Leadership and responsibility
Top management carries the responsibility, assigns roles for the security of the installations and provides resources.
Free self-assessment for OT security
IEC 62443 gap analysis: how mature is your CSMS?
IEC 62443 is the international benchmark for the security of industrial automation. As an asset owner, integrator or manufacturer, find out how far your cyber security management system carries and where the gaps are.
- Free, no sign-up
- Asset owner, system, manufacturer
- Data stays in your browser
- Report as PDF
Sample result
118items
18topics
3roles
Basics
IEC 62443 and the CSMS: a management system for operational technology
IEC 62443 is an international series of standards for the cybersecurity of industrial automation and control systems. It addresses everyone who operates, integrates or manufactures such systems and applies across industries: from manufacturing to energy and water to building technology.
A cyber security management system, or CSMS, is the management system for the security of these installations. It follows the same logic as an information security management system in line with ISO/IEC 27001: management takes responsibility, risks are assessed, measures are implemented, their effect is monitored and the system is continually improved. The difference lies in the priorities. In operational technology, the availability of the installation and the protection of people and the environment come first.
The term CSMS comes from the first edition of the part for asset owners. The current edition from 2024 speaks of the security program and structures it into eight elements. In practice, CSMS has remained the name for this management system.
The standard suggests aligning the security program with an existing information security management system or integrating it. This creates one integrated management system instead of two parallel worlds for office IT and production.
Do not confuse: the automotive sector also knows a CSMS. There it means the vehicle manufacturer's management system required for type approval. That is a separate set of rules and not the subject of this page.
Management system
Four building blocks of a CSMS
What turns a CSMS into a management system is the closed loop of responsibility, risk, measures and review.
Risk and protection goals
Installations are divided into zones, risks are assessed per zone and the required level of protection is derived from this.
Measures in operation
Rules for configuration, network, components, data, access, incidents and availability are implemented and practised.
Review and improve
Effectiveness is reviewed regularly. Findings from audits, incidents and changes feed back into the system.
ISMS and CSMS compared
| Building block | In the ISMS under ISO/IEC 27001 | In the CSMS for operational technology |
|---|---|---|
| Leadership | Top management sets objectives, provides resources and carries the responsibility. | Company and plant management approve the security program and name a responsible person for each installation. |
| Risk | Risks to information are assessed and treated. | Installations are divided into zones and conduits. The required protection is defined for each zone. |
| Measures | Organisational and technical measures according to the risk. | Eight elements from organisation through network and remote maintenance to backup and restart. |
| Monitoring | Metrics, internal audits and management review. | Regular review of the program, technical checks and maturity rating. |
| Improvement | Nonconformities are corrected and the system evolves. | Results from incidents, reviews and modifications feed back into the program. |
Build on it, do not duplicate: the 2024 edition of the part for asset owners builds on an existing ISMS. If you already run an ISMS, you extend it by what is special about production: availability, protection of people and the environment, long service lives and legacy installations. Where an installation cannot technically provide a protective function, documented compensating measures are the intended route.
The series
The most important parts of IEC 62443
The series organises its requirements by role. Which parts matter to you depends on whether you operate installations, integrate them or manufacture components.
| Part | Who is addressed? | What is it about? |
|---|---|---|
| IEC 62443-2-1 (2024) | Asset owners | Security program for operating industrial installations, structured into eight elements from organisation to availability. |
| IEC 62443-2-4 (2023) | Integrators and service providers | Requirements for companies that integrate and maintain installations. |
| IEC 62443-3-2 (2020) | Asset owners and planners | Risk assessment for system design: zones, communication paths and the required level of protection. |
| IEC 62443-3-3 (2013) | Integrators and system owners | Technical requirements for the overall system along seven foundational requirements. |
| IEC 62443-4-1 (2018) | Manufacturers | Secure development lifecycle with eight practices, from requirements to updates. |
| IEC 62443-4-2 (2019) | Manufacturers | Technical requirements for components: software, embedded devices, hosts and network devices. |
In motion: new editions of the parts for manufacturers are in preparation, and European amendments are intended to align the standard with the Cyber Resilience Act. None of this has been published yet. The gap analysis checks against the editions in force.
Roles
Three roles, shared responsibility
Security in industry only works together. The gap analysis covers each role as a separate module; you choose what applies to you.
Asset owner
You are responsible for the secure operation of your installations. The check covers your CSMS with all eight elements, the risk assessment with zones and the management of your service providers. This module is preselected.
Integrator and system
You plan and build automation solutions. The check covers the technical requirements for the overall system along the seven foundational requirements.
Manufacturer
You develop components and products. The check covers your secure development lifecycle and the technical requirements for your components.
Several roles are the norm: a machine builder that develops its own controllers and maintains customer installations is a manufacturer and a service provider at the same time. In the gap analysis, select all modules that apply to your organisation.
