IEC 62443

Yes.

Now, um, I would also want to keep in mind is that the, uh, ISA IEC 62443 is a best practice, uh, standard that you can apply in, in your concepts and architecture in the way that you want to, uh, set up your, your environment.

However, if you are in certain industries like electric power, there are regulations that the government requires you to follow that supersedes these best practices.

So, for example, if you're an electric power company, as your power plant, you can't use VLANs because in the NERC SIP standard, any information that passes between a critical asset and a power plant and anything else has to go through an intermediary zone, like a DMZ, and the two cannot directly talk.

So am I gonna be, as an IT person, grappling with some foreign concepts as I'm diving into this document, or should it sort of generally track with My expertise and experience on the

IT side.

Yeah, if you're coming from the IT side and you're a cybersecurity professional and you're familiar with other frameworks like NIST 800-53 or the NIST CSF framework, you're going to already know a lot of the concepts that you're going to see in the ISA IEC 62443.

Now, what you will see that's different is the unique aspects of these standards that apply to whether you're an asset owner If you work for a chemical plant or a manufacturing company, there are parts of that standard that apply to you and your responsibility.

It is the device where the plant's entire trust model becomes a physical reality.

In all the architecture guides like IEC 62443, they talk constantly about zones and conduits.

You isolate the highly volatile chemical mixing zone from the mundane packaging zone.

You create strict rules about what data can flow between them.

Compliance gaps.

NERC CIP, IEC 62443, and NIST 800-82 require granular access controls and audit-ready reporting.

Many legacy OT tools simply weren't built to provide either, so audit preparation becomes a manual scramble.

Assets spread across remote sites, substations, refineries, water plants, and pipelines are often geographically distributed.

You know, like for us, water, wastewater issues.

We look at IEC 62443 as our framework to work from and the Purdue model to work from as far as how we pull everything together.

The reality is that it would be much better if the feds produced something, gave us law that says this is the minimum standard that you will meet.

These are the protections you'll have in place.

It's not an infinite amount.

And it all depends on if you're talking about NERC SIP, or you're talking about a NIST standard or IEC 62443, all these different standards, organize them differently, but it's still the same universe of stuff that you need to pay attention to, to make sure that you're managing the risks to the appropriate level for your threat environment.

It sounds like from your experience over the last couple years that the industry is, let's call it maturing, that they are beginning to accept that there is the risk there, it's not going to go away, and they need to begin taking actions to to begin mitigating what they can within their control.

Obviously, we hear organizations say, I want to see 100% visibility.

The other one is what we've talked about already, which is there's a difference between being compliant and being secure.

If I'm just trying to check the box and I'm not trying to understand that this is a safety and uptime issue, okay, then I'm not – I may – not getting out of the gates correctly, right? Now, once I'm there, I need to have their frameworks.

As I mentioned, IEC 62443 is an international standard.

NIST is a standard.