OT security (IEC 62443)

OT security for the systems that keep your plant running

We help industrial organisations assess, design and implement IEC 62443 programmes across SCADA, PLC, DCS and IIoT environments, from zone and conduit architecture to security level verification and certification readiness. OT security is different from IT security: integrity, availability and safety of the process come first, because downtime in a plant means lost production and can mean harm to people or equipment. IEC 62443 is widely used as the reference for industrial cyber security, and a structured programme gives you evidence you can show customers and auditors.

Ask about IEC 62443 See assessments

Why OT is not IT

Process first. In a plant, integrity and availability of the process, and safety, usually come before confidentiality of data.
Downtime has a cost. An outage can mean lost production, damaged equipment or harm to people, not only lost data.
Different assets. SCADA, PLC, DCS and IIoT equipment is long-lived, hard to patch and often cannot be taken offline for testing.

What we do

OT security assessment: A structured review of your industrial control system against the relevant parts of IEC 62443, for example 2-1 and 3-3. It includes an asset inventory, zone and conduit mapping, and current against target security levels.
Zone and conduit design: A segmentation design that separates critical control zones from IT networks, with conduits defined and secured between them. It is the backbone of any IEC 62443 programme.
Security level assessment: Set a target security level for each zone, from SL 1 (protection against casual or coincidental violation) to SL 4 (protection against intentional violation using sophisticated means and extended resources), then verify what you have achieved.
OT risk assessment: Threat modelling built for industrial environments, where the risk to the process and to safety shapes every decision.
CSMS development: Build the cyber security management system behind your OT security: policies, procedures, roles and the ongoing monitoring that keeps it running day to day.
Certification readiness: Documentation and evidence preparation, and support through the audit with an accredited body. For asset owners and integrators this centres on the programme and system parts; for product suppliers on secure development (4-1) and component requirements (4-2).
OT and IT integration: Align your OT security programme with an existing ISO/IEC 27001 ISMS, so asset, risk and incident processes reinforce each other instead of duplicating effort.

We advise and prepare. Certification and formal assessment are carried out by accredited bodies that are independent of us.

IEC 62443 secures the machines that run your operation

The IEC 62443 series is the reference for cybersecurity in industrial automation and control systems. It is not an Annex SL management system standard. It divides a system into zones, joins them with conduits, and sets a target security level for each zone according to the risk.

Which parts matter depends on where you sit in the chain.

Asset owner: You run the plant, building or network. Security programme and risk assessment (IEC 62443-2-1, 3-2).
System integrator: You design and commission control systems for others. Zones, conduits and system requirements (IEC 62443-3-2, 3-3), and service provider programme requirements (2-4).
Product supplier: You build the devices and software that go into those systems. Secure development lifecycle and component requirements (IEC 62443-4-1, 4-2).

Operators designated as national critical information infrastructure have separate duties under Malaysia’s Cyber Security Act 2024. IEC 62443 is a widely used technical reference, but following it does not by itself demonstrate compliance with the Act.

Illustration only. Real zone boundaries and security levels come from a risk assessment of your system.

Questions we hear first

Is IEC 62443 only for factories?

No. It covers industrial automation and control systems wherever they run: plants, utilities, buildings, logistics sites and the suppliers who build the equipment for them.

Which parts of IEC 62443 apply to us?

It depends on your role. Asset owners usually start with the security programme and risk assessment parts, integrators with the system design parts, and product suppliers with secure development and component requirements. The table above shows the usual mapping; a scoping call confirms yours.

Do you issue the certificate?

No. Certification is issued by an accredited body that is independent of us. We advise and prepare you; keeping that separation is what makes the certificate credible.

Does this make us compliant with the law?

A technical standard is not a legal opinion. IEC 62443 is a widely used reference, but following it does not by itself show compliance with a statute such as Malaysia's Cyber Security Act 2024. For interpretation of the law, work with your legal adviser.

How long will it take, and what will it cost?

It depends on the size of the system, how much documentation exists, and the target security levels. A scoping call lets us give you a realistic range rather than a guess.

Working on an OT security programme?

A scoping call is a conversation about your organisation, the standards in play, and what a sensible first step looks like.

Ask about IEC 62443