IEC 62443-3-2
The IEC 62443-3-2 standard defines the risk assessment process for Industrial Automation and Control Systems (IACS). It structures the analysis around security zones and conduits, and results in the determination of a Security Level Target (SL-T) for each zone.
This introduction page summarises the module; each step has its own detailed guide, accessible from the links below or from the contextual help panel of the corresponding page.
Recommended workflow
Context → ZCR1 SUC → ZCR2 Initial risk → ZCR3 Zones & SL-T
→ ZCR4 Comparison → ZCR5 Detailed → ZCR6 CRS → ZCR7 ApprovalThe order is often surprising
Initial risk (ZCR 2) comes before zoning: it feeds the per-zone SL-T suggestion. See Where to start, which also details the three choices to make before starting.
Where to start
Before diving into the analysis, fill in the study's Context (SUC identification, scope, team), then follow the ZCR steps in order: they build on one another logically, each relying on the previous one's data.
If you have a written description of the installation (process, equipment, network), the ✦ AI Scoping feature can automatically pre-fill the Context, ZCR2 and ZCR3 from that text — a valuable time saver at the start of a study.
For a quick overview without going through the detailed analysis, the light CRS format automatically derives the applicable requirements from the zones and their SL-T alone.
Context
Defines the study's general parameters: SUC (System Under Consideration) identification, functional and physical scope, team, work sessions, reference documents and applicable regulations.
See Context.
✦ AI Scoping
An AI assistant that pre-fills Context, ZCR2 and ZCR3 from a descriptive sheet of the installation (text + images), using the AI engine configured in /gestion/ia.
See AI Scoping.
ZCR1 — Identify the SUC
Modelling of the SUC: inventory of equipment and networks, functions, users and roles, access points, a visual diagram of the system, and vulnerability analysis (CVE/CVSS) of the listed equipment.
TIP
Import your components from the IEC 62443 library to save time on common equipment (Siemens S7, Allen-Bradley, OSIsoft PI…).
See ZCR1 — Identify the SUC (also covers the SUC Diagram and CVE analysis).
ZCR2 — Initial Risk Assessment
Initial risk assessment at the overall SUC level: for each asset, a feared event is rated for likelihood/severity, which determines the raw risk level before segmentation into zones.
See ZCR2 — Initial Risk Assessment.
ZCR3 — Zones & Conduits
Segmentation of the SUC into security zones (SL-T per zone) linked by conduits, following the IEC 62443-3-2 segmentation rules (IT/OT separation, safety systems, temporary/wireless devices, external connections).
ZCR4 — Risk Comparison
Compares each initial risk (ZCR2) to a tolerable risk threshold, to decide which risks require a detailed analysis in ZCR5.
ZCR5 — Detailed Risk Assessment
Detailed analysis of each retained scenario: threat (with MITRE ATT&CK for ICS mapping), vulnerabilities, severity, likelihood, risk, SL-T, countermeasures and residual risk.
See ZCR5 — Detailed Risk Assessment (also covers the MITRE ATT&CK analysis).
ZCR6 — CRS Document
Consolidates the analysis into the CRS (Cyber Security Requirements Specification) document required by the standard (§4.7.2): 9 numbered sections, from the SUC description to the regulatory requirements.
See ZCR6 — CRS Document.
Compliance Analysis
Measures, zone by zone, the coverage of security requirements (SR/CR) by the countermeasures assessed in ZCR5, organised around the 7 Foundational Requirements (FR1-FR7) plus organizational measures (ORG).
See Compliance Analysis.
IEC 62443 Report
Three output formats are available: the CRS Report (full, editable, Word/Excel export), the light CRS (automatically derived, Excel export) and the Risk Analysis Report (fixed 10-section summary, Word/Excel export).
See IEC 62443 Report (covers all 3 formats).