← Home

IEC 62443-4-1 Clause 7 – Secure by Design

ISA/IEC 62443-4-1:2018, Clause 7 defines Practice 3 – Secure by design (SD) in the Product Supplier’s secure product development lifecycle.

Secure by design pushes security decisions into architecture early, using defence-in-depth so a single weak layer does not leave the product exposed.

Teaching note: Summaries paraphrase ISA/IEC 62443-4-1:2018 for learning. They are not verbatim extracts — always use the published standard for normative wording and assessment.

Reference: ISA/IEC 62443-4-1:2018, Clause 7
Related: Product Security Lifecycle overview | IEC 62443-4-2 Technical Requirements

Practice pages: SM | SR | SD | SI | SVV | DM | SUM | SG

Requirements in this practice

SD requirement summaries

SD-1: Secure design principles

Clause: 7.2

Summary
A process must be employed for developing and documenting a secure design that identifies and characterizes each interface of the product, including physical and logical interfaces, to include: an indication of whether the interface is externally accessible (by other products), or internally accessible (by other components of the product), or both; security implications of the product security context (see Clause 6,…

SD-2: Defense in depth design

Clause: 7.3

Summary
A process must be employed to implement multiple layers of defense using a risk based approach based on the threat model. This process must be employed for assigning responsibilities to each layer of defense. 4 Under preparation.

SD-3: Security design review

Clause: 7.4

Summary
A process must be employed for conducting design reviews to identify, characterize and track to closure security-related issues associated with each significant revision of the secure design including but not limited to: security requirements (see Clause 6, Practice 2 - Specification of security requirements) that were not adequately addressed by the design;

SD-4: Secure design best practices

Clause: 7.5

Summary
A process must be employed to ensure that secure design best practices are documented and applied to the design process. These practices must be periodically reviewed and updated.

Key takeaways