Yardsticks
Security level and maturity level
The standard has two yardsticks that are often confused. One describes the strength of protection, the other the quality of the processes.
Security level 1 to 4
The security level states against which kind of attacker an installation or component should be protected: from accidental misuse to a targeted attack with extensive resources and specialist knowledge.
- Target: derived from the risk assessment
- Capability: what the system or component can deliver
- Achieved: what actually holds in operation
Maturity level 1 to 4
The maturity level rates processes, not technology: from case-by-case handling through defined and demonstrably practised procedures to measured, continual improvement.
- applies to the security program, service providers and development
- shows whether rules exist only on paper
- the basis of every process certification
What this self-assessment measures: the implementation status of your processes and measures on a scale from 0 to 3. It does not determine the security level of an installation. That requires a risk assessment and technical testing.
Self-assessment
IEC 62443 gap analysis
Choose your role and the depth, rate each item on a scale from 0 to 3 and get your results immediately: fulfilment, maturity by topic and the gaps sorted by criticality.
Privacy: your entries are stored only locally in your browser and are not transmitted to VamiSec or third parties. The page works without tracking and without external services.
Next steps
From results to a roadmap
The result shows where you stand. This is how it becomes a plan.
Clarify the scope
Define which installations, products and sites the CSMS should cover and which parts of the standard apply to your role.
Prioritise the gaps
Start with the critical items: responsibility, risk assessment, zones, remote access and vulnerability handling.
Implement the roadmap
Derive measures with owners and dates, implement them and repeat the gap analysis to measure progress.
Regulation
Why the topic is urgent now
Several European and German rules require state-of-the-art cybersecurity. For industry and operational technology, IEC 62443 is the recognised point of reference.
NIS2 and the German BSI Act
Important and particularly important entities must manage risks, document measures and report incidents. Manufacturing is among the sectors covered, including machinery, electrical equipment and vehicles. NIS2 gap analysis
Cyber Resilience Act
Manufacturers of products with digital elements must demonstrate security throughout the life cycle. The reporting duties for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026.
Machinery Regulation
For the first time, the new European Union regulation requires safety-relevant software, data and control systems of machinery to be protected against manipulation.
In context: none of these rules prescribes IEC 62443 by name. They require the state of the art and consideration of relevant standards. A certificate according to IEC 62443 does not create automatic conformity with the Cyber Resilience Act today, but it is a strong building block for the technical documentation.
Support
How VamiSec supports you
From the first assessment to certification readiness: we accompany asset owners, integrators and manufacturers.
Gap analysis and roadmap
We clarify role, scope and relevant parts of the standard, rate the maturity and deliver a prioritised roadmap.
Building and integrating the CSMS
We set up the security program for your installations and link it with an existing information security management system.
Risk, zones, architecture
Risk assessment, zones and communication paths, network architecture and hardening of control systems. OT & industrial security
Secure product development
Secure development lifecycle, threat analysis, security architecture and software bill of materials. Product security
Security testing
Penetration tests, fuzzing, code analysis and verification of the protection level of components and systems.
Certification readiness
Pre-audit, evidence package and mock audit for process, product, system or organisation. The certification itself is carried out by an independent body.
FAQ
Frequently asked questions
What is a CSMS?
A cyber security management system is the management system for the security of industrial installations. It governs responsibility, risk assessment, measures, monitoring and improvement. The current edition of the standard calls it a security program; in practice, CSMS is the common term.
Is IEC 62443 required by law?
No, no law prescribes the standard by name. The German BSI Act, the Cyber Resilience Act and the Machinery Regulation do require state-of-the-art measures and consideration of relevant standards. In industry, IEC 62443 is the recognised benchmark for this, and many customers demand it by contract.
Which part applies to my organisation?
That depends on your role. Asset owners look at the part on the security program and at the risk assessment. Integrators and service providers at the parts for service providers and systems. Manufacturers at the parts for development and components. Many organisations have several roles.
What is the difference between security level and maturity level?
The security level describes how strongly an installation or component should be protected against attackers. The maturity level describes how reliable the processes behind it are. A high security level without mature processes does not last long in operation.
How does IEC 62443 relate to ISO/IEC 27001?
The two complement each other. ISO/IEC 27001 describes the management system for information security across the organisation. IEC 62443 adds what operational technology needs in addition: availability, the safety of people and the environment, long life cycles and legacy installations. A joint system with separate rules for production where they are needed makes sense.
We hold an ISO/IEC 27001 certificate. Is that enough for production?
It is a good foundation because organisation, risk management and many procedures already exist. Often, however, the scope ends at the transition to production, and typical topics of operational technology are missing: zones and conduits, remote maintenance by machine suppliers, legacy installations without updates and restarting an installation. The self-assessment shows where your ISMS already covers production and where it does not.
Which security level is right for us?
