| Risk Assessment and Safety Function Definition |
Identify machine hazards, hazardous events, operating modes, and required risk-reduction measures before purchasing or integrating automation equipment. |
ISO 13849-1
IEC 61508 |
Document each safety function, its initiating event, safe state, required response time, and target performance level or safety integrity level. |
Approved risk assessment, safety requirement specification, operating-mode analysis, and traceability matrix. |
100% of safety functions linked to a documented hazard and validated requirement. |
Critical |
| Safety Integrity and Performance Level Verification |
Require the supplier to demonstrate that safety-related control systems achieve the specified PL or SIL for each applicable safety function. |
ISO 13849-1
IEC 61508 |
Evaluate architecture, diagnostic coverage, component reliability data, common-cause failure controls, and systematic capability. |
PL or SIL calculation, safety manual, reliability assumptions, architecture diagram, and independent verification record. |
Every applicable safety function meets or exceeds its specified PLr or SIL target. |
Critical |
| Safety Function Validation |
Confirm that implemented safety functions operate correctly under normal, abnormal, fault, restart, and maintenance conditions. |
ISO 13849-2
IEC 61508 |
Perform documented validation tests, including emergency stop, guard interlock, enabling device, safe speed, and controlled stop functions where applicable. |
Validation plan, test results, fault-injection records, safety circuit inspection, and signed acceptance report. |
100% of safety functions pass validation before production release and after safety-related changes. |
Critical |
| Functional Safety Lifecycle Management |
Maintain safety requirements, design decisions, testing, modification control, and decommissioning activities throughout the automation lifecycle. |
IEC 61508 |
Use formal management of functional safety with assigned roles, competence requirements, lifecycle gates, and change-impact assessments. |
Functional safety management plan, competence records, lifecycle review minutes, and change approvals. |
All safety-related changes receive documented impact analysis and revalidation before release. |
High |
| Safety-Related Software Development |
Control the design, implementation, verification, and versioning of software that can affect a safety function. |
IEC 61508
ISO 13849-1 |
Apply documented coding, configuration, review, testing, access control, and version-management practices appropriate to the safety integrity target. |
Software safety plan, source-code or logic review records, test coverage report, approved versions, and configuration baseline. |
100% of deployed safety logic is traceable to an approved version and test record. |
Critical |
| Asset Inventory and System Boundary Definition |
Maintain an accurate inventory of controllers, safety devices, engineering workstations, network equipment, remote-access paths, and software dependencies. |
IEC 62443-2-1
IEC 62443-3-2 |
Define automation zones and conduits, record asset ownership and criticality, and identify connections between OT, IT, safety, and external networks. |
Asset register, network topology, data-flow diagram, zone-and-conduit model, and criticality classification. |
At least 98% of discovered OT assets reconciled with the approved inventory; all external connections documented. |
Critical |
| Network Segmentation and Secure Architecture |
Prevent unauthorized movement between enterprise systems, industrial control networks, safety systems, and vendor-access environments. |
IEC 62443-3-2
IEC 62443-3-3 |
Implement documented zones and conduits, deny-by-default firewall rules, controlled data flows, and separation of safety-related networks where risk requires it. |
Approved architecture, firewall rule review, segmentation test results, and exception register. |
100% of permitted cross-zone traffic has an owner, business purpose, and periodic review date. |
Critical |
| Identity, Authentication, and Least Privilege |
Ensure that only authorized and appropriately trained personnel can access automation and safety-related systems. |
IEC 62443-3-3
IEC 62443-2-1 |
Use unique accounts, role-based access, strong authentication for remote or privileged access, controlled shared accounts, and timely access removal. |
Access-control matrix, user review records, authentication configuration, joiner-mover-leaver records, and privileged-session logs. |
100% of privileged accounts reviewed at least quarterly; terminated-user access removed within one business day. |
Critical |
| Secure Remote Access |
Allow remote support only when necessary, authorized, time-limited, monitored, and technically restricted to approved assets. |
IEC 62443-3-3
IEC 62443-2-1 |
Require documented approval, multi-factor authentication where feasible, jump-host access, session logging, least privilege, and automatic expiry. |
Remote-access procedure, approval tickets, session logs, vendor-account list, and periodic access review. |
100% of remote sessions have an approved ticket, named user, defined scope, and recorded start and end time. |
Critical |
| Vulnerability and Patch Management |
