IEC 62443 and NIS2 – cybersecurity for industrial networks

Why OT security differs from IT security

In office IT, confidentiality often comes first. In a control system, availability and safety matter most: the process must not stop and a valve must not be opened by the wrong person. Equipment often stays in service for 15–30 years, updates require planned shutdowns and older protocols such as Modbus lack authentication. Meanwhile, ever more machines are connected for remote service.

What is IEC 62443?

IEC 62443 is a series of international standards for cybersecurity in industrial automation and control systems. It builds on work by the US organisation ISA, which is why you sometimes see the name ISA/IEC 62443.

Three roles

The asset owner owns and operates the plant and is responsible for the risks. The integrator designs, builds and maintains the system. The product supplier develops the components, such as switches, routers, PLCs and software.

Security levels SL 1–4

• SL 1 – protection against unintentional mistakes and casual violations.
• SL 2 – protection against intentional attacks with simple means and generic skills.
• SL 3 – protection against sophisticated attacks with moderate resources and control-system knowledge.
• SL 4 – protection against sophisticated attacks with extensive resources and high motivation.

Zones and conduits

A zone is a group of equipment with the same security requirements, such as a production line or a substation. A conduit is the controlled communication path between zones, typically through a firewall or secure router. The idea is that an intrusion in one zone cannot spread freely to the rest of the plant.

What does NIS2 require – and who is covered?

NIS2, Directive (EU) 2022/2555, replaced the first NIS Directive and was due to be transposed by EU member states by October 2024. In Sweden the Cybersecurity Act (2025:1506) has applied since 15 January 2026, and covered organisations must register with the Swedish Agency for Civil Defence (MCF). Other countries are at different stages, and the UK has its own rules.

The directive generally applies to medium and large organisations, from 50 employees or 10 million euros in annual turnover, in designated sectors. These include energy, transport, healthcare, water and digital infrastructure, but also manufacturing of medical devices, electronics, machinery and vehicles, and food and chemicals. Some are covered regardless of size.

• Risk management – measures for incident handling, continuity, supply chain security, access control and encryption, among others.
• Management accountability – management must be trained in the security measures and is responsible for their implementation.
• Incident reporting – an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
• Penalties – fines of up to 10 million euros or 2 per cent of global annual turnover for essential entities.

Companies outside the scope are still affected, because covered customers must place requirements on their suppliers. Manufacturers of products with digital elements also face the EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, applying in full from December 2027.

Practical first steps

1. Take inventory. List equipment, firmware versions and connections. You cannot protect what you do not know you have.
2. Segment. Divide the network into zones with VLANs in managed switches and firewalls in between. Separate the office network from OT with a DMZ.
3. Control the traffic. Industrial firewalls and secure routers with deep packet inspection understand protocols such as Modbus and can block unauthorised commands.
4. Secure remote access. No open ports to the internet. Suppliers connect via VPN through a controlled point, with personal accounts and two-factor login.
5. Update and harden. Plan firmware updates, change default passwords and disable unused services and ports.
6. Log and monitor. Collect logs centrally and raise alarms on anomalies, so incidents are detected in time.
7. Plan for recovery. Back up configurations and programs, and test that restoring works.

Examples from different industries

• Energy – secure routers between substations and the control centre, and firewalls that understand IEC 61850.
• Water and wastewater – pumping stations reached via cellular networks and VPN instead of open ports.
• Factories and machine builders – NAT devices that separate the machine network from the customer’s, and VPN routers for remote service.
• Railways – secure routers and firewalled gateways that separate on-board subsystems.
• Hospitals and defence – medical equipment in separate zones, and strict separation between networks of different classification.

What should you demand from suppliers?

• Products certified to IEC 62443-4-2, with the security level stated, for example SL 2.
• Development to IEC 62443-4-1, including vulnerability handling.
• A clear statement of how long security updates will be provided.
• Secure defaults: no shared default passwords, signed firmware and secure boot. Ideally also a software bill of materials (SBOM).
• For integrators and service providers: working methods to IEC 62443-2-4.

Common mistakes

1. A flat network. In a single flat network, malware on a service laptop can reach every PLC. Segmentation is often the most effective measure.
2. An air gap that does not exist. USB sticks, service laptops and 4G modems added by someone break the isolation. Map every way in.
3. Remote access on the side. Port forwarding and remote control tools from a quick fix often stay. Bring all remote access into one controlled solution.
4. The certificate becomes an alibi. A certified IEC 62443-4-2 component does not make the system secure. That depends on how zones, conduits and procedures are designed.

Secure network products from SCN

We supply secure routers, industrial firewalls, NAT devices, VPN routers and managed switches from Moxa, Axiomtek, INSYS icom, HMS Networks and Yaskawa, among others. Some products in the range are certified to IEC 62443-4-2, for example Moxa’s NPort 6600-G2 serial device server at SL 2.

Examples from our range

Frequently asked questions

Is IEC 62443 mandatory?

The standard itself is voluntary, but it is often used to show that NIS2 requirements are met, and more customers require it in procurement.

What is the difference between IEC 62443 and ISO/IEC 27001?

ISO/IEC 27001 describes an information security management system for the whole organisation. IEC 62443 is written for industrial control systems, with technical requirements for systems and components. Many use both.

Is my company covered by NIS2?

It depends on sector and size. Check your national law and the supervisory authority’s guidance. Companies outside the scope often get requirements from customers who are covered.

What does SL 2 mean in IEC 62443?

Security level 2 means protection against intentional attacks using simple means and generic skills. It is a common level for certified industrial network products.