That follows from the risk assessment and not from a rule of thumb. You divide the installation into zones, assess the possible damage for each zone and define against which kind of attacker it should be protected. Different zones of the same installation can have different levels. This avoids excessive measures in uncritical places and gaps in critical ones.
What can we do about legacy installations that can no longer be updated?
The standard expects installations to run for many years. It does not demand technology an old controller cannot deliver, but defined compensating measures: stronger isolation in the network, restricted and monitored access, closer monitoring and a practised restart. What matters is that the risk is assessed, the compensating measure is documented and management has approved it.
Does IEC 62443 help with the Cyber Resilience Act?
Yes, as a foundation. The parts for manufacturers cover many topics the Cyber Resilience Act requires, such as secure development, vulnerability handling and updates. Automatic conformity does not follow from this. The European standards intended to achieve that are still in preparation.
Can you get certified to IEC 62443?
Yes, but always related to a role. A manufacturer's development process, individual products, entire systems, the security program of integrators and service providers and, by now, installations in operation can be certified. This is offered, among others, in the international conformity assessment scheme of the IEC and in the ISASecure programme. VamiSec is not a certification body; we prepare you for the assessment.
How long does the self-assessment take?
The quick check for asset owners covers 22 critical items and takes about 15 minutes. The complete asset owner module has 55 items in 10 topics; with all three roles there are 118. You can pause at any time; your progress stays stored in the browser.
What happens to my entries?
All entries stay in your browser. Nothing is transmitted to VamiSec or third parties. You can save your progress as a file, export it as a table or print it as a report.
Does the self-assessment replace an audit?
No. The self-assessment is a self-evaluation and neither an audit nor a conformity assessment, because nobody verifies your answers or reviews evidence. It shows the need for action and works as a basis for discussion between management, production and IT. A reliable statement requires an on-site gap analysis with interviews, document review and a look at the installation. For a formal assessment, the licensed text of the standard applies.
Have your result put into context
In a free 30-minute initial call we discuss your results, your role and the sensible next steps.
Basis
Sources and assessment basis
The items follow the publicly described topics of the IEC 62443 series. Each item states which part of the standard it refers to.
- ISA/IEC 62443 series of standards: overview. International Society of Automation (ISA). https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
- IEC 62443-2-1:2024, security program requirements for asset owners. International Electrotechnical Commission (IEC), webstore. https://webstore.iec.ch/en/publication/62883
- IEC 62443-2-4:2023, requirements for service providers. International Electrotechnical Commission (IEC), webstore. https://webstore.iec.ch/en/publication/67631
- IEC 62443-3-2:2020, security risk assessment for system design. International Electrotechnical Commission (IEC), webstore. https://webstore.iec.ch/en/publication/30727
- IEC 62443-3-3:2013, system security requirements and security levels. International Electrotechnical Commission (IEC), webstore. https://webstore.iec.ch/en/publication/7033
- IEC 62443-4-1:2018, secure product development lifecycle requirements. International Electrotechnical Commission (IEC), webstore. https://webstore.iec.ch/en/publication/33615
- IEC 62443-4-2:2019, technical security requirements for components. International Electrotechnical Commission (IEC), webstore. https://webstore.iec.ch/en/publication/34421
- White paper: applying ISO/IEC 27001/2 and the ISA/IEC 62443 series for operational technology environments. International Society of Automation (ISA). https://www.isa.org/news-press-releases/2021/july/new-white-paper-applying-iso-iec-27001-2-and-the-i
- Certification programmes for IEC 62443. ISASecure. https://isasecure.org/certification
- Standards in the cyber security category of the CB scheme. IECEE. https://www.iecee.org/certification/iec-standards?category=CYBR
- ISASecure announces new IACS Security Assurance inspection and certification scheme, 18 June 2025. International Society of Automation (ISA). https://www.isa.org/news-press-releases/2025/june/isasecure-announces-new-iacs-security-assurance-ac
- Act on the Federal Office for Information Security (BSIG) as amended by the NIS 2 Implementation Act. Federal Ministry of Justice, Gesetze im Internet. https://www.gesetze-im-internet.de/bsig_2025/
- Cyber Resilience Act: overview and key dates (German). Federal Office for Information Security (BSI). https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Cyber_Resilience_Act/cyber_resilience_act_node.html
- Machinery Regulation (EU) 2023/1230: information from the Commission. European Commission. https://single-market-economy.ec.europa.eu/sectors/mechanical-engineering/machinery_en
- Aligning EN IEC 62443 with the Cyber Resilience Act. CEN-CENELEC. https://www.cencenelec.eu/news-events/events/2025/2025-09-09-en-iec-62443-to-cra
As of November 2026. All questions are VamiSec GmbH's own wording and do not reproduce the text of the standard. The self-assessment is a self-evaluation, not an audit and not a conformity assessment. For formal assessments, the licensed text of the standard is authoritative. The content of this page does not replace legal advice.