Reduce exposure to known vulnerabilities without compromising validated safety functions or production stability. |
IEC 62443-2-3
IEC 62443-3-3 |
Use risk-based vulnerability assessment, compensating controls for unsupported assets, maintenance-window testing, rollback plans, and documented patch exceptions. |
Vulnerability register, patch-impact assessment, test results, exception approvals, and remediation plan. |
Critical exploitable findings have an owner and treatment plan within 15 calendar days, unless an approved exception exists. |
High |
| Malware Protection and Removable Media Control |
Control software introduction and removable-media use on industrial workstations and controllers where technically feasible. |
IEC 62443-3-3
IEC 62443-2-1 |
Authorize media, scan files before use, restrict automatic execution, maintain offline scanning procedures, and document approved transfer methods. |
Removable-media policy, scan records, media register, endpoint configuration, and exception approvals. |
100% of removable-media events are logged and linked to an authorized user or work order. |
High |
| System Hardening and Secure Configuration |
Minimize unnecessary services, ports, accounts, protocols, and default settings on automation assets. |
IEC 62443-3-3
IEC 62443-2-1 |
Apply approved configuration baselines, disable unused services, change default credentials, restrict administrative interfaces, and protect configuration backups. |
Hardening checklist, baseline configuration, deviation report, configuration backup, and verification scan. |
All critical assets have an approved baseline; deviations are risk-assessed and time-bound. |
High |
| Security Monitoring and Event Detection |
Detect unauthorized access, abnormal network behavior, configuration changes, malware indicators, and safety-system events. |
IEC 62443-3-3
IEC 62443-2-1 |
Collect relevant logs, synchronize time, define alert thresholds, protect log integrity, and monitor high-value OT assets without disrupting deterministic operations. |
Logging standard, time-synchronization evidence, alert rules, monitoring coverage report, and sample investigation records. |
At least 95% of identified critical OT assets provide required security events to the monitoring process. |
High |
| Incident Response and Recovery |
Restore safe and reliable operation after cyber incidents, equipment failures, or unauthorized changes. |
IEC 62443-2-1
IEC 62443-3-3 |
Maintain OT-specific response playbooks, isolate affected zones, preserve evidence, define manual-safe-state procedures, and test recovery from clean backups. |
Incident-response plan, exercise report, recovery test, backup verification, and lessons-learned record. |
Recovery procedures tested at least annually and after major architecture changes; critical backups successfully restored. |
Critical |
| Backup, Restore, and Configuration Integrity |
Protect the availability and integrity of PLC logic, safety configurations, HMI projects, recipes, network settings, and engineering files. |
IEC 62443-3-3
IEC 61508 |
Maintain versioned, access-controlled, malware-checked, and offline or otherwise isolated backups, with documented restoration procedures. |
Backup schedule, hash or integrity records, access logs, retention policy, and restoration test report. |
100% of critical configurations have a current verified backup and documented restoration owner. |
Critical |
| Supplier Security and Component Lifecycle |
Require suppliers and integrators to provide security, safety, vulnerability, support, and end-of-life information for delivered systems. |
IEC 62443-2-4
IEC 61508 |
Include security and functional-safety requirements in procurement documents, define notification duties, require update guidance, and assess unsupported components. |
Contract clauses, supplier security questionnaire, product security documentation, lifecycle statement, and vulnerability-notification process. |
100% of high-criticality purchases include documented security and safety acceptance criteria before award. |
High |
| Personnel Competence and Operational Discipline |
Ensure engineering, maintenance, operations, and cybersecurity personnel are competent to perform assigned safety and OT security tasks. |
IEC 61508
IEC 62443-2-1 |
Define role-based training, authorization levels, refresher intervals, supervised work requirements, and escalation responsibilities. |
Training matrix, competency assessments, authorization records, drills, and refresher-training evidence. |
100% of personnel performing safety-related or privileged OT activities meet current competency requirements. |
High |
| Management of Change and Periodic Revalidation |
Prevent unassessed changes to hardware, software, network architecture, safety logic, or operating procedures from creating unacceptable risk. |
ISO 13849-1
IEC 61508
IEC 62443-2-1 |
Require change classification, safety and cybersecurity impact assessment, testing, approval, rollback planning, documentation updates, and post-change review. |
Change request, impact assessment, test evidence, approval record, updated drawings, and revalidation report. |
100% of safety- or security-relevant changes are approved and validated before operational use. |
Critical |
