← Home

IEC 62443-2-1 Clause 7 – Configuration Management

ISA/IEC 62443-2-1:2024, Clause 7 covers configuration management as Security Program Element SPE 2 in the asset owner’s IACS Security Program.

SPE 2 is about knowing what is installed, how it is connected and configured, and ensuring changes are authorised — so the live system matches the approved design across its lifecycle.

Teaching note: The summaries below paraphrase ISA/IEC 62443-2-1:2024 for learning purposes. They are not a verbatim extract of the standard — always refer to the published text for normative wording and assessment.

Reference: ISA/IEC 62443-2-1:2024, Clause 7
Related: Security Program Requirements (2024) | CSMS (2010) | Asset Inventory | Change Management

SPE pages: SPE 1 | SPE 2 | SPE 3 | SPE 4 | SPE 5 | SPE 6 | SPE 7 | SPE 8

Requirements in this SPE

CM 1 – Inventory management of IACS hardware/software components and network

Reference: ISA/IEC 62443-2-1, Clause 7.2

CM 1.1: Asset inventory baseline

Clause: 7.2.1

Summary
Policies shall keep a verified inventory of IACS devices, hardware, software, protocols and open ports for the whole life of the system. Typical record fields include ownership, manufacturer, model, versions, serial numbers, network details, addresses, patch level and change history.
Risk assessment relevance: During Part 3-2 work the inventory supports SuC scope, allocation of assets to zones and conduits, criticality ranking and asset-specific vulnerability identification. See Prepare for an Assessment and SP and Risk Assessment. Practice detail: Asset Inventory.

CM 1.2: Infrastructure drawings/documentation

Clause: 7.2.2

Summary
Up-to-date drawings and related documents shall show physical and logical connectivity of IACS devices and software, and that baseline shall be checked and maintained.

CM 1.3: Configuration settings

Clause: 7.2.3

Summary
Approved configuration settings for IACS devices and applications shall be documented, and plant systems shall be checked to confirm they match those settings in operation.

CM 1.4: Change control

Clause: 7.2.4

Summary
Changes to the inventory baseline, drawings and configuration — including software revisions and patches — shall be authorised, validated and approved under controlled change processes.

Practice: Change Management (priorities, MOC overlap, emergency documentation).

Key Takeaways