IEC 62443-2-1 – Security Program and Risk Assessment | Automation Engineering Body of Knowledge

ISA/IEC 62443-2-1 defines the asset owner’s Security Program (SP) — policies, procedures, products and services that keep an IACS defendable while it runs. ISA/IEC 62443-3-2 is a methodology inside that programme: how to assess cyber risk, partition zones and conduits, and set security level targets. This page is the bridge between the two for assessors and programme owners.

Teaching note: Paraphrased for learning from IACS Security Program and risk-assessment practice and related ISA/IEC 62443 concepts. Not a verbatim extract of ISA publications or the standard — always refer to published text for normative wording.

What a Security Program is

A Security Program (SP) is a portfolio of security services — including integration and maintenance — and their associated policies, procedures and products applicable to the IACS. For asset owners that means the rules and ways of working they define for IACS cybersecurity, including technical, process, physical and compensating measures that reduce the attack surface.

The eight SPE groups are top-level activities for organisational and technical controls that implement a defence-in-depth strategy. Full SPE summaries live on Security Program Requirements and the clause pages for SPE 1–8.

Purpose of SP requirements: risk mitigation

The primary goal of each SP requirement is to mitigate risk, often in more than one way:

Reducing the likelihood of an incident
Minimising the impact of an incident
Shortening recovery time after an incident

Requirements are written in an implementation-independent way: owners choose architectural approaches, policies, procedures and technologies that fit their applications.

How Part 2-1 and Part 3-2 interact

Part 2-1 defines the Security Program, its scope and asset-owner requirements — the governance and management backbone, often integrated with a broader ISMS.
Part 3-2 is a tool within that programme: a methodology to identify and assess risks, define security zones and conduits, and determine security level targets for each zone or conduit.
ORG 2.1 (security risk mitigation) is the usual policy home: identify, document and manage IACS cyber risks, set tolerable risk, and respond when risk is outside that level. Part 3-2 is one means the owner can adopt; the owner must still document how 3-2 is used in their organisation.

Design-time zone and SL-T work (3-2) and day-to-day programme operation (2-1) are complementary — not alternatives.

How SP evidence feeds a 3-2 assessment

Process inputs (scope, zones, roles)

ORG 1.2 / 1.3 / 1.5 — background checks, roles/sign-off and responsibility training for people who run or support the assessment
ORG 2.1 — tolerable risk and treatment policy
CM 1.1 — inventory for SuC scope, zone allocation, criticality and asset-specific vulnerabilities
NET 1.1–1.3 — segmentation and zone documentation expectations that align with ZCR 3

Countermeasure evidence for residual risk (ZCR 5.8–5.10)

When the detailed assessment credits existing controls, implemented SPE practices are often the proof:

Hardening (COMP 1.1) shrinks attack surface → typically lower residual likelihood
Accepted cryptography (DATA 1.5), identity assignment (USER 1.1) → more precise residual scoring when verified on the SuC
Incident handling (EVENT 1.8) and backups (AVAIL 2.1) → often lower impact / faster recovery

Highlighted requirements → risk assessment use

SP ID	Feeds risk assessment how	AEBOK page
ORG 1.2	Vet assessors and reduce insider threat to the RA process	Clause 6
ORG 1.3	Pre-define RA sign-off and OT security roles	Clause 6
ORG 1.5	3-2 competence for assessors and third parties	Clause 6
ORG 2.1	Policy home for 3-2 method + tolerable risk response	Clause 6
CM 1.1	SuC scope, zones, criticality, asset vulnerabilities	Clause 7
NET 1.1–1.3	Segmentation / safety / zone documentation (ZCR 3)	Clause 8
COMP 1.1	Hardening evidence → residual likelihood	Clause 9
DATA 1.5	Crypto evidence → residual precision	Clause 10
USER 1.1	Identity/access evidence → residual precision	Clause 11
EVENT 1.8	IR capability → often lower impact	Clause 12
AVAIL 2.1	Backup/restore → lower impact / faster recovery	Clause 13

Key takeaways

Part 2-1 owns the Security Program; Part 3-2 is a risk/zone/SL-T method used inside it.
SP requirements mitigate risk by cutting likelihood, impact and recovery time.
Assessors consume SPE evidence as process inputs and as residual-risk countermeasures.