IEC 62443 — Industrial communication networks, network and system security.

When does IEC 62443 apply to you?

IEC 62443 may apply to you if one of these triggers applies. The Regulatory Check tests them against your details. Triggers marked “only together with industry or activity” only count if a trigger on industry or activity applies at the same time.

• Activity: Operational technology (OT plant) (Applies): Anyone operating operational technology (OT) or industrial control systems finds in IEC 62443 the internationally recognised framework for systematically building and demonstrating their cybersecurity.
• Industry: Energy (Recommend individual review): In energy supply, IEC 62443 is increasingly used as an accepted state of the art for securing control systems, complementing the ICT minimum standard under the Electricity Supply Ordinance.
• Industry: Manufacturing (Likely applies): In manufacturing, IEC 62443 links requirements for operators (62443-2-1) with those for manufacturers of connected components (62443-4-1/4-2) and is increasingly accepted by customers and auditors as evidence of OT security.
• Activity: Critical infrastructure (Recommend individual review): Operators of critical infrastructure are required by legislation such as NIS2 implementation to take appropriate technical measures; IEC 62443 is, in practice, regarded as an accepted way of giving concrete effect to this obligation for OT environments, even though the law does not name the standard in its wording.
• Role towards customers: Manufacturer (only together with industry or activity) (Recommend individual review): Manufacturers of components for industrial control systems are increasingly asked by operators for a development process under IEC 62443-4-1 and components under 62443-4-2.

Exceptions

• There is no legal obligation to be certified to IEC 62443 in Switzerland or the EU; the standards series as a whole is voluntary to apply.
• Pure office IT with no connection to production or control systems falls outside the series' scope.

What does IEC 62443 require?

• For operators (IEC 62443-2-1, 2024 edition): build a security programme for the OT environment with a four-stage maturity model (Initial, Managed, Defined, Improving), explicitly aligned with ISO/IEC 27001 to avoid duplicating work with an existing ISMS
• For system design (IEC 62443-3-2, 3-3): risk assessment, a zones-and-conduits model, and defining a security level (SL1 to SL4) per zone
• For manufacturers (IEC 62443-4-1): a secure development process across the entire product life cycle
• For component manufacturers (IEC 62443-4-2): technical security requirements per component type (embedded devices, network components, host components, software applications)

What evidence is needed?

• Conformity assessment/certification by specialised certification bodies is possible but not uniformly mandated
• Documented risk assessment, zones/conduits model and assigned security level as an internal evidence document
• For manufacturers: evidence of a secure development process (62443-4-1) and product conformity (62443-4-2), partly via manufacturer declaration, partly via certification by a testing body

What are the consequences of violations?

No fine from the standard itself, since it is voluntary; in practice: without documented implementation, auditors, cyber insurers and customers may object that the 'state of the art' for OT security has not been reached, which can make tenders and taking out cyber insurance more difficult.

What is connected with it?

• ISO/IEC 27001: ISO/IEC 27001 is the internationally recognised standard for an information security management system (ISMS); it is voluntary, but is frequently required by large customers, in tenders and in due-diligence reviews.
• ICT Minimum Standard under the Electricity Supply Ordinance (StromVV, Art. 5a): Since 1 July 2024, the recommendations of the Minimum Standard for Improving ICT Resilience (ICT Minimum Standard, May 2023 edition) have been binding, per the respective protection level under Annex 1a, under Art.
• Directive on measures for a high common level of cybersecurity across the Union (NIS2): The NIS2 Directive (Directive (EU) 2022/2555) obliges operators in critical and important sectors to manage risk and report significant security incidents.
• Regulation on cybersecurity requirements for products with digital elements (Cyber Resilience Act): The Cyber Resilience Act (Regulation (EU) 2024/2847) sets EU-wide, uniform cybersecurity requirements for hardware and software products with digital elements across their entire life cycle.

What is still uncertain?

• iec.ch (main site/blog) was unreachable in this session (HTTP 403); only the IEC webstore entry for part 1-1 (publication metadata, not the full text of the standard) could be read directly.
• A literal reference to IEC 62443 in NIS2 implementation or the Cyber Resilience Act was not found in a statutory text in this session; the classification as 'accepted state of the art' rests on secondary sources and professional knowledge, not on a legal reference checked directly.
• The complete list of all published parts of the series (in particular 2-2, 2-3, 2-4, 3-1) was only checked via secondary sources (Fortinet, Wikipedia), not individually verified in the IEC webstore.
• Whether and which accredited certification bodies in Switzerland offer IEC 62443 certifications was not examined in this session.

Sources

Information as of: 24 September 2026.

• IEC TS 62443-1-1:2009 — Terminology, concepts and models, IEC (International Electrotechnical Commission), retrieved on 24 September 2026
• IEC 62443, Wikipedia (Übersichtsartikel), retrieved on 24 September 2026
• IEC 62443 Standard: Industrial Cybersecurity Framework Explained, Fortinet, retrieved on 24 September 2026
• What Are ISO/IEC 62443-4-1 and 62443-4-2?, Security Compass (Suchergebnis), retrieved on 24 September 2026

A professional assessment based on publicly available sources, not legal advice. Whether a given rule applies in your specific case depends on circumstances that are not fully captured here.