In IEC 62443, SL-T is the target security level that a risk assessment sets for a zone or conduit. SL-C is the capability security level that a system or component can provide when properly configured. SL-A is the achieved security level actually measured in the design or the built system. All three are expressed per foundational requirement, and the aim is for SL-A to meet SL-T in every zone and conduit. What a security level is IEC 62443-3-2 defines a security level (SL) as a measure of confidence that the system under consideration (SUC), a zone or a conduit is free from vulnerabilities and functions as intended (IEC 62443-3-2:2020, 3.1.15). IEC TS 62443-1-1 adds a key point. A security level is a property of a zone or conduit, not of a device or any single part of a system (IEC TS 62443-1-1:2009, 5.11.1). The levels are defined by the type of threat they protect against (IEC 62443-3-3:2013, A.3.2; IEC 62443-3-2:2020, Annex A): SL 0: no specific requirements or security protection necessary SL 1: protection against casual or coincidental violation SL 2: protection against intentional violation using simple means with low resources, generic skills and low motivation SL 3: protection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation SL 4: protection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation IACS stands for industrial automation and control system. Note that IEC TS 62443-1-1:2009 recommended a minimum of three levels, described as low, medium and high (IEC TS 62443-1-1:2009, 5.11.1). The 1 to 4 scale above is the one used in IEC 62443-3-3 and IEC 62443-3-2. Seven foundational requirements and the SL vector Security levels are not a single number. They are tied to the seven foundational requirements (FRs) (IEC 62443-3-3:2013, Clause 1): FR 1 Identification and authentication control (IAC) FR 2 Use control (UC) FR 3 System integrity (SI) FR 4 Data confidentiality (DC) FR 5 Restricted data flow (RDF) FR 6 Timely response to events (TRE) FR 7 Resource availability (RA) Annex A of IEC 62443-3-3 explains why. Security covers too broad a set of consequences to compress into one protection factor, as safety integrity levels do. So it uses a vector with one level per FR (IEC 62443-3-3:2013, A.3.1). The format lists the seven values in FR order (IEC 62443-3-3:2013, A.3.3). One example in the standard is a basic process control system zone with an SL-T of {2 2 0 1 3 1 3}. That zone needs level 3 for restricted data flow and resource availability, but level 0 for system integrity. The vector matters in practice. A zone can need strong segmentation and availability while needing little data confidentiality. A single number hides that. SL-T: the target, set from risk SL-T is the desired level of security for a zone or conduit. It is usually set by a risk assessment (IEC 62443-3-3:2013, A.2.2). IEC 62443-3-2 requires an SL-T for each security zone and conduit, as a single value or a vector (IEC 62443-3-2:2020, ZCR 5.6). The standard does not prescribe a method. One approach it describes is to start from an estimate, test the resulting risk against the risk matrix and raise the level until the risk is acceptable. The asset owner or system integrator sets SL-T, based on what level of threat the zone must resist (IEC 62443-3-3:2013, A.3.2.1). It is recorded as one of the characteristics of each zone and conduit in the cyber security requirements specification (CRS) (IEC 62443-3-2:2020, ZCR 6.4). SL-C: what a system or component can do SL-C is the level a system or component can provide when properly configured. It means the system or component can meet the target natively, without extra compensating countermeasures, once configured and integrated correctly (IEC 62443-3-3:2013, A.2.2). At system level, IEC 62443-3-3 gives the system requirements (SRs) and requirement enhancements (REs) for each FR and maps them to SL-C 1 to 4. Annex B tabulates the mapping (IEC 62443-3-3:2013, 3.3 and Annex B). At component level, IEC 62443-4-2 does the same with component requirements, giving SL-C for a component. Component types include embedded devices, host devices, network devices and software applications. Both standards treat SL-T and SL-A as out of their scope. They describe capability only. Product suppliers state SL-C for their products. The supplier or integrator also has to say how to configure the product to reach the claimed level (IEC 62443-3-3:2013, A.2.3). SL-A: what the built system achieves SL-A is the actual level of security of a particular system. It is measured once a design exists or the system is in place, and used to check that the system meets its SL-T (IEC 62443-3-3:2013, A.2.2). SL-A depends on the capability of the products and countermeasures, how effective those countermeasures are, the conduits used and the zones they connect to (IEC TS 62443-1-1:2009, 5.11.3). It also falls over time as countermeasures degrade, new vulnerabilities appear and threats change. The objective is that SL-A stays at or above SL-T at any given time (IEC TS 