← Home

IEC 62443-3-2 Clause 4.8 – Asset Owner Approval

ISA/IEC 62443-3-2:2020, Clause 4.8 covers asset owner approval as zone and conduit requirement ZCR 7.

ZCR 7 closes the Clause 4 loop. Facilitators, SMEs and third parties can run workshops and draft risk results, but they usually cannot formally accept risk on behalf of the plant. Accountable management must review and approve the assessment outcome.

Teaching note: The summaries below paraphrase ISA/IEC 62443-3-2:2020 for learning purposes. They are not a verbatim extract of the standard — always refer to the published text for normative wording and assessment.

Reference: ISA/IEC 62443-3-2:2020, Clause 4.8
Related: Zone, Conduit and Risk Assessment (Clause 4) | ZCR 5 – Detailed Risk Assessment | ZCR 6 – Document Requirements | IEC 62443-2-1 Security Program (2024)

ZCR pages: ZCR 1 | ZCR 2 | ZCR 3 | ZCR 4 | ZCR 5 | ZCR 6 | ZCR 7

Requirements in this ZCR

ZCR 7 – Asset owner approval

Reference: ISA/IEC 62443-3-2, Clause 4.8

ZCR 7.1: Attain asset owner approval

Clause: 4.8.2

Summary
Asset-owner management accountable for the safety, integrity and reliability of the process controlled by the SUC shall review and approve the results of the risk assessment.

Workshops typically draw on people who know the process and the IACS deeply. Decision authority to live with residual risk usually sits higher. Presenting SL-T, residual risk and proposed countermeasures to those accountable managers makes risk acceptance an explicit management act — not an implied workshop consensus.

Key Takeaways