← Home

IEC 62443-4-2 Annex B – Mapping of CRs and REs to FR SLs 1–4

ISA/IEC 62443-4-2, Annex B (informative) maps component requirements (CRs), category-specific requirements (SAR / EDR / HDR / NDR) and requirement enhancements (REs) to the Security Level columns for each Foundational Requirement — SL 1 through SL 4.

Use Annex B the same way Part 3-3 uses its SR/RE mapping: it shows which base requirements and enhancements must be in place to claim a given SL-C(FR, component). Exact tick marks live only in the published table — AEBOK pages summarise structure, not a substitute matrix.

Teaching note: Do not copy Annex B cells into contracts or certificates from secondary notes. Always verify against the published ISA/IEC 62443-4-2 Annex B table.

Reference: ISA/IEC 62443-4-2, Annex B
Related: Part 4-2 overview | IEC 62443-3-3 Annex B (system SR/RE mapping) | CR 1 · CR 2 · CR 3 · CR 4 · CR 5 · CR 6 · CR 7

How to read the mapping

Higher Security Levels typically require the base CR plus more REs (for example multifactor authentication, stronger cryptographic practices, or dual approval). Some rows apply only to certain component types — a network device may show an NDR where a software application shows a SAR.

Relationship to Part 3-3

Part 4-2 requirements are derived from the system requirements (SRs) and REs in ISA/IEC 62443-3-3. Annex B is the component-level counterpart of the Part 3-3 Annex B style mapping: same FR model and SL columns, expressed as what a component must be capable of when correctly implemented and configured.

Integrators still need Part 3-3 when assembling zones and claiming system SL-C / SL-A; suppliers use Part 4-2 Annex B when declaring component SL-C for a product family.

Worked teaching use

  1. Choose the FR of interest (for example IAC or SI).
  2. Decide the target SL-C for that FR on the component.
  3. In Annex B, collect every CR/RE marked for that SL column (including category-specific rows).
  4. Confirm compensating measures (CCSC 2) where a CR cannot be met inside the component alone.
  5. Confirm the product was developed under Part 4-1 (CCSC 4).

Key takeaways