Target, security boundaries and roles
Define the organization, system or component and its network boundaries and responsibilities.
Industrial & embedded
Choose the applicable standard parts and assessment target
IEC 62443 is a series covering industrial automation and control system cybersecurity. Asset owners, service providers and product developers have different requirements and certification routes.
Source record updated:
Discuss your certification →Scope and applicability
Industrial automation and control system cybersecurity standards and certification
Adoption follows customer, industry and supply-chain requirements. There is no single statutory certification applying identically to all industrial software.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- Industrial control and OT product developers
- Automation integrators and operators
- Industrial component suppliers
Documents to prepare
Risk assessment and security requirements
Connect threats, risks, zones, conduits and required controls.
Secure development and vulnerability evidence
Document development, verification and vulnerability reporting, correction and release activities.
Preparation process
Select parts and certification scheme
Check applicable parts and the certification body's recognized scope.
Analyze gaps and verify controls
Prepare procedures, implemented controls, test environments and security evidence.
Assess and manage changes
Address findings and maintain software change, vulnerability and certification conditions.
Timing
Applicable parts, product families, security levels and development maturity determine effort. Plan technical tests and process audits separately.
Agency fees
Institutional testing and assessment fees
Quotation based on the agreed scope
Confirm scope, assessor days, retesting, travel and VAT in the final quotation. Institutional fees are separate from Specify subscription charges.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for IEC 62443 based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Is IEC 62443 one uniform certificate?
State the parts, scheme and organizational, system or product scope.
Can ISO 27001 replace it?
An information security management system does not automatically meet industrial product and system requirements.
Is individual training equivalent to product certification?
No. Training evidence differs from product or organizational development process conformity.