IEC 62443-3-3 FR and SL Vector | Automation Engineering Body of Knowledge

Instead of compressing a zone or control system into a single Security Level number, ISA/IEC 62443 can express a vector of seven values — one Security Level per Foundational Requirement (FR). Annex A of Part 3-3 discusses this vector approach; risk-assessment practice in Part 3-2 (Clause A.3.1 themes) uses the same idea when setting targets.

Teaching note: This page paraphrases vector notation and examples for learning. SL type definitions (SL-T / SL-A / SL-C) and the 0–4 adversary model are covered on Security Levels. Normative FR requirements are on the FR pages; packing lists for SL claims are on Annex B.

Why a vector?

Different FRs can legitimately need different strengths in the same zone. A BPCS area may demand strong restricted data flow and integrity while accepting a lower confidentiality target if little sensitive data leaves that zone. The vector keeps those differences visible instead of forcing a single “the zone is SL-3” slogan.

Notation

SL-?(domain) = { IAC , UC , SI , DC , RDF , TRE , RA }

SL-? — type: typically SL-T (target), SL-C (capability) or SL-A (achieved).
domain — zone, conduit, control system, subsystem or component name.
Optional FR tag when quoting only one element, for example SL-C(RA, FS-PLC) = 4.

Teaching examples (values illustrative of the style used in Annex A):

SL-T(BPCS Zone) = { 2, 2, 0, 1, 3, 1, 3 }
SL-C(SIS Engineering Workstation) = { 3, 3, 2, 3, 0, 0, 1 }

Worked radar example (BPCS zone)

The chart compares three vectors on the same seven FR axes (0 at centre → 4 at the rim):

FR and SL Vector radar chart for an example BPCS Zone — Figure – Example FR and SL Vector for a BPCS zone. Green = SL-T, blue = SL-C, red = SL-A. Training materials cite ANSI/ISA 62443-3-2, Clause A.3.1 for this style of example.

Vector	IAC	UC	SI	DC	RDF	TRE	RA
SL-T (target)	3	3	4	2	4	3	4
SL-C (capability)	2	2	3	1	2	1	2
SL-A (achieved)	0	1	0	1	1	0	1

Green is the risk-derived target; blue is what the current design/products can support; red is what is measured in place. Gaps drive compensating countermeasures, redesign or procurement — not a claim that the zone as a whole “is SL-3”.

Use with caution

Vector methods draw on quantitative assurance ideas, but cyber risk judgments remain largely qualitative and expert-driven.
Align vector values with the asset owner’s risk matrix and risk appetite.
Treat plots as decision support, not false precision.

Key takeaways

Seven FR axes → one SL each → the FR / SL Vector.
SL-T, SL-C and SL-A can be plotted together to show target–capability–achieved gaps.
Build each FR element using SRs/REs — Annex B.