1 Scope
This part of IEC 62443 specifies asset owner security program (SP) policy and procedure requirements for an industrial automation and control system
(IACS) in operation. This document uses the broad definition and scope of what constitutes
an IACS as described in IEC TS 62443‑1‑1 . In the context of this document, asset owner also includes the operator of the IACS.
This document recognizes that the lifespan of an IACS can exceed twenty years, and that many legacy systems contain hardware and software
that are no longer supported. Therefore, the SP for most legacy systems addresses only a subset of the requirements defined in this
document. For example, if IACS or component software is no longer supported, security patching requirements cannot
be met. Similarly, backup software for many older systems is not available for all
components of the IACS. This document does not specify that an IACS has these technical requirements. This document states that the asset owner needs to have policies and procedures around these types of requirements. In the
case where an asset owner has legacy systems that do not have the native technical capabilities, compensating security measures can be part of the policies and procedures specified in this document.
This document also recognizes that not all requirements specified in this document
apply to all IACSs. For example, requirements associated with certain technology (such
as wireless) or functions (such as remote access) will not apply to IACSs that do
...
Open preview (PDF)Security for industrial automation and control systems - Security program requirements for IACS asset owners