BS EN IEC 62443-2-4:2024
Security for industrial automation and control systems - Security program requirements for IACS service providers

Standard No.

BS EN IEC 62443-2-4:2024

Release Date

2024

Published By

British Standards Institution (BSI)

Latest

BS EN IEC 62443-2-4:2024

Scope

This part of IEC 62443 specifies a comprehensive set of requirements for security-related processes that IACS service providers can offer to the asset owner during integration and maintenance activities of an Automation Solution. Because not all requirements apply to all industry groups and organizations, Subclause 4.1.4 provides for the development of "profiles" that allow for the subsetting of these requirements. Profiles are used to adapt this document to specific environments, including environments not based on an IACS. prevent confusion with other uses of this term. Collectively, the security processes offered by an IACS service provider are referred to as its Security Program (SP) for IACS asset owners. In a related specification, IEC 62443-2-1 describes requirements for the Security Management System of the asset owner. Figure 1 illustrates the integration and maintenance security processes of the asset owner, service provider(s), and product supplier(s) of an IACS and their relationships to each other and to the Automation Solution. Some of the requirements of this document relating to the safety program are associated with security requirements described in IEC 62443-3-3 and design, deployment, operation, and maintenance. processes and procedures can be addressed through risk mitigation. Figure 1 – Scope of service provider processes In Figure 1, the Automation Solution is illustrated to contain essential functions that include safety functions, commonly implemented by a Safety Instrumented System (SIS), and complementary and control functions, commonly implemented by supporting applications, such as batch management, advanced control, historian, and security related applications. The dashed boxes identify organizational roles that perform the indicated actions. In general, the Automation Solution is the set of hardware and software, independent of product packaging, which is used to control a physical process (e.g. continuous or manufacturing) as defined by the asset owner. Solution. These generic architectures are often referred to as "reference architectures".

BS EN IEC 62443-2-4:2024 history

• 2024 BS EN IEC 62443-2-4:2024 Security for industrial automation and control systems - Security program requirements for IACS service providers
• 2019 BS EN IEC 62443-2-4:2019+A1:2019 Security for industrial automation and control systems. Security program requirements for IACS service providers

Standard and Specification