ISASecure and IEC 62443, explained with the numbers
What each certification program actually evaluates, how the security levels and device types change the scope, and where the common points of confusion come from — written by the assessors who run these evaluations.
Filteractive
16 articles match your filters
IEC 62443-2-1 audit evidence in an ACSSA evaluation: documents, interviews and inspection, never testing
How an ISASecure ACSSA evaluator gathers evidence on an installed IACS: documents, interviews and configuration inspection, never testing or device access.
IEC 62443-2-1 maturity level 2 vs 3: why ISASecure ACSSA certification needs level 3 on every requirement
In ISASecure ACSSA, maturity level 2 means a requirement is documented and level 3 means it is practised. Certification needs level 3 on every requirement.
Service providers in ACSSA: IEC 62443-2-4, delegated tasks and the VIC shortcut
How ISASecure ACSSA evaluates an asset owner's service providers against IEC 62443-2-4: who counts, delegated tasks, the agreed list, NR-A and the VIC result.
ACSSA evaluation results: ten result types, and the one that fails
ACSSA records ten result types across four IEC 62443 parts. Only Not met fails; three others pass only with approved documentation; unsampled zones get none.
The SDLA prerequisite: why ISASecure CSA needs it, and what the SDA-C artifact review adds
ISASecure CSA requires a valid SDLA certificate. What the process certificate covers, what the component-level SDA-C review adds, and what to prepare.
Where fuzzing, load testing and penetration testing actually live in ISASecure CSA
Suppliers often expect the certification lab to fuzz and pen-test their product. It does not. Who performs each kind of security test in a CSA evaluation, what the lab checks instead, and what to prepare.
SDA-IC: the 93 lifecycle requirements checked per IIoT component, and the five ICSA-only practices
What ICSA's SDA-IC review checks per IIoT component: 93 of the 118 IEC 62443-4-1 lifecycle requirements, 16 IIoT-specific rows and five ICSA-only practices.
IEC 62443-4-1 defect and update management: the SDLA practices product certifications come back to
How ISASecure SDLA evaluates IEC 62443-4-1 defect and update management: 15 rows, most seen only in the process audit, and the four requirements ICSA revisits.
Full or readiness evaluation: the SDLA choice that sets your certificate at 36 or 12 months
ISASecure SDLA has two evaluation methods. One requirement passed by readiness evaluation sets the certificate at 12 months, not 36. The 21 rows that decide it.
What counts as a major nonconformity in an IEC 62443-4-1 audit: the 31 SDLA minimum requirements
In an ISASecure SDLA audit a finding is major when no evidence exists, or when one of 31 minimum requirements is applied inconsistently. The full list.
IEC 62443-4-1 security guidelines and hardening: the SDLA practice with the most minimum requirements
ISASecure SDLA and the IEC 62443-4-1 security guidelines practice: 7 requirements, 17 rows, 10 minimum requirements, no mandatory artifacts, examined twice.
Fuzz, load, penetration and abuse-case testing: what the IEC 62443-4-1 SVV practice asks of a supplier
The SVV practice is where ISASecure SDLA is strictest: five IEC 62443-4-1 requirements, 20 assessable rows and a named test type behind most of them.
What is ISASecure SDLA, and what does the certificate actually certify?
ISASecure SDLA certifies a development organisation and a versioned development process against IEC 62443-4-1: eight practices, 47 requirements, no levels.
IEC 62443-4-1 process audit: the 23 SDLA rows no product evaluation examines
23 ISASecure SDLA-312 rows are checked only in the SDLA process audit, on Perseus's reading of its activity columns: defect handling, coding rules, pen testing.
Reference layouts and scalable systems: how one ISASecure SSA certificate covers a family of configurations
How ISASecure SSA certifies a scalable IEC 62443-3-3 system: zone specifications, layouts in scope, the reference layout the lab tests, and nine submissions.
SSA SDA-S artifacts: the 74 lifecycle rows ISASecure checks for a system, and why fuzz and load results are among them
ISASecure SSA's SDA-S stream re-checks 74 assessable rows of the SDLA-312 lifecycle catalogue for the system as sold, fuzz and load coverage included.
Have a product or system to certify?
Talk to the assessors who wrote these articles about what applies to you.