Development of industrial cyber security standards: IEC 62443 for scada and industrial control system security
Abstract
This paper examines the development of standards for Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition) SCADA security. Good practice and standards are reviewed, with a discussion on their future direction.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Implementing the MITRE ATT&CK framework is fully justified at the threat intelligence level, as the comprehensive matrix includes different techniques and tactics used by cybersecurity assessment teams.
“Implementing the MITRE ATT&CK framework [41] is fully justified at this level, as the comprehensive matrix includes different techniques and tactics used by cybersecurity assessment teams.”
From Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap (2021) · cites this paper as [41]
Cited by
Sorted by citations
The evolution and future of manufacturing: A review
Esmaeilian, B., Behdad, S., & Wang, B. (2016) · Journal of Manufacturing Systems · doi:10.1016/j.jmsy.2016.03.001 · Cited by 691 · see citing works
Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap
Dhirani, L. L., Armstrong, E., & Newe, T. (2021) · Sensors · doi:10.3390/s21113901 · Cited by 172 · see citing works
“Authors in [50] point out limitations in existing standards, whereas [5,15,74] underline IT/OT convergence and interoperability issues [28,41].”
BackgroundMethodInfluentialAshraf, S., Shawon, M. H., Khalid, H. M., & Muyeen, S. M. (2021) · Sensors · doi:10.3390/s21196415 · Cited by 89 · see citing works
“There have been several additional standards proposed and developed by IEC such as: (1) IEC 62351 standards for the power system information infrastructure [9] and (2) IEC 62443 standards for SCADA systems and industrial control systems security [10,11].”
Review on cyber vulnerabilities of communication protocols in industrial control systems
Xu, Y., Yang, Y., Li, T., Ju, J., & Wang, Q. (2017) · IEEE Conference on Energy Internet and Energy System Integration (EI2) · doi:10.1109/ei2.2017.8245509 · Cited by 90 · see citing works
Sheikh, Z. A., Singh, Y., Singh, P. K., & Ghafoor, K. Z. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.07.007 · Cited by 49 · see citing works
Lv, W., Xiong, J., Shi, J., et al. (2020) · Journal of Intelligent Manufacturing · doi:10.1007/s10845-020-01584-z · Cited by 48 · see citing works
“In manufacturing, there are many safety-critical control systems, and ensuring their safety based on IEC 61508 (Bell et al. 2006) and security based on IEC 62442 (Piggin et al. 2013) has been an important issue in industry and academia.”
BackgroundWhen Operation Technology Meets Information Technology: Challenges and Opportunities
Berardi, D., Callegati, F., Giovine, A., Melis, A., Prandini, M., & Rinieri, L. (2023) · Future Internet · doi:10.3390/fi15030095 · Cited by 42 · see citing works
“Standardization efforts [13] are still fighting their way toward a more systematic and uniform approach to basic cyber-security features in manufacturing connected systems.”
BackgroundStandardization: A Key Factor of Industry 4.0
Villagrán, N. V., Estévez, E., Pesado, P. M., & Márquez, J. J. (2019) · International Conference on eDemocracy & eGovernment · doi:10.1109/icedeg.2019.8734339 · Cited by 33 · see citing works
“0 and in the industrial networks that require reliability, flexibility, and capacity for the interconnection of all the components of the plant and their interconnection with the management systems of the company with the IEC standard TC 65: Measurement, control and automation of industrial processes and IEC 61158: In…”
BackgroundSeeking the Relation Between Performance and Security in Modern Systems: Metrics and Measures
Fujdiak, R., Mlýnek, P., Blažek, P., et al. (2018) · International Conference on Telecommunications and Signal Processing (TSP) · doi:10.1109/tsp.2018.8441496 · Cited by 29 · see citing works
“Therefore, the IEC 62443 was created as a product of collaboration with an international impact [25].”
BackgroundCombining Safety and Security Analysis for Industrial Collaborative Automation Systems
Plósz, S., Schmittner, C., & Varga, P. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66284-8_16 · Cited by 24 · see citing works
LiDiTE: A Full-Fledged and Featherweight Digital Twin Framework
Russo, E., Costa, G., Longo, G., Armando, A., & Merlo, A. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3236798 · Cited by 20 · see citing works
“3 follows a recurrent ICS network architecture featuring the segmentation model proposed in the ISA/IEC 62443 standard [20].”
BackgroundAn Industrial Network Digital Twin for enhanced security of Cyber-Physical Systems
Grasselli, C., Melis, A., Rinieri, L., Berardi, D., Gori, G., & Sadi, A. A. (2022) · International Symposium on Networks, Computers and Communications (ISNCC) · doi:10.1109/isncc55209.2022.9851731 · Cited by 21 · see citing works
Wang, J., Zhu, M. F., Li, M., Sun, Y., & Tian, Z. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3285992 · Cited by 20 · see citing works
“R ELATED W ORKS IEC62443 [5] defined the security of the industrial con-trol network, including security protection against unauthorized access to system resources, unauthorized or accidental changes, destruction, or loss.”
