IEC 62443
IEC 62443-3-3, System security requirements and security levels
S3M supports nine IEC 62443-3-3 system requirements for industrial networks. ConnGuard NAC and EndGuard identify users and devices, APNZone binds each SIM to its hardware at remote sites, CityGate segments control networks without VLANs, and SAMI keeps audit-ready records. The standard applies to a whole system, so S3M is one part of it.
How S3M supports IEC 62443
Applies to: Asset owners, system integrators and suppliers of industrial automation and control systems. Read the official text
| Article / control | What it asks | How S3M supports it | Products |
|---|---|---|---|
| SR 1.1 Human user identification and authentication | Identify and authenticate every person who uses the system. | ConnGuard NAC identifies and authenticates users at the network with 802.1X and RADIUS. S3M does not provide multi-factor authentication. | |
| SR 1.2 Software process and device identification and authentication | Identify and authenticate devices and software processes. | EndGuard fingerprints devices, ConnGuard NAC authenticates them with 802.1X, and APNZone binds each SIM to its hardware (IMSI and IMEI). | |
| SR 1.13 Access via untrusted networks | Monitor and control access that comes in over untrusted networks. | APNZone controls cellular access from remote sites by SIM and device, and pushes policy to active sessions. | |
| SR 2.1 Authorization enforcement | Enforce the permissions given to each identity. | ConnGuard NAC and CityGate enforce per-identity network permissions at each connection. | |
| SR 2.8 Auditable events | Create audit records of security-relevant events. | SAMI keeps audit-ready records of network access events. | |
| SR 5.1 Network segmentation | Separate control system networks from other networks. | CityGate segments control system networks without VLANs, and APNZone isolates cellular-connected field devices. | |
| SR 5.2 Zone boundary protection | Monitor and control traffic at the boundaries between zones. | ConnGuard NAC shares identity with the firewalls at zone boundaries, so boundary rules can follow the user and device. | |
| SR 6.2 Continuous monitoring | Monitor security mechanisms continuously to detect breaches. | EndGuard and CityGate keep verifying identity, device and session, and APNZone detects unauthorized SIMs. | |
| SR 7.8 Control system component inventory | Keep an inventory of the control system’s components. | ConnGuard NAC discovers the devices on the network, including IoT, which feeds the component inventory. |
S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.
Checked against the official text on .
Related
Frequently asked questions
Can one product satisfy IEC 62443-3-3?
No. IEC 62443-3-3 sets requirements for a whole control system, which the asset owner and integrator put together. S3M supports the requirements in the table as one part of that system.
Why are only requirement numbers and titles shown?
IEC 62443 is a paid, copyrighted standard. We name each system requirement by number and title and describe it in our own words.
Which S3M product fits remote industrial sites?
APNZone. It binds each SIM to its device, detects unauthorized SIMs and isolates cellular-connected field equipment.
Last updated