IEC 62443 (Industrial Cybersecurity)
IEC 62443 is the standard for securing industrial automation and control systems — the PLCs, SCADA systems, HMIs, and safety instrumented systems that run plants, utilities, and critical infrastructure. It exists because IT security practices don't transfer cleanly to OT. You can't just push a patch to a controller that's been running a water treatment process unattended for eleven years; you can't run an aggressive vulnerability scan against equipment where an unexpected packet might trip a safety system. IEC 62443 was built for that reality, with concepts like zones and conduits for segmenting a control network by trust level and consequence, and Security Levels that scale protection to the actual threat an asset faces, instead of applying one blanket IT-style policy everywhere.
The standard spans everything from how a vendor builds secure products and how a system integrator architects a plant, to how the asset owner operates and maintains it day to day. Most of my work sits in that last part — the operational and architectural side that asset owners are actually accountable for.
Who needs this
Manufacturers, utilities, water and wastewater systems, oil and gas, and any operator where a cyber incident doesn't just mean a data breach — it means a physical process stops, or worse, becomes unsafe. If your environment has a control network that's gradually been connected to the business network for convenience, or that was air-gapped once and isn't anymore, this is the standard that tells you how to get segmentation and access control right without breaking the process it's protecting.
How I'd approach it
I start by understanding the process before I touch the network — what each system actually does, what happens if it fails or is manipulated, and what the real consequence is, because that's what should drive your Security Level targets, not a generic checklist. From there it's mapping out zones and conduits that reflect genuine trust boundaries, assessing where IT and OT have blurred together in ways nobody fully decided on, and building a remediation path that respects uptime and safety constraints instead of fighting them. I work with your operations and engineering teams, not around them — in OT, the people who know the process are the ones who keep a change from becoming an outage.
If you're trying to figure out where your control environment actually stands against IEC 62443, or you need a credible outside assessment before a regulator, insurer, or customer asks, let's talk.