62443-1-1:2009, 5.11.2.3). How the three fit together in design and assurance The design loop is described in IEC 62443-3-3 Annex A (IEC 62443-3-3:2013, A.2.2 and A.2.3): set SL-T for each zone and conduit select systems and components whose SL-C meets the target where SL-C falls short, add compensating countermeasures, change the design or choose another product after each design iteration, assess SL-A against SL-T once in operation, measure SL-A again during or after changes and on a regular schedule Compensating countermeasures should be documented so the SL-A reflects the real design (IEC 62443-3-3:2013, 0.2). Higher is not automatically better. The standard notes that in very high availability applications, strong access controls can increase the risk of lockout or loss of control (IEC 62443-3-3:2013, 4.3). The common mistake: treating SL as a plant certificate A frequent error is to talk about a plant, or a whole system, being "SL 2". The standards do not work that way. A security level belongs to a zone or conduit and is set per FR. A site will usually have different vectors in different zones. A product with a stated SL-C does not make the zone it sits in reach that level. The zone's SL-A depends on configuration, the surrounding countermeasures and the conduits into it. Equally, a zone can meet its SL-T with products of lower SL-C if documented compensating countermeasures close the gap. When someone quotes a security level, ask which type it is, which zone or component it applies to and which FRs it covers. Where ControlShield can help ControlShield can help you set SL-T for your zones and conduits from a documented risk assessment. We can also check supplier SL-C claims and assess SL-A against the targets. Sources IEC TS 62443-1-1, Industrial communication networks, Network and system security, Part 1-1: Terminology, concepts and models, Edition 1.0, 2009 IEC 62443-3-2, Security for industrial automation and control systems, Part 3-2: Security risk assessment for system design, Edition 1.0, 2020 IEC 62443-3-3, Industrial communication networks, Network and system security, Part 3-3: System security requirements and security levels, Edition 1.0, 2013, with Corrigendum 1, 2014 IEC 62443-4-2, Security for industrial automation and control systems, Part 4-2: Technical security requirements for IACS components, Edition 1.0, 2019, with Corrigendum 1, 2022 (IEC webstore abstract) ISA Global Cybersecurity Alliance, "Quick Start Guide: An Overview of ISA/IEC 62443 Standards", 2024
In IEC 62443, SL-T is the target security level that a risk assessment sets for a zone or conduit. SL-C is the capability security level that a system or component can provide when properly configured. SL-A is the achieved security level actually measured in the design or the built system. All three are expressed per foundational requirement, and the aim is for SL-A to meet SL-T in every zone and conduit. What a security level is IEC 62443-3-2 defines a security level (SL) as a measure of confidence that the system under consideration (SUC), a zone or a conduit is free from vulnerabilities and functions as intended (IEC 62443-3-2:2020, 3.1.15). IEC TS 62443-1-1 adds a key point. A security level is a property of a zone or conduit, not of a device or any single part of a system (IEC TS 62443-1-1:2009, 5.11.1). The levels are defined by the type of threat they protect against (IEC 62443-3-3:2013, A.3.2; IEC 62443-3-2:2020, Annex A): SL 0: no specific requirements or security protection necessary SL 1: protection against casual or coincidental violation SL 2: protection against intentional violation using simple means with low resources, generic skills and low motivation SL 3: protection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation SL 4: protection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation IACS stands for industrial automation and control system. Note that IEC TS 62443-1-1:2009 recommended a minimum of three levels, described as low, medium and high (IEC TS 62443-1-1:2009, 5.11.1). The 1 to 4 scale above is the one used in IEC 62443-3-3 and IEC 62443-3-2. Seven foundational requirements and the SL vector Security levels are not a single number. They are tied to the seven foundational requirements (FRs) (IEC 62443-3-3:2013, Clause 1): FR 1 Identification and authentication control (IAC) FR 2 Use control (UC) FR 3 System integrity (SI) FR 4 Data confidentiality (DC) FR 5 Restricted data flow (RDF) FR 6 Timely response to events (TRE) FR 7 Resource availability (RA) Annex A of IEC 62443-3-3 explains why. Security covers too broad a set of consequences to compress into one protection factor, as safety integrity levels do. So it uses a vector with one level per FR (IEC 62443-3-3:2013, A.3.1). The format lists the seven values in FR order (IEC 62443-3-3:2013, A.3.3). One example in the standard is a basic process control system zone with an SL-T of {2 2 0 1 3 1 3}. That zone needs level 3 for restricted data flow and resource availability, but level 0 for system