EN IEC 62443-2-4:2019

This part of IEC 62443 specifies a comprehensive set of requirements for security capabilitiesfor IACS service providers that they can offer to the asset owner during integration andmaintenance activities of an Automation Solution. Because not all requirements apply to allindustry groups and organizations, Subclause 4.1.4 provides for the development of Profilesthat allow for the subsetting of these requirements. Profiles are used to adapt this documentto specific environments, including environments not based on an IACS.NOTE 1 The term “Automation Solution” is used as a proper noun (and therefore capitalized) in this part ofIEC 62443 to prevent confusion with other uses of this term.Collectively, the security capabilities offered by an IACS service provider are referred to as itsSecurity Program. In a related specification, IEC 62443-2-1 describes requirements for theSecurity Management System of the asset owner.NOTE 2 In general, these security capabilities are policy, procedure, practice and personnel related.Figure 2 illustrates how the integration and maintenance capabilities relate to the IACS andthe control system product that is integrated into the Automation Solution. Some of thesecapabilities reference security measures defined in IEC 62443-3-3 that the service providermust ensure are supported in the Automation Solution (either included in the control systemproduct or separately added to the Automation Solution).