IEC 62443-3-3 Clause 4 – Common Control System Security Constraints

ISA/IEC 62443-3-3, Clause 4 defines common control system security constraints that apply to the control system as a whole. They are not Security Level–dependent: they support integrity and availability of the IACS for every asset before you select Foundational Requirement (FR) system requirements (SRs) and requirement enhancements (REs).

Detailed Design in Part 3-3 starts here. After these constraints, Clauses 5–11 define the seven FRs and their SRs/REs. Component-level parallels (CCSC) live in Part 4-2 Clause 4.

Teaching note: Summaries paraphrase ISA/IEC 62443-3-3 for learning — always refer to the published text for normative wording. Examples below reflect common training illustrations (e.g. essential-function lockout, procedural compensating controls).

Constraints in Clause 4

Support of essential functions — safety before security
Compensating countermeasures — when the system or component cannot meet an SR alone
Least privilege — minimum rights with enough access to do the job

Support of essential functions

Security measures must not interfere with measures that protect health, safety and the environment. If security and safety requirements conflict, safety takes precedence (“safety trumps security”).

Teaching example: an account used for essential operations must not be locked out after unsuccessful login attempts if that would leave an operator unable to control a safety-critical process. Account lockout policies that are normal for IT must be designed so essential functions remain available.

Compensating countermeasures

If the control system, an asset or a component cannot perform a security requirement itself, a compensating countermeasure may be used so the requirement is still met in the Automation Solution. Compensating measures can be technical (external devices), physical security, procedures, background checks or other external resources.

Teaching example: a SCADA system that cannot provide strong enough user identification for changes to critical parameters may rely on a procedure that requires additional human oversight. Document compensating measures in the design package and CRS so operators and auditors know what fills the gap.

Product suppliers document component-level compensating expectations under Part 4-2 CCSC 2. Legacy or uncertified products often need a one-time self-assessment of which SRs they meet and which need compensating controls — then reuse that assessment.

Least privilege

People, processes and devices should hold only the minimum privileges needed to do their job — but enough privileges so the job can still be done. Implement least privilege with granular, specific roles; when assigning people and processes to roles, consider individual accountability.

Least privilege under Clause 4 frames how FR 1 (identification) and FR 2 (use control) should be designed together, and how Part 4-2 components expose role and permission granularity (CCSC 3).

Key takeaways

Clause 4 constraints are SL-independent and apply before FR SR/RE selection.
Essential functions and safety take precedence over security controls that would disable them.
Compensating countermeasures are valid when documented and effective in the integrated system.
Least privilege uses roles with enough — but not excess — rights and accountability.