IEC 62443-3-2 Clause 4 – Zone, Conduit and Risk Assessment Requirements

ISA/IEC 62443-3-2:2020 (ANSI/ISA-62443-3-2-2020) specifies how to define a system under consideration (SUC), partition it into zones and conduits, assess cybersecurity risk for each partition, set a target security level (SL-T), and capture the outcome in a cybersecurity requirements specification (CRS).

Clause 4 organises those engineering steps as zone and conduit requirements (ZCRs). The series does not offer a single “secure by recipe” design: every plant presents different threats, vulnerabilities and business tolerance for risk. Part 3-2 gives a consistent method so design decisions follow risk rather than guesswork.

Purpose and Scope

Part 3-2 sits in the “system” group of the ISA/IEC 62443 series. It tells asset owners, integrators, suppliers, service providers and compliance authorities what to produce when assessing risk for system design — not which firewall brand to buy.

In practice the outputs feed Part 3-3: each zone and conduit’s SL-T is aligned with the capability security levels (SL-C) that technical requirements are expected to deliver. Day-to-day organisational programme requirements live in Part 2-1; Part 3-2 is the design-time risk and zone/conduit method.

Zones and conduits themselves are introduced in Part 1-1. A zone groups assets that share common security needs; a conduit is the controlled communications path between zones (or within them). Every asset in an SUC belongs to a zone or a conduit.

What Clause 4 Requires

Clause 4 sets out seven ZCR groups that follow a workflow from scoping the SUC through to management approval. Flowcharts in the standard are informative — alternate sequences are acceptable if the requirements are still met.

ZCR	Title	In plain terms	Clause
ZCR 1	Identify the SUC	Draw a clear perimeter and list every way in.	4.2
ZCR 2	Initial cybersecurity risk assessment	Estimate worst-case unmitigated risk if the IACS is compromised.	4.3
ZCR 3	Partition into zones and conduits	Group assets by risk and best-practice separation rules.	4.4
ZCR 4	Risk comparison	Decide whether detailed assessment is needed against tolerable risk.	4.5
ZCR 5	Detailed cybersecurity risk assessment	Per zone/conduit: threats, vulnerabilities, SL-T, residual risk, controls.	4.6
ZCR 6	Document requirements, assumptions and constraints	Produce the CRS and the supporting zone/conduit record.	4.7
ZCR 7	Asset owner approval	Accountable management reviews and signs the risk outcome.	4.8

Recommended Workflow

A typical path (as outlined in the standard’s Clause 4 workflow) looks like this:

ZCR 1 — Define the SUC boundary and access points using inventories, architecture drawings and data flows.
ZCR 2 — Run (or refresh) an initial risk view of worst-case impact, drawing on PHAs, corporate risk matrices and threat intelligence where relevant.
ZCR 3 — Partition the SUC into zones and conduits, applying mandatory separations (business vs IACS, safety vs non-safety) and the recommended separations for temporary, wireless and externally connected devices.
ZCR 4 — Compare that initial risk with organisational tolerable risk. If risk is already tolerable, you may skip the detailed loop; if not, continue.
ZCR 5 — Perform a detailed assessment per zone or conduit (or grouped where similar), set SL-T, evaluate existing and additional countermeasures, and document residual risk.
ZCR 6 — Capture mandatory controls, assumptions and constraints in a CRS.
ZCR 7 — Obtain approval from asset-owner management accountable for process safety, integrity and reliability.

Design tip: Zone assignments can be refined after the detailed risk assessment. Initial partitioning is a starting model, not a permanently frozen drawing.

Key Outcomes

Initial risk — understanding of worst-case exposure if mission-critical IACS operations are disrupted.
Zone and conduit model — a defensible partition of the SUC with shared security expectations inside each zone.
SL-T per zone/conduit — the target protection level that subsequent design and Part 3-3 capabilities must meet.
Residual risk — risk remaining after existing and planned countermeasures, compared with tolerable risk.
CRS — the design requirements package that records what must be built, assumed and constrained.

Relationship to Other Parts

Part	Role relative to 3-2
1-1	Defines zone/conduit concepts and models used throughout the series.
2-1	Operational Security Program that keeps controls alive after design handover.
3-3	System security requirements and SL-C guidance aligned with SL-T from 3-2.
4-1 / 4-2	Product development lifecycle and component capability requirements that suppliers use when matching design needs.

Key Takeaways

Part 3-2 is the design-time method for scoping an SUC, building zones and conduits, assessing risk and setting SL-T.
Clause 4 packages the work as seven ZCR groups ending in accountable management approval and a CRS.
Detailed assessment is triggered when initial risk exceeds what the organisation is prepared to live with.
SL-T from 3-2 is the bridge into Part 3-3 technical requirements and capability levels.

References

ISA/IEC 62443-3-2:2020 — Security risk assessment for system design (ANSI/ISA-62443-3-2-2020), Clause 4.
ISA/IEC 62443-1-1 — Terminology, concepts and models (zones and conduits).
ISA/IEC 62443-3-3 — System security requirements and security levels.
ISA/IEC 62443-2-1 — Security Program requirements for asset owners.