducts (2–3 days)​

Draw a diagram of the current OT network, including security zones and communication flows. Identify:

  • Existing IT/OT interfaces
  • Remote access methods (VPN, RDP, TeamViewer)
  • Devices with ports exposed to the Internet (search for your IP addresses on Shodan)

Step 3: Simplified Risk Analysis (1 week)​

For each area, assess:

  • Criticality (impact of a breach: production, security, environment)
  • Threat (who might want to attack your sector?)
  • Vulnerability (current security status of the area)

Prioritize the areas to be addressed first: high criticality + high vulnerability = Priority 1.

Step 4: Defining the Target SL Level by Zone​

Based on the risk analysis:

  • Standard production areas → SL 2
  • Areas with SIL safety controllers → SL 3
  • OT office areas (engineering workstations) → SL 1 to SL 2

Step 5: Remediation Plan (spanning 6–18 months)​

For each area where the current level is below the target SL, define corrective actions:

SL 2 Priority Actions:

  1. Remove all default passwords from OT devices
  2. Replace unsecured remote access methods (exposed RDP, TeamViewer) with a zero-trust VPN
  3. Implement MFA authentication for all remote access
  4. Create named accounts (no shared generic accounts)
  5. Enable access logging on all devices that support it
  6. Segment the OT network from the office IT network (DMZ or VLAN with ACL)

Key Actions for SL 2: 7. Update the firmware on OT equipment (gateways, industrial switches) 8. Document incident response procedures 9. Train maintenance teams on OT cybersecurity risks

Step 6: Evaluation and Continuous Improvement​

IEC 62443 compliance is not a one-time project but an ongoing process. Plan for:

  • Annual review of the inventory and mapping
  • Annual (or semi-annual) penetration testing of remote access points
  • Update the remediation plan after each incident or infrastructure change

IEC 62443 and NIS2: What French Entities Need to Do​

The NIS2 Directive (transposed into French law by the Act of October 8, 2024) does not explicitly cite IEC 62443, but the measures it requires are directly in line with it.

The Entities Involved​

Critical infrastructure: energy (electricity, natural gas, oil), transportation (air, rail, maritime, road), banking, financial infrastructure, water (supply, wastewater), healthcare, digital infrastructure.

Key sectors: postal services, waste management, chemicals, food, industrial manufacturing (medical devices, electronic equipment, mechanical engineering), digital service providers.

Required Cybersecurity Measures (Art. 21 NIS2)​

  1. Information Systems Security Policy (IEC 62443-2-1)
  2. Incident Management: detection, response, notification within 24 hours (IEC 62443-2-1, FR 6)
  3. Business Continuity: Backups, recovery plans (IEC 62443-3-3 FR 7)
  4. Supply Chain Security: Security of subcontractors with OT access (IEC 62443-2-4)
  5. Procurement Security: security assessment prior to deployment of OT equipment (IEC 62443-4-2)
  6. Training and Awareness: all personnel with access to OT systems
  7. Cryptography and Encryption: encrypted communications, protected sensitive data
  8. Access Control: strong authentication, RBAC, logging (IEC 62443-3-3 FR 1, FR 2)
  9. Human Resources Security: background checks, exit procedures
  10. Risk Assessment: formal, documented process (IEC 62443-3-2)

5 Mistakes to Avoid in an IEC 62443 Project​

Mistake 1: Starting with the documentation before the site survey​

Many manufacturers commission security policies before conducting an actual inventory. The result: theoretical documents that are out of touch with the reality on the ground. Always start with the inventory and mapping.

Mistake 2: Treating IEC 62443 as an IT project​

OT security has specific constraints: equipment cannot be taken offline for updates, the protocols are legacy (Modbus from 1979), and the teams are automation engineers—not IT professionals. Involve the production teams from the very beginning.

Mistake 3: Aiming for SL 3 or SL 4 without a valid reason​

SL 3 and SL 4 have very strict requirements (strong authentication on PLCs, encryption of all industrial protocols, including Modbus) that often necessitate replacing OT equipment. For most manufacturers, SL 2 is a realistic and sufficient target.

Mistake 4: Neglecting Third-Party Access Security​

The most common OT incidents involve remote access by maintenance contractors. Prioritize third-party access security (named accounts, MFA, audit trails) before addressing the more technical aspects.

Mistake 5: Thinking that NIS2 compliance equals IEC 62443 compliance​

NIS2 mandates security measures but does not certify compliance with IEC 62443. IEC 62443 certification (by an accredited body) is distinct from NIS2 compliance. For most manufacturers, documented compliance with IEC 62443 without formal certification is sufficient to meet NIS2 requirements.

FAQ​

Is IEC 62443 certification required to comply with NIS2? No. The NIS2 directive mandates technical and organizational security measures but does not require formal IEC 62443 certification (which is issued by accredited bodies such as TÜV, Bureau Veritas, etc.). However, documenting that your practices are aligned with IEC 62443 is an excellent way to demonstrate your NIS2 compliance to ANSSI.

Which part of IEC 62443 should an industrial PMI start with? For an industrial PMI, start with IEC 62443-2-1 (policies and procedures) and IEC 62443-3-3 (system requirements for Security Levels 1 and 2). These are the most directly applicable parts and the ones most frequently requested by clients. The 4.x parts (components) are of greater interest to equipment manufacturers.

What is a security zone in IEC 62443? A security zone is a group of systems with the same required security level, separated from other zones by conduits (controlled communication channels). Example: Zone 1 = production PLCs (SL2), Zone 2 = SCADA (SL2), Zone 3 = IT (SL1). Communications between zones must pass through a firewall or a controlled DMZ.

How do I determine the target Security Level (SL) for my facility? The target SL depends on the consequences of an incident: SL1 for a limited risk (temporary shutdown of a non-critical process), SL2 for a significant risk (impact on production or personal safety), and SL3 for critical systems (energy, water, healthcare). Most industrial SMEs aim for SL2 for their SCADA systems and SL1 for support systems.

Does IEC 62443 cover VPN remote access security? Yes. IEC 62443-3-3 explicitly addresses authentication (SR 1.1, SR 1.2), communication encryption (SR 4.1), session management (SR 1.3), and auditability (SR 2.8). An OpenVPN/IPSec VPN with certificate-based authentication and logging meets the requirements of Security Levels 1 and 2 in these areas.

Additional Resources​

Additional Resources​