IEC 62443 playbook: the factory fortressΒΆ
A practical lens on IEC62443, the industrial control systems security standard. Not tutorials: they assume that the work is done, devices deployed, networks segmented, and processes running. Their purpose is to help spot gaps, shore up defences, and verify that every control is documented and auditable.
The stages follow the fortress from survey to standing watch. Know what it contains, know who besieges it, draw the walls and gates, set the locks and patrols, test the defences, pass the inspection, and keep watch.
Auditable controls are necessary but not sufficient. Each control in an IEC 62443 deployment encodes an assumption about how the ICS environment will behave under attack: that the firewall rule will enforce what the diagram says it will, that the anomaly detection will fire against the technique the attacker will actually use, that the incident response team will execute the procedure under the conditions of a real event. The evidence that is relevant is not that controls are documented and auditable, but that they produce their intended effect under realistic conditions: a penetration test verifying that segmentation holds against the techniques in scope, a PoC confirming that an anomaly detection signature fires as expected, a tabletop exercise checking that the incident response chain operates under time pressure.
Last updated: 4 July 2026