ISA/IEC 62443-4-2, Annex A (informative) gives representative examples of devices in each component category used by the standard. The lists are illustrations, not exhaustive catalogs — products that behave like these examples are typically assessed under the matching CR / SAR / EDR / HDR / NDR mapping.
Reference: ISA/IEC 62443-4-2, Annex A
Related:
Part 4-2 overview
|
Clause 13 – Embedded
|
Clause 14 – Host
|
Clause 15 – Network
|
Clause 12 – Software application
| Category | Requirement prefix | Typical examples (Annex A themes) |
|---|---|---|
| Software application | SAR | SCADA applications, data historians (application layer) |
| Embedded device | EDR | PLC, IED, smart sensors/actuators with control logic |
| Host device | HDR | Operator workstations, engineering stations, historian servers |
| Network device | NDR | Switches, VPN terminators, industrial routers/firewalls |
PLCs typically sit on lower Purdue levels, use ruggedised hardware and real-time operating systems, and execute control logic driven by process inputs and actuator outputs. Engineering software on host devices programs them (often IEC 61131-3). Modern PLCs use Ethernet/TCP-IP upward and fieldbuses toward instrumentation. Safety PLCs demand hard real-time behaviour with high integrity and availability.
IEDs are conceptually similar to PLCs but are the common term in power / substation automation. They measure power equipment, run control or protection logic, and command switches and breakers. Local HMIs are common; substations may need isolated operation. Integrity, availability and hard real-time expectations are typically high (IEC 61850 context often applies).
Switches link network segments or nodes, typically at OSI Layer 2. Managed industrial switches expose configuration and network-management interfaces (web, file transfer, CLI/SSH, SNMP) and may forward logs/events — those management paths are part of the security surface.
VPN terminators build encrypted tunnels so private networks can traverse public links transparently. They encapsulate/decapsulate traffic at network borders (or via client software for roaming users). Tunnel establishment needs authentication; roaming scenarios can raise privacy and location-tracking considerations.
Operator stations display process data and accept operator commands (setpoints, device actions). A minimum set often must stay available continuously. They usually talk to control or connectivity servers (sometimes directly to PLCs) over Ethernet/TCP-IP, run on COTS PC hardware/OS, and need high integrity and availability even when hard real-time is not required.
Historians collect long-term process data from servers or PLCs for optimisation, performance and regulatory reporting. Built from COTS hardware, OS and databases; availability/integrity needs depend on business and regulatory criticality, usually without hard real-time constraints.