Is IEC 62443 the same as ISA-99?

Yes, in substance. The standard was originally developed by the International Society of Automation as ISA-99, then adopted and renumbered by the IEC as the 62443 series. Today it is commonly cited as "ISA/IEC 62443", and the two names refer to the same family of documents.

How is IEC 62443 different from ISO 27001 or NIST?

ISO 27001 and NIST frameworks are IT-centric and prioritise confidentiality. IEC 62443 is purpose-built for OT/ICS, where availability and safety come first. It models the network as physical zones and conduits, accounts for decades-long equipment lifecycles, and ties security capability to certifiable products. It complements NIST CSF rather than replacing it.

What is the difference between a Security Level and a Maturity Level?

A Security Level (SL 1–4) measures the technical robustness of a zone or component — specifically the strength of attacker it can resist. A Maturity Level (ML 1–4, based on CMMI) measures how repeatable and well-managed your security processes are. A product can be highly capable (high SL) while the organisation operating it is immature (low ML), so both are assessed.

What are SL-Target, SL-Capability and SL-Achieved?

SL-Target (SL-T) is the security level a zone needs based on risk and is set by the asset owner. SL-Capability (SL-C) is the level a component or system can reach when correctly configured, and is a property of the product. SL-Achieved (SL-A) is the level actually realised in the live installation. A successful design ensures SL-A is greater than or equal to SL-T for every zone.

Does IEC 62443 replace the Purdue model?

No. The Purdue model is a hierarchical reference architecture for plant networks. IEC 62443 uses Purdue levels as a convenient starting point for drawing zones and conduits, then refines that segmentation according to a formal risk assessment. The two are complementary: Purdue describes the hierarchy, 62443 secures it.

Engineering·10 min read·June 17, 2026

🏭 IEC 62443: Securing Industrial Automation and Control Systems (OT)

A vendor-neutral guide to IEC 62443 (formerly ISA-99): its document structure, Zones and Conduits, the seven Foundational Requirements, Security Levels, Maturity Levels, and how asset owners adopt it for OT/ICS cybersecurity.

📖Industrial Cybersecurity Reference (Full Access)

View →

What IEC 62443 actually is

IEC 62443 is the leading international standard for the cybersecurity of Industrial Automation and Control Systems (IACS) — the controllers, SCADA, DCS, PLCs, safety systems and supporting networks that run physical processes. It began life as ISA-99, developed by the International Society of Automation, and was later adopted and renumbered by the IEC. The two names refer to the same body of work; you will still see "ISA/IEC 62443" used interchangeably.

Topics covered

IEC 62443ISA-99OT security standardICS cybersecurityzones and conduitsfoundational requirementssecurity levels SLPurdue model security