IEC IEC PAS 62443-1-6 Edition 1.02025-12 PUBLICLYAVAILABLE SPECIFICATION Security for industrial automation and control systems : Part 1-6: Application of the 62443 series to the Industrial Internet of Things (lloT) IEC PAS 62443-1-6:2025-12(en) ICS25.040.40 ISBN 978-2-8327-0905-4 THIS PUBLICATION IS COPYRIGHT PROTECTED Copyright @ 2025 IEC, Geneva, Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or IEc or IEC's member National Committee in the country of the requester. If you have any questions about IEc copyright IECmemberNational Committeeforfurtherinformation. IEC Secretariat Tel.: +41 22 919 02 11 3, rue de Varembé [email protected] CH-1211Geneva20 www.iec.ch Switzerland About the IEC The International Electrotechnical Commission (lEC)is the leading global organization that prepares and publishes International Standards forall electrical, electronic and related technologies. AboutIECpublications The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the latestedition,acorrigendumoranamendmentmighthavebeenpublished IEC publicationssearch- IECProducts&ServicesPortal-products.iec.ch webstore.iec.ch/advsearchform Discover our powerful search engine and read freely all the The advanced search enables to find IEC publications by a publications previews,graphical symbols and the glossary variety of criteria (reference number, text, technical With a subscription you will always have access to up to date committee, ...). It also gives information on projects, content tailored to your needs. replaced and withdrawn publications. Electropedia - www.electropedia.org IEc Just Published - webstore.iec.ch/justpublished The world's leading online dictionary on electrotechnology, Stay up to date on all new IEC publications. Just Published containing more than 22 500 terminological entries in English details all new publications released. Available online and and French, with equivalent terms in 25 additional languages. once a month by email Also known as the International Electrotechnical Vocabulary (IEV) online. IEC Customer Service Centre - webstore.iec.ch/csc If you wish to give us your feedback on this publication or need further assistance,please contact the Customer ServiceCentre:[email protected]. Warning! Make sure that you obtained this publication from an authorized distributor. IECPAS62443-1-6:2025@IEC2025 CONTENTS FOREWORD INTRODUCTION. 5 1 Scope.. 6 2 Normative references .... 3 Terms, definitions, abbreviated terms and acronyms 3.1 Terms and definitions 3.2 Abbreviated terms and acronyms... 4 From current functional models to the future. 4.1 General. 9 4.2 Traditional model representation of functional capability architecture 4.3 Challenges of IloT within functional model . 4.3.1 General. 10 4.3.2 Hybrid industrial-business systems. 4.3.3 Zero trust architecture.. 12 4.4 Example of functional model with lloT integrated 13 5 Principal roles and how they interact in IloT 14 6 Integrating IloT into the asset owner's security program . ..17 6.1 Overview. 6.2 Recommendations 17 6.2.1 Risk to IACS ... 17 6.2.2 Training for personnel. 17 6.2.3 Impactonbusinesscontinuity.... 17 6.2.4 Security policies and procedures. 18 6.2.5 Policies and procedures for physical security and physical assets. 6.2.6 Policies and activities around IloT ... .18 6.2.7 Authentication strategy.... ..18 6.2.8 Authorization policies and procedures .. .18 6.2.9 Security program maintenance .. 6.2.10 Information and document management , 19 6.2.11 Incident planning and response 19 6.2.12 Defense-in-depth strategy 19 6.2.13 Conformance with the IEC 62443 series 7 Risk assessments of lloT .20 7.1 Overview 7.2 Recommendations ... 7.2.1 Identify the SuC... ....20 7.2.2 Cybersecurity risk assessment . ...20 7.2.3 Target security levels .... ..20 7.2.4 Logical or physical separation ... .21 7.2.5 Implications for safety-related zones .