IEC 62443-2-4 Security Program Requirements for IACS Service Providers

Learning objectives

• Explain the purpose of ISA/IEC 62443-2-4 and how “support” for a capability is interpreted.
• Define the service-provider role and distinguish integration, maintenance and product-supplier activities.
• Recognise the twelve Security Program Functional Areas (SP.01–SP.12).
• Describe how ISA/IEC TR/TS 62443-6-1 supports evaluation of Part 2-4 programmes against maturity levels.

What Part 2-4 covers

Part 2-4 sits in the Policies & Procedures group of the series. Where Part 2-1 addresses the asset owner’s Security Program, Part 2-4 addresses the programme that service providers use when they integrate or maintain Automation Solutions.

In practice that means expectations such as:

• How people are assigned and qualified for Automation Solution work.
• How architecture, wireless, SIS integration and remote access are handled securely.
• How configuration, accounts, events, malware protection, patching and backup/restore are governed during service delivery.
• How assurance activities show that the Automation Solution security policy is actually enforced.

Asset owners increasingly ask for ISA/IEC 62443 conformance when contracting. Demonstrating alignment with Part 2-4 can therefore be both a risk-reduction measure and a commercial differentiator — evidence that cybersecurity is part of day-to-day delivery, not an afterthought.

What is a service provider?

A service provider is a person or organisation that supplies a defined support service (and related materials), usually under agreement with the asset owner. The role need not be a separate legal entity. Many large asset owners have internal departments that act as the service provider for their own plants.

The 62443 series prefers the terms provider and supplier over the vague word vendor, so integration, maintenance and product-supply roles can be distinguished clearly.

Related: IACS Cybersecurity Roles — Asset Owner, Integration Service Provider, Maintenance Service Provider and Product Supplier.

Types of IACS service providers

Part 2-4 is written primarily around integration and maintenance service providers. The broader role model also includes product suppliers, whose hardware and software products become part of Automation Solutions.

Integration Service Provider

An IACS Integration Service Provider implements and deploys Automation Solutions to meet asset-owner requirements. Integration work typically runs from design through to handover of the Automation Solution to the asset owner.

Typical integration activities include:

• Defining the technical specifications that guide the integration
• Assessing system requirements and designing tailored solutions
• Installation, configuration, patching, backup and testing of systems
• Obtaining asset-owner approval as work progresses

Maintenance Service Provider

An IACS Maintenance Service Provider maintains and services Automation Solutions according to asset-owner requirements. Maintenance activities are distinct from day-to-day operations. They generally begin after handover and can continue for as long as the asset owner needs them.

Typical maintenance activities include:

• Patching and anti-virus updates
• Equipment upgrades and maintenance
• Component and system migration
• Change management
• Contingency plan management

Product Supplier

A product supplier manufactures hardware and/or software products. Control-system products are typically built from combinations of:

• Supporting applications
• Embedded devices
• Network components
• Host devices

Those products are developed largely independently of any one plant’s IACS environment; they are later selected, configured and integrated into a site-specific Automation Solution. Secure development of the products themselves is the focus of ISA/IEC 62443-4-1, while system and component security capabilities sit in Parts 3-3 and 4-2.

Who may share maintenance work

In a live facility, maintenance activities may be shared across several parties:

• Asset Owner
• Integrator
• Maintainer
• Product Supplier

Contracts and role definitions should make clear who owns each activity — and which Part 2-4 capabilities the service provider is expected to support when that work is outsourced.

Security Program Functional Areas (SP.01–SP.12)

To claim conformance, service providers must meet the applicable requirements in ISA/IEC 62443-2-4. Those requirements are grouped into twelve functional areas. The areas are a high-level map of where a service provider can claim conformance — not a substitute for reading the individual requirements.

Each area uses a requirement-ID pattern such as SP.03.XX (Architecture). Facility patching under SP.11 also connects closely to the guidance in ISA/IEC TR 62443-2-3.

Evaluating service-provider programmes — TR/TS 62443-6-1

ISA/IEC TR/TS 62443-6-1 was published in 2024. It provides objective evaluation criteria for assessing a service provider’s security programme against ISA/IEC 62443-2-4. Both service providers preparing for assessment and evaluators conducting conformity assessments use it to keep results consistent.

Aligned with Part 2-4, the technical report establishes evaluation criteria and the evidence expected at each maturity level (ML 1 through ML 4). The aim is repeatable and reproducible evaluation outcomes — so two competent assessors looking at the same programme reach comparable conclusions.

Maturity-level thinking also appears elsewhere in the series (for example asset-owner programmes in Part 2-1 and secure-development programmes in Part 4-1). Use each part’s own tables and criteria when scoring; do not assume the evidence list for one part transfers unchanged to another.

Reference: ISA/IEC TR/TS 62443-6-1 — Security evaluation methodology for IEC 62443-2-4
Related: IEC 62443-2-1 Maturity Levels | IEC 62443-2-1 Conformance and Assessment

Key takeaways

• ISA/IEC 62443-2-4 defines security-programme capabilities for integration and maintenance service providers; support means the capability can be provided to the asset owner on request.
• A service provider may be an external organisation or an internal department — the role is defined by the work performed, not by legal separation.
• Integration spans design to handover; maintenance begins after handover and is separate from operations.
• Requirements are grouped into twelve functional areas (SP.01–SP.12), from staffing and architecture through patching and backup/restore.
• TR/TS 62443-6-1 supplies objective evaluation criteria and ML 1–ML 4 evidence expectations so assessments are repeatable.

Standards reference

• ISA/IEC 62443-2-4 — Security program requirements for IACS service providers (primary).
• ISA/IEC TR/TS 62443-6-1 — Security evaluation methodology for IEC 62443-2-4.
• ISA/IEC 62443-2-1 — Security Program requirements for IACS asset owners.
• ISA/IEC TR 62443-2-3 — Patch management in the IACS environment (links to SP.11).
• ISA/IEC 62443-4-1 — Secure product development lifecycle for product suppliers.