← Home

IEC 62443-3-3 – Using SL-T to Select SRs and REs

Part 3-2 risk assessment sets a Target Security Level (SL-T) for each zone or conduit — as a single number or as a seven-element FR vector. Part 3-3 Annex B then shows which system requirements (SRs) and requirement enhancements (REs) you must implement for that SL on each Foundational Requirement (FR). That mapping is the bridge from assessment into Detailed Design.

Teaching note: Paraphrased for learning from ISA/IEC 62443-3-3 Annex B and related course material. Always verify checkmarks and normative RE wording against the published standard.

Related: Annex B mapping | Clause 4 constraints | Foundational Requirements | Security Levels | ZCR 5.6 – Determine SL-T | CRS

Steps

  1. Start from Clause 4 — Apply common control system constraints (essential functions, compensating measures, least privilege) before packing SRs.
  2. Read SL-T for the zone or conduit — Single SL means the same level on every FR; a vector sets a level per FR (IAC, UC, SI, DC, RDF, TRE, RA).
  3. Open Annex B for each FR — For the target SL column, collect every base SR and RE marked required at that level (and below). See Annex B.
  4. Read requirement intent on the FR page — FR pages summarise each SR and nest REs under their parent SR (e.g. FR 1).
  5. Select products / compensating controls — Prefer components whose Part 4-2 SL-C covers the needed CRs; document compensating measures where capability falls short (Clause 4).
  6. Record in the CRS / design package — Carry selected SRs/REs and compensations into requirements and architecture documents.

Worked example — FR 1 at SL-T = 3

Suppose risk assessment sets SL-T = 3 for Foundational Requirement 1 (IAC) for a zone (either as part of a vector or as a uniform SL 3). Using Annex B for FR 1, you must implement at least:

plus every other FR 1 base SR/RE that Annex B marks for SL 3 (for example SR 1.2 base and RE(1), SR 1.3 RE(1), and so on — read the full FR 1 table). You do not yet need SR 1.1 RE(3) (multifactor for all networks), which Annex B places at SL 4.

Full packing list: Annex B – FR 1. Requirement intent: SR 1.1 and its REs.

Single SL vs vector

A single SL-T applies the same Annex B column to every FR. A vector lets the asset owner raise protection on high-risk FRs (for example IAC and RDF at SL 3) while leaving others lower where risk allows. Either way, selection is still “read the SL column → implement marked SRs/REs.”

Key takeaways