integrity. The vector matters in practice. A zone can need strong segmentation and availability while needing little data confidentiality. A single number hides that. SL-T: the target, set from risk SL-T is the desired level of security for a zone or conduit. It is usually set by a risk assessment (IEC 62443-3-3:2013, A.2.2). IEC 62443-3-2 requires an SL-T for each security zone and conduit, as a single value or a vector (IEC 62443-3-2:2020, ZCR 5.6). The standard does not prescribe a method. One approach it describes is to start from an estimate, test the resulting risk against the risk matrix and raise the level until the risk is acceptable. The asset owner or system integrator sets SL-T, based on what level of threat the zone must resist (IEC 62443-3-3:2013, A.3.2.1). It is recorded as one of the characteristics of each zone and conduit in the cyber security requirements specification (CRS) (IEC 62443-3-2:2020, ZCR 6.4). SL-C: what a system or component can do SL-C is the level a system or component can provide when properly configured. It means the system or component can meet the target natively, without extra compensating countermeasures, once configured and integrated correctly (IEC 62443-3-3:2013, A.2.2). At system level, IEC 62443-3-3 gives the system requirements (SRs) and requirement enhancements (REs) for each FR and maps them to SL-C 1 to 4. Annex B tabulates the mapping (IEC 62443-3-3:2013, 3.3 and Annex B). At component level, IEC 62443-4-2 does the same with component requirements, giving SL-C for a component. Component types include embedded devices, host devices, network devices and software applications. Both standards treat SL-T and SL-A as out of their scope. They describe capability only. Product suppliers state SL-C for their products. The supplier or integrator also has to say how to configure the product to reach the claimed level (IEC 62443-3-3:2013, A.2.3). SL-A: what the built system achieves SL-A is the actual level of security of a particular system. It is measured once a design exists or the system is in place, and used to check that the system meets its SL-T (IEC 62443-3-3:2013, A.2.2). SL-A depends on the capability of the products and countermeasures, how effective those countermeasures are, the conduits used and the zones they connect to (IEC TS 62443-1-1:2009, 5.11.3). It also falls over time as countermeasures degrade, new vulnerabilities appear and threats change. The objective is that SL-A stays at or above SL-T at any given time (IEC TS 62443-1-1:2009, 5.11.2.3). How the three fit together in design and assurance The design loop is described in IEC 62443-3-3 Annex A (IEC 62443-3-3:2013, A.2.2 and A.2.3): set SL-T for each zone and conduit select systems and components whose SL-C meets the target where SL-C falls short, add compensating countermeasures, change the design or choose another product after each design iteration, assess SL-A against SL-T once in operation, measure SL-A again during or after changes and on a regular schedule Compensating countermeasures should be documented so the SL-A reflects the real design (IEC 62443-3-3:2013, 0.2). Higher is not automatically better. The standard notes that in very high availability applications, strong access controls can increase the risk of lockout or loss of control (IEC 62443-3-3:2013, 4.3). The common mistake: treating SL as a plant certificate A frequent error is to talk about a plant, or a whole system, being "SL 2". The standards do not work that way. A security level belongs to a zone or conduit and is set per FR. A site will usually have different vectors in different zones. A product with a stated SL-C does not make the zone it sits in reach that level. The zone's SL-A depends on configuration, the surrounding countermeasures and the conduits into it. Equally, a zone can meet its SL-T with products of lower SL-C if documented compensating countermeasures close the gap. When someone quotes a security level, ask which type it is, which zone or component it applies to and which FRs it covers. Where ControlShield can help ControlShield can help you set SL-T for your zones and conduits from a documented risk assessment. We can also check supplier SL-C claims and assess SL-A against the targets. Sources IEC TS 62443-1-1, Industrial communication networks, Network and system security, Part 1-1: Terminology, concepts and models, Edition 1.0, 2009 IEC 62443-3-2, Security for industrial automation and control systems, Part 3-2: Security risk assessment for system design, Edition 1.0, 2020 IEC 62443-3-3, Industrial communication networks, Network and system security, Part 3-3: System security requirements and security levels, Edition 1.0, 2013, with Corrigendum 1, 2014 IEC 62443-4-2, Security for industrial automation and control systems, Part 4-2: Technical security requirements for IACS components, Edition 1.0, 2019, with Corrigendum 1, 2022 (IEC webstore abstract) ISA Global Cybersecurity Alliance, "Quick Start Guide: An Overview of ISA/IEC 62443 Standards", 2024