IEC 62443 Compliance from the Facility Device Perspective

How the products and devices deployed in manufacturing and defence facilities affect OT cybersecurity and compliance

IEC 62443 is not only about policies. It is about how every connected device is selected, configured, segmented, accessed, monitored, maintained and eventually retired.

A manufacturing or defence facility may contain hundreds or thousands of connected products: programmable logic controllers, human-machine interfaces, industrial robots, CNC machines, sensors, safety systems, industrial switches, firewalls, wireless access points, engineering workstations, servers, storage systems and remote-access gateways. Each device performs a useful function, but each also introduces a possible cybersecurity exposure.

IEC 62443 provides a structured way to manage these risks. From a facility perspective, compliance means understanding what devices are present, what they communicate with, who can access them, what security capabilities they provide and how they are protected throughout their operating life.

The Connected Device Landscape in a Modern Facility

The following device groups commonly form part of an Industrial Automation and Control System, or IACS:

Device category	Typical products	Primary IEC 62443 concern
Control and automation	PLCs, DCS controllers, remote I/O, robot controllers, CNC controllers	Unauthorised logic, firmware or parameter changes
Operator and engineering systems	HMIs, engineering workstations, programming laptops, historian clients	Privileged access, malware, shared accounts and uncontrolled software
Network infrastructure	Industrial switches, routers, firewalls, wireless access points and gateways	Flat networks, insecure protocols and unrestricted data flows
Industrial servers and storage	SCADA servers, historians, MES servers, domain services, backup systems	Availability, patching, identity control and recovery
Field and IIoT devices	Sensors, actuators, cameras, meters, RFID and edge devices	Weak authentication, unmanaged firmware and excessive connectivity
Safety and critical systems	Safety PLCs, emergency shutdown systems and environmental controls	Isolation, integrity and protection from common-cause compromise
Remote-access products	VPN gateways, jump servers, vendor appliances and cloud connectors	Third-party access, session control and external exposure

Why Compliance Must Start with Products and Devices

Industrial cybersecurity failures often begin with ordinary device-level weaknesses: default passwords, old firmware, unused open ports, unmanaged remote access, flat network connections or unsupported operating systems. A facility may have strong corporate IT security while production devices remain exposed.

IEC 62443 encourages organisations to look beyond the brand or purchase specification of a product. The key question is whether the device can be operated securely within the complete industrial architecture. A secure-capable product can still become a risk if it is installed in the wrong zone, configured with weak credentials or connected directly to an untrusted network.

For this reason, compliance must cover the complete device lifecycle: selection, procurement, installation, configuration, operation, maintenance, monitoring, backup, replacement and disposal.

1. PLCs, DCS Controllers and Machine Controllers

Controllers are the core of production. They manage motors, conveyors, robots, process equipment and machine sequences. Any unauthorised change can affect production quality, safety or equipment reliability.

IEC 62443-aligned controls should include unique engineering access, role-based permissions, controlled programming ports, approved firmware, configuration backups, change approval and network isolation. Where controllers cannot support modern authentication or encryption, compensating controls such as industrial firewalls, restricted engineering stations and continuous network monitoring become essential.

2. HMIs and Engineering Workstations

HMIs and engineering workstations are high-value targets because they provide direct visibility and control over production systems. They may also run older Windows versions, vendor software and specialised drivers that are difficult to patch.

These systems should use named accounts, least privilege, application allowlisting, controlled USB use, endpoint protection where compatible, secure backup and restricted internet access. Engineering laptops used across several machines or sites require special attention because they can carry malware from one production zone to another.

3. Industrial Switches, Routers and Firewalls

Network products determine how industrial devices communicate. If the plant uses a flat network, a compromise in one area may spread across multiple production lines.

IEC 62443 uses the concept of zones and conduits. Devices with similar functions and risk levels are grouped into zones, while communication between zones is controlled through conduits. Industrial switches, VLANs, firewalls, access-control lists, OT demilitarised zones and secure gateways enforce this structure.

The objective is not simply to install a firewall. The organisation must document permitted communication, block unnecessary services, inspect relevant industrial protocols, review rule changes and maintain configuration backups.

4. Wireless, IIoT and Edge Devices

Wireless sensors, cameras, meters, handheld terminals and edge-computing devices improve visibility and flexibility, but they also increase the number of endpoints that must be managed.

The facility should verify device identity, wireless encryption, firmware support, certificate management, network segregation and the method used for cloud communication. Consumer-grade devices should not be introduced into critical production zones without a risk assessment and suitable controls.

5. Servers, Storage and Backup Products

SCADA, historian, MES, authentication and application servers support plant operations even when they are not physically located on the production line. Their failure can stop monitoring, traceability, quality reporting or production scheduling.

IEC 62443-aligned protection includes system hardening, controlled administrative access, patch governance, malware protection, log collection, resilient architecture and tested recovery. Backups must include not only business data but also PLC logic, HMI projects, switch and firewall configurations, recipes, certificates and licence information.