BackgroundMethodA Host Intrusion Detection System architecture for embedded industrial devices
Martínez, C. V., & Vogel‐Heuser, B. (2019) · Journal of the Franklin Institute · doi:10.1016/j.jfranklin.2019.03.037 · Cited by 19 · see citing works
Smart Behavioural Filter for Industrial Internet of Things
Corbò, G., Foglietta, C., Palazzo, C., & Panzieri, S. (2017) · Mobile Networks and Applications · doi:10.1007/s11036-017-0882-1 · Cited by 15 · see citing works
“Network segmentation following IEC 62443 [13] is the best practice for SCADA system security and takes advantage of SCADA-aware firewalls and multiple layers of defence, the so-called Defence in Depth approach.”
MethodInfluentialAsset Management Method of Industrial IoT Systems for Cyber-Security Countermeasures
Matsumoto, N., Fujita, J., Endoh, H., Yamada, T., Sawada, K., & Kaneko, O. (2021) · Information · doi:10.3390/info12110460 · Cited by 13 · see citing works
“It is also unacceptable for security updates to cause system malfunctions [4,5].”
BackgroundA Security-Aware Framework for Designing Industrial Engineering Processes
Dedousis, P., Stergiopoulos, G., Arampatzis, G., & Gritzalis, D. A. (2021) · IEEE Access · doi:10.1109/access.2021.3134759 · Cited by 13 · see citing works
“The concept to perform a security risk assessment and management is similar to what is outlined in the ISO 27000 family [29].”
MethodJohnsen, S. O. (2012) · Information Management & Computer Security · doi:10.1108/09685221211235607 · Cited by 11 · see citing works
Robles-Durazno, A., Moradpoor, N., McWhinnie, J., & Russell, G. (2019) · International Conference on Control and Automation · doi:10.1109/icca.2019.8899564 · Cited by 10 · see citing works
“The evolution of technology and computing capabilities allowed control equipment such as the Programmable Logic Controller (PLC) to adopt network features with poor or no security measures [3] [4].”
MethodMartínez, C. V., & Vogel‐Heuser, B. (2018) · Applied Sciences · doi:10.3390/app8122460 · Cited by 11 · see citing works
“It also provides compliance with the ISA/IEC 62443 series of Standards (i.e., R2), by enabling the execution of mitigation strategies suggested by these Standards.”
BackgroundInfluentialSafety Versus Security in Aviation, Comparing DO-178C with Security Standards
Torens, C. (2020) · AIAA SciTech Forum · doi:10.2514/6.2020-0242 · Cited by 10 · see citing works
“An analysis of cybersecurity standards is done in [14].”
MethodTowards Modeling Attacker’s Opportunity for Improving Cyber Resilience in Energy Delivery Systems
Ullah, S., Shetty, S. S., & Hassanzadeh, A. (2018) · Resilience Week (RWS) · doi:10.1109/rweek.2018.8473511 · Cited by 9 · see citing works
“To tackle this problem, Industrial Control System (ICS) network architecture must be compliant with ISA99/IEC 62443 reference architecture [3] [4].”
BackgroundResearch on Safe Communication Architecture for Real-Time Ethernet Distributed Control System
Huang, Z., Jiang, X., Chen, L., et al. (2019) · IEEE Access · doi:10.1109/access.2019.2926650 · Cited by 9 · see citing works
“THE SYSTEM DESIGN COMBINING SESAMO METHOD AND FORMALIZED MODELING Based on IEC61508 [21], [22], ISO26262 [23], [24] and IEC62443 [25], [26] standards, SESAMO method could be used to design the safe architecture of network embedded system for functional security and information security.”
MethodSecuring critical infrastructure
Schukat, M. (2014) · doi:10.1109/dt.2014.6868731 · Cited by 8 · see citing works
“ ISA/IEC-62443 is a series of standards [8] that define procedures for implementing electronically secure industrial automation and control systems.”
BackgroundSelf-Adaptation Applied to MQTT via a Generic Autonomic Management Framework
Maksuti, S., Schluga, O., Settanni, G., et al. (2019) · IEEE International Conference on Industrial Technology (ICIT) · doi:10.1109/icit.2019.8754937 · Cited by 7 · see citing works
“to ensure guaranteed network performance, whilst security measures, such as encryption, defined in industrial security standards [20], [21] have to be considered to ensure secure data transmission.”
