What is the primary objective of IEC 62443?

IEC 62443 defines requirements and processes for implementing and maintaining cybersecurity in Industrial Automation and Control Systems (IACS). The series establishes a shared-responsibility framework across asset owners, system integrators, and product suppliers, using zones/conduits for segmentation and security levels (SL 0–4) to address OT constraints like availability and long lifecycles. It operationalizes risk assessment (IEC 62443-3-2) into target security levels (SL-T), system requirements (SRs in 3-3), and component requirements (CRs in 4-2), ensuring reliability, integrity, and resilience.

Who is legally or professionally required to comply with IEC 62443?

IEC 62443 applies to asset owners, system integrators/service providers, and product suppliers managing IACS cybersecurity. Asset owners establish security programs (IEC 62443-2-1); integrators implement zones/conduits and meet SL-T (3-2/3-3/2-4); suppliers deliver secure development (4-1) and components (4-2). While not universally mandatory, it is professionally required in critical sectors (energy, manufacturing) via contracts, procurement, and regulations referencing it as a horizontal standard.

Does IEC 62443 require an external audit or third-party certification?

IEC 62443 does not mandate external audits or certification but supports them via ISASecure schemes. Modular certifications include SDLA (4-1 processes), CSA (4-2 components), and SSA (3-3 systems), using accredited bodies for consistent assessment. Organizations use these for assurance, procurement, and maturity levels (ML1–ML4 in 2-1), with emerging site assessments for operational conformance.

How often should an assessment for IEC 62443 be performed?

IEC 62443 assessments should occur initially, then periodically via continuous improvement in the security program (IEC 62443-2-1). Risk assessments (3-2) for zones/conduits and SL-T are repeated after changes, incidents, or threats. Maturity evaluations (ML1–ML4) and surveillance audits support annual reviews, with triennial re-certifications for ISASecure, aligning to patch management (2-3) and operational cycles.

What are the consequences of non-compliance with IEC 62443?

Non-compliance with IEC 62443 exposes organizations to operational disruptions, safety risks, and regulatory/contractual penalties. In IACS, failures increase cyberattack impacts (downtime, physical harm), supply chain vulnerabilities, and loss of insurance/market access. While not directly fined, referencing regulations enforce it, leading to procurement exclusion, legal liability for asset owners, and escalated residual risk without SL-A verification.

Can IEC 62443 be mapped to other international frameworks?

Yes, IEC 62443-2-1:2024 provides explicit mappings from Security Program Elements (SPE) to system requirements (3-3 SRs) and component requirements (4-2 CRs). These internal traceability links governance to technical controls across foundational requirements (FR1–FR7), enabling lifecycle assurance without external standards.

What is the first step to begin implementing IEC 62443?

The first step is establishing an IACS security program per IEC 62443-2-1, including governance and asset inventory. Define the System Under Consideration (SUC), conduct initial risk assessment (3-2), and create zones/conduits to set SL-T, forming the Cybersecurity Requirements Specification (CSRS) as the foundation for segmentation and procurement.

What is the primary objective of AS9120B?

AS9120B establishes quality management system requirements for aerospace distributors that procure, store, split, and resell parts without altering product characteristics. Built on ISO 9001:2015’s 10-clause structure, it adds over 100 aerospace-specific controls addressing distribution risks like traceability loss, counterfeit parts, documentation errors, and external provider weaknesses. Core focus areas include chain-of-custody preservation (Clauses 8.5.2, 8.1), counterfeit prevention (8.1.4-8.1.5), configuration management (8.1.2), and robust supplier evaluation (8.4), enabling OASIS listing and supply chain approval.

Who is legally or professionally required to comply with AS9120B?

AS9120B applies to aviation, space, and defense distributors performing purchase, storage, splitting, or resale without affecting product conformity. It targets stockist and pass-through distributors, excluding those modifying products (e.g., machining) or performing MRO. Certification is not legally mandatory but commercially essential, required by OEMs and primes for supplier qualification; thousands of global certifications reflect de facto market entry criteria via IAQG OASIS.

Does AS9120B require an external audit or third-party certification?

AS9120B requires third-party certification through accredited bodies using AS9101 audit criteria, involving Stage 1 (documentation) and Stage 2 (implementation) audits. Certification, valid 3 years with annual surveillance and recertification, lists organizations in IAQG’s OASIS database for visibility. Internal audits (Clause 9.2) support readiness, but external certification demonstrates compliance to customers.