6. Safety and Environmental Control Devices

Safety PLCs, emergency shutdown systems, access controls, fire systems, HVAC controls and environmental monitoring may be connected to the wider facility network. Their compromise can have consequences beyond production loss.

These devices require strong isolation, tightly controlled communication and documented dependencies. Where possible, safety systems should not share unrestricted pathways with general IT or production systems. Changes should follow formal approval and testing procedures.

7. Remote-Access and Vendor-Support Products

Machine manufacturers and service providers often require remote access for maintenance. Uncontrolled vendor connectivity is one of the most common risks in industrial facilities.

A compliant approach uses approved remote-access gateways, multi-factor authentication, named accounts, time-bound permissions, access approval, session logging and immediate removal of access after completion. Direct inbound connections, permanently enabled modem links and shared vendor credentials should be eliminated or strictly controlled.

Additional Importance for Defence Facilities

In defence manufacturing, device security protects more than production availability. CNC controllers, test equipment, calibration systems, industrial PCs and engineering stations may contain sensitive drawings, machining programmes, inspection limits and acceptance criteria.

A small unauthorised change to a machine parameter, robotic sequence, test script or calibration value may affect the reliability of a finished component without causing an obvious system outage. This makes device integrity, change control, logging and verification especially important.

Defence suppliers must also demonstrate that subcontractors, machine vendors and maintenance teams cannot access sensitive production systems beyond what is required. IEC 62443 provides a practical structure for controlling these device and supplier relationships.

What to Check Before Purchasing an Industrial Product

IEC 62443 readiness becomes easier when security requirements are included at the procurement stage. Before approving a new product or device, the facility should evaluate:

• Whether the product supports unique users, roles and strong authentication;
• Whether secure protocols, encryption and certificate management are available;
• How firmware and security updates are provided and for how long;
• Whether security logs can be exported to a central monitoring platform;
• Whether unused services, ports and interfaces can be disabled;
• How configurations, programmes and certificates can be backed up and restored;
• Whether the supplier follows a secure product-development lifecycle;
• How remote support is enabled, approved, monitored and revoked;
• Whether the product can operate within the required zone and target security level; and
• What happens when the product reaches end of support.

A Device-Focused IEC 62443 Roadmap

1. Create an accurate asset inventory: Identify every connected product, including model, firmware, IP address, location, owner, function, criticality, support status and remote-access method.
2. Map communication and dependencies: Document which devices communicate, which protocols are used, why the connection is required and whether it crosses a trust boundary.
3. Group devices into zones: Separate corporate IT, production lines, engineering systems, safety systems, servers, wireless devices and vendor access according to function and risk.
4. Assess device security capabilities: Compare each product against the security controls required for its zone. Record unsupported features and compensating controls.
5. Harden configurations: Remove default accounts, disable unused services, restrict management interfaces, apply secure firmware and back up configurations.
6. Control privileged and remote access: Use named accounts, least privilege, multi-factor authentication, jump servers, time-limited vendor access and session logging.
7. Monitor and maintain: Collect logs, review changes, track vulnerabilities, test backups and plan replacement before products become unsupported.
8. Retire devices securely: Remove credentials, certificates, data and network access before disposal, transfer or reuse.

Business Benefits of a Device-Level Compliance Approach

Reduced production disruption: Segmentation and secure configuration prevent one compromised device from affecting the entire facility.

Improved product quality and integrity: Controlled access and change management reduce the risk of altered recipes, machine programmes or test parameters.

Safer vendor maintenance: Remote support can continue without giving suppliers unrestricted access to the OT network.

Better audit and tender readiness: The organisation can show which devices are present, how they are secured and how risks are being treated.

Longer and safer equipment life: Legacy products can remain operational through compensating controls while replacement is planned.

Faster incident response: Accurate inventories, network maps and configuration backups help teams isolate and restore affected systems.

How Vays Infotech Can Support IEC 62443 Readiness

Vays Infotech helps manufacturing and defence organisations assess the products and devices already operating within their facilities and translate IEC 62443 requirements into practical improvements.

Our support can cover OT asset discovery, device inventory, network and communication mapping, zone-and-conduit design, industrial firewall deployment, secure remote access, switch and wireless hardening, server and endpoint protection, centralised monitoring, configuration backup, policy development and remediation tracking.

We can also assist organisations in defining cybersecurity requirements for new equipment purchases so that insecure or unsupported devices are not introduced into critical production environments.

From Product Selection to Operational Resilience

IEC 62443 compliance becomes meaningful when it reaches the device level. Every PLC, switch, firewall, server, sensor, workstation and remote-access gateway must have a defined role, owner, security configuration and lifecycle plan.

For manufacturers, this protects productivity, product quality, equipment and delivery commitments. For defence facilities and suppliers, it also protects engineering integrity, sensitive information, supply-chain confidence and mission readiness.

The objective is not to purchase a single ‘IEC 62443-compliant’ product. The objective is to build a secure industrial system in which all products and devices work together within a controlled, monitored and resilient architecture.

Speak with Vays Infotech about an IEC 62443 device and facility readiness assessment.