CYBRARY Foundational requirements and security levels
The seven things IEC 62443 asks of every zone, and the four-step scale for saying how hard a zone must be to beat.
By the end you can
- List the seven foundational requirements and say what each is for.
- Explain what a target security level claims about the attacker it resists.
- Match a Forge activity to the requirement it produces evidence for.
Seven requirements, per zone
IEC 62443-3-3 asks the same seven questions of every zone. They are deliberately short — the detail lives in the requirement enhancements underneath each one.
| Requirement | What it asks |
|---|---|
| FR1 — Identification and authentication control | Every human, device and software process on the control network is identified. |
| FR2 — Use control | Identified users and devices may only do what their role permits, and it is logged. |
| FR3 — System integrity | Control logic, firmware and process data are not altered without being noticed. |
| FR4 — Data confidentiality | Recipes, batch records and process data stay inside the zone that owns them. |
| FR5 — Restricted data flow | Zones are segmented and traffic crosses only through declared conduits. |
| FR6 — Timely response to events | The plant notices a security event and responds without losing the process. |
| FR7 — Resource availability | Control keeps running — availability outranks a clean IT containment. |
Security levels are about the opponent
A security level is not a score out of four. It names the kind of attacker the zone is meant to hold against — casual mistake, someone with simple means, someone with specific skills and motivation, or a resourced group.
Each zone gets a target level, the design is assessed against it, and the gap is a work plan.
| Level | What it claims |
|---|---|
| SL0 — No specific requirement | Nothing is expected of this zone. |
| SL1 — Casual or coincidental | Protection against accidental misuse. |
| SL2 — Intentional, simple means | A low-skill attacker with generic tools and low motivation. |
| SL3 — Intentional, sophisticated means | An attacker with ICS-specific skills, tools and moderate resources. |
| SL4 — Intentional, extended resources | A well-resourced actor with ICS-specific skills and sustained motivation. |
Where the evidence comes from
Forge cannot certify anything, and does not claim to. What it can do is produce the artifacts an assessor asks to see: an alert that fired from real log records, a timeline of what the attacker did, and a case record with the decision written in it.
Check yourself
What does a target security level of SL3 on a zone say?
Which requirement covers 'control logic and firmware are not changed without being noticed'?