How often should an assessment for AS9120B be performed?

AS9120B mandates internal audits at planned intervals to cover the QMS annually (Clause 9.2), with management reviews at least annually (Clause 9.3). Audits ensure conformity and effectiveness, using process-based methods (e.g., PEAR/Turtle diagrams). External surveillance audits occur yearly post-certification, with full recertification every 3 years.

What are the consequences of non-compliance with AS9120B?

Non-compliance with AS9120B risks contract disqualification, supply chain exclusion, and liabilities from nonconforming parts or counterfeits. Without certification, distributors face OEM rejection, lost OASIS visibility, audit findings, recalls, and safety incidents; common pitfalls include traceability failures and weak supplier controls leading to major nonconformities.

Can AS9120B be mapped to other international frameworks?

AS9120B aligns directly with ISO 9001:2015’s high-level structure, enabling seamless mapping of its 10 clauses. It augments ISO requirements with distributor-specific additions (e.g., counterfeit prevention, traceability), allowing integrated QMS for organizations pursuing multiple certifications without clause conflicts.

What is the first step to begin implementing AS9120B?

Conduct a formal gap analysis against AS9120B clauses using cross-functional teams and checklists to identify deficiencies. Appoint a Management Representative, define QMS scope (Clause 4.3) with “not applicable” justifications (e.g., 8.3 design), and prioritize high-risk areas like supplier controls and traceability for a risk-based rollout.

Standards Comparison

IEC 62443 vs AS9120B

IEC 62443

Voluntary

2018

International standard for IACS cybersecurity lifecycle frameworks

AS9120B

Mandatory

2016

Aerospace standard for distributor quality management systems

Quick Verdict

IEC 62443 secures industrial control systems via risk-based cybersecurity frameworks for OT environments, while AS9120B ensures aerospace distributors maintain traceability and quality. Organizations adopt IEC 62443 for cyber resilience and AS9120B for supply chain approval.

Industrial Cybersecurity

IEC 62443

IEC 62443: Industrial automation and control systems security

Cost

€€€€

Complexity

Medium

Implementation Time

18-24 months

Key Features

Shared-responsibility framework for owners, integrators, suppliers
Zones and conduits model for risk-based segmentation
Security Levels SL-T, SL-C, SL-A triad
Seven Foundational Requirements with 140+ specs
ISASecure modular certifications for components, systems

Quality Management

AS9120B

AS9120B Quality Management Systems - Requirements

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Traceability and chain-of-custody controls for split lots
Counterfeit and suspected unapproved parts prevention
Risk-based external provider evaluation and flowdown
Product preservation and configuration management
Enhanced awareness of product safety and ethics

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

IEC 62443 Details

What It Is

IEC 62443 is the international consensus-based series of standards for securing Industrial Automation and Control Systems (IACS). It provides a comprehensive, risk-based framework spanning governance, risk assessment, system architecture, and component requirements tailored to OT environments with unique constraints like safety and availability.

Key Components

Four groupings: General (-1), Policies (-2), System (-3), Components (-4)
Seven Foundational Requirements (FR1-7) with 140+ system/component specs
Zones/conduits model, Security Levels (SL 0-4), SL-T (target), SL-C (capability), SL-A (achieved)
ISASecure certifications: SDLA (-4-1), CSA (-4-2), SSA (-3-3)

Why Organizations Use It

Mitigates OT cyber risks to safety, production, environment
Enables supplier qualification, procurement specs, insurance benefits
Builds stakeholder trust via certifications; horizontal applicability across sectors
Supports regulatory baselines (e.g., NIS-2 alignments)

Implementation Overview

Phased approach: CSMS governance (-2-1), risk assessment/segmentation (-3-2), controls (-3-3/-4-2), audits. Applies to critical infrastructure globally; requires OT expertise, multi-year maturity progression (ML1-4).

AS9120B Details

What It Is

AS9120B is the IAQG quality management system standard for aerospace distributors, built on ISO 9001:2015's high-level structure. It targets organizations procuring, storing, splitting, and reselling parts without alteration, emphasizing risk-based thinking to address distribution risks like traceability loss and counterfeits.

