Audit
OT security GAP analysis: where do you stand on IEC 62443?
Whether you operate plants, integrate automation solutions or develop components: IEC 62443 sets different requirements for each role. We check exactly the part of the standard series that applies to you and show what is still missing for implementation.
Free and without obligation. You will receive your proposal within 48 hours.
Which part of IEC 62443 we check
We check the part of the standard series that fits your role:
- Operators (asset owners): IEC 62443‑2‑1, your security programme for plant operation
- Integrators and service providers: IEC 62443‑2‑4, requirements for integration and maintenance
- Software development: IEC 62443‑4‑1, your secure development process
- Products and components: IEC 62443‑4‑2, technical requirements per security level
- On request: IEC 62443‑3‑3 for systems you supply or operate
Your result: compliance level and IEC 62443 action plan
You know what is still missing for implementation or certification:
- Compliance level for each requirement of the part reviewed
- Gaps rated by risk and effort
- Prioritised action plan, aligned with plant operation or product development
- Basis for implementation with our OT security consulting and for the certification audit
How your IEC 62443 GAP analysis works
We start with your role and then check requirement by requirement:
- Initial conversation: role, plants or products, goals.
- Your proposal with scope and approach
- Classification: relevant parts of the standard, scope and target level.
- Analysis: interviews, document review and, for operators, a site walkthrough.
- Report and action plan: with recommendations, for example for risk analyses, OT pentests or secure coding training.
Why Securitects
- Close to the standard: our team contributes as an expert member to the OVE working group on IEC 62443
- The right part of the standard for every role: we assess operators, integrators and manufacturers against the requirements that apply to them
- Experience as NIS auditors of critical infrastructure: in the energy, drinking water and wastewater, and public transport sectors
- From product development: years of experience in designing and developing secure products, for the analysis under IEC 62443‑4‑1 and 4‑2
Frequently asked questions about the IEC 62443 GAP analysis
That depends on your role. Plant operators follow IEC 62443‑2‑1, integrators and maintenance service providers IEC 62443‑2‑4. Manufacturers check their development process against IEC 62443‑4‑1 and their components against IEC 62443‑4‑2. Many companies have several roles, such as a machine builder who develops controllers and commissions them at the customer’s site. We clarify this in the initial conversation.
The security programme for your plants: organisation and responsibilities, configuration management, network segmentation, remote access, user and access management, malware protection, patch and backup management, and the handling of security incidents.
IEC 62443‑4‑1 describes eight practices for a secure development process, from security requirements and secure design through implementation and testing to vulnerability and update management. IEC 62443‑4‑2 defines the technical security requirements for components, that is software applications, embedded devices, host devices and network devices, graded by security level.
The Cyber Resilience Act requires manufacturers to ensure cybersecurity throughout the entire product lifecycle. For industrial components, IEC 62443‑4‑1 and 4‑2 cover many of these requirements, such as secure development, vulnerability handling and security updates. A GAP analysis under 4‑1 and 4‑2 is therefore good preparation. Whether your product meets all CRA requirements is shown by our CRA Readiness Assessment.
The GAP analysis is the first step and shows where you stand. With our IEC 62443 consulting we then implement the measures with you, from risk analysis and zone model to policies and OT pentests.
No. The GAP analysis is based on interviews, documents and site walkthroughs, and we do not intervene in your control systems. We plan technical tests such as OT pentests separately and coordinate them with your plant operations.
Yes. It shows what is still missing for the audit by an independent certification body, for example for the development process under IEC 62443‑4‑1, components under 4‑2 or service providers under 2‑4. The GAP analysis is a preliminary review; we do not certify ourselves.
The effort depends mainly on the number of parts of the standard reviewed, for operators on the number of sites and plants, and for manufacturers on the number of products and the target security levels. The state of your documentation also plays a role. Products on a shared platform can often be assessed together.
Start your IEC 62443 GAP analysis
In the free initial conversation we clarify which part of the standard series applies to you.