BackgroundA technique for bytecode decompilation of PLC program
Lv, X., Xie, Y., Zhu, X., & Ren, L. Q. (2017) · IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC) · doi:10.1109/iaeac.2017.8054016 · Cited by 8 · see citing works
Encryption-Aware Anomaly Detection in Power Grid Communication Networks
Sen, Ö., Gurabi, M. A., Deruelle, M., et al. (2024) · IEEE PES Innovative Smart Grid Technologies Europe · doi:10.1109/isgteurope62998.2024.10863032 · Cited by 6 · see citing works
“Ensuring cybersecurity in power systems is an ongoing process, focusing on prevention, detection, and response, guided by standards such as IEC 62351 [3] and IEC 62443 [4].”
Lykou, G., Anagnostopoulou, A., Stergiopoulos, G., et al. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05849-4_10 · Cited by 5 · see citing works
Enhancing Industrial Cyber-Physical Systems Security with Smart Probing Approach
Bonagura, V., Foglietta, C., Panzieri, S., & Pascucci, F. (2023) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr57506.2023.10224912 · Cited by 3 · see citing works
“Due to this, only firewalls and Intrusion Detection Systems (IDSs), in accordance with the IEC 62443 standard [9], [10], are recommended for use in industrial networks to protect against cyberattacks.”
ResultIdentification of Information Technology Security Issues Specific to Industrial Control Systems
Rogowski, D. (2018) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-91446-6_37 · Cited by 1 · see citing works
Remote and Agile Improvement of Industrial Control and Safety Systems Processes
Myklebust, T., Lundteigen, M. A., Bodsberg, L., & Hanssen, G. K. (2020) · European Safety and Reliability Conference (ESREL) · doi:10.3850/978-981-14-8593-0_4201-cd · Cited by 1 · see citing works
Side Benefits of Cybersecurity Measures an Empirical Study
Saulaiman, M. N.-E., Kozlovszky, M., & Csilling, Á. (2023) · IEEE International Symposium on Intelligent Systems and Informatics (SISY) · doi:10.1109/sisy60376.2023.10417952 · Cited by 1 · see citing works
Transformation from DMS to ADMS in Power Distribution Utilities: Challenges and Lessons Learned
Alseiari, M., Tawfeek, A., Ahmad, O. A., et al. (2024) · IEEE International Conference on High Voltage Engineering and Application (ICHVE) · doi:10.1109/ichve61955.2024.10676228 · Cited by 1 · see citing works
“The best practice here is to ensure to add the requirement of the compliance of the system to one of the ICS standard, a few to mention here is NIST, IEC62443/ISA99, NESA, …etc in the SOW , this can be affected by the compliance requirement of the firm depending on its cyber security policy [7].”
BackgroundSafety and Security in SCADA Systems Must be Improved through Resilience Based Risk Management
Johnsen, S. O. (2012) · IGI Global eBooks · doi:10.4018/978-1-4666-2659-1.ch012 · Cited by 1 · see citing works
A Formal Method for Verifying the Ability of a Protocol to Resist Replay Attacks
Shi, R.-M., Zhang, Y., Zhang, Y., et al. (2020) · Lecture notes in electrical engineering · doi:10.1007/978-981-15-1876-8_25 · Cited by 1 · see citing works
Automation Security Risk Assessment
Runde, M., Speth, W., Steffen, T., et al. (2016) · atp magazin · doi:10.17560/atp.v58i01-02.551
Co-Engineering Gap Analysis of ANSI/ISA‑62443‑3‑3
Mlýnek, P., Fujdiak, R., Mrnustik, P., et al. (2020) · International Journal of Advances in Telecommunications Electrotechnics Signals and Systems · doi:10.11601/ijates.v9i1.285
A Fine-Grained Access Control Method for Control Instructions of the Industrial Control Network
Wang, J., Zhu, M., Zhang, K., et al. (2025) · Actuators · doi:10.3390/act15010005
- Authors
- Piggin, R. S. H.
- Affiliations
- AtkinsRéalis (United Kingdom) (GB)
- Corresponding author
- Piggin, R.S.H.
- ORCID
- Piggin, R.S.H.
- Venue
- IET Conference on Control and Automation 2013: Uniting Problems and Solutions
- Published
- 2013
- Pages
- 11-11
- OpenAlex
- W2002212813
- Cited by
- 38
- References
- 0
- Citations by year
- 2025: 1 · 2024: 2 · 2023: 5 · 2022: 2 · 2021: 4 · 2020: 5 · 2019: 5 · 2018: 5 · 2017: 4 · 2016: 2 · 2014: 1 · 2012: 2
- FWCI
- 1.37
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IET Conference on Control and Automation: Uniting Problems and Solutions (publishedVersion)
- Funders
- U.S. Department of Homeland Security
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Keywords
- IEC 62443, industrial cybersecurity, industrial control systems, SCADA security, cybersecurity standards, standards development, best practices
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