Key Components

Over 100 aerospace-specific requirements beyond ISO 9001.
Core areas: context analysis, leadership, planning, support, operations (traceability, preservation, counterfeit prevention), performance evaluation, improvement.
Built on PDCA cycle; requires documented information, not full procedures.
Certification via accredited bodies, OASIS listing.

Why Organizations Use It

Commercial necessity for OEM/Tier-1 supply chains.
Mitigates risks of nonconformities, enhances chain-of-custody trust.
Improves efficiency, market access (2,442 global certifications).
Builds stakeholder confidence in product safety/authenticity.

Implementation Overview

Phased: gap analysis, process design, training, audits (6-12 months).
Applies to aviation/space/defense distributors globally.
Involves cross-functional teams, internal audits, management reviews.

Key Differences

Aspect	IEC 62443	AS9120B
Scope	IACS cybersecurity lifecycle framework	Aerospace distribution quality management
Industry	Industrial automation, critical infrastructure global	Aviation, space, defense distributors worldwide
Nature	Voluntary consensus cybersecurity standards	Voluntary certification quality standard
Testing	ISASecure modular certifications, risk assessments	IAQG audits, internal audits, management reviews
Penalties	Loss of certification, supply chain exclusion	Loss of certification, market exclusion

Scope

IEC 62443

IACS cybersecurity lifecycle framework

AS9120B

Aerospace distribution quality management

Industry

IEC 62443

Industrial automation, critical infrastructure global

AS9120B

Aviation, space, defense distributors worldwide

Nature

IEC 62443

Voluntary consensus cybersecurity standards

AS9120B

Voluntary certification quality standard

Testing

IEC 62443

ISASecure modular certifications, risk assessments

AS9120B

IAQG audits, internal audits, management reviews

Penalties

IEC 62443

Loss of certification, supply chain exclusion

AS9120B

Loss of certification, market exclusion

Frequently Asked Questions

Common questions about IEC 62443 and AS9120B

IEC 62443 FAQ

AS9120B FAQ

You Might also be Interested in These Articles...

NIST SP 800-53 Rev 5.1 Private Sector Tailoring Blueprint: First 5 Steps to Overlay-Driven Compliance with Infographic

Step-by-step blueprint for private sector NIST SP 800-53 Rev 5.1 tailoring using overlays for AI & supply chain risks. Infographic + first 5 steps for ROI-drive

CIS Controls v8.1 IG1 Ransomware-Resilience Sprint: A 30-60-90 Day Action Plan (With Evidence Checklist)

Tactical CIS Controls v8.1 IG1 playbook for ransomware resilience. 30-60-90 day sprint with tool-agnostic tasks, ownership & evidence checklists to prove progre

NIST CSF 2.0 Govern Function Deep Dive: Building Executive Cybersecurity Governance from Scratch

Step-by-step blueprint for NIST CSF 2.0 Govern function: templates, RACI matrices, metrics to elevate cybersecurity governance to boardroom level. Reduce breach

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how IEC 62443 and AS9120B compare against other standards

Other IEC 62443 Comparisons

Other AS9120B Comparisons

What It Is

Key Components

Four groupings: General (-1), Policies (-2), System (-3), Components (-4)

Seven Foundational Requirements (FR1-7) with 140+ system/component specs

Zones/conduits model, Security Levels (SL 0-4), SL-T (target), SL-C (capability), SL-A (achieved)

ISASecure certifications: SDLA (-4-1), CSA (-4-2), SSA (-3-3)

What It Is

Key Components

Over 100 aerospace-specific requirements beyond ISO 9001.

Core areas: context analysis, leadership, planning, support, operations (traceability, preservation, counterfeit prevention), performance evaluation, improvement.

Built on PDCA cycle; requires documented information, not full procedures.

Certification via accredited bodies, OASIS listing.

Aspect

IEC 62443

AS9120B

Scope

IACS cybersecurity lifecycle framework

Aerospace distribution quality management

Industry

Industrial automation, critical infrastructure global

Aviation, space, defense distributors worldwide

Nature

Voluntary consensus cybersecurity standards

Voluntary certification quality standard

Testing

ISASecure modular certifications, risk assessments

IAQG audits, internal audits, management reviews

Penalties

Loss of certification, supply chain exclusion

Loss of certification, market exclusion