IEC 62645:2019

Overview

IEC 62645:2019 is an international standard developed by the International Electrotechnical Commission (IEC) that sets forth cybersecurity requirements for nuclear power plants, specifically focusing on Instrumentation, Control, and electrical power systems. This standard addresses the development and management of comprehensive computer security programs aimed at protecting I&C (Instrumentation & Control) programmable digital systems from cyber threats. It emphasizes compliance with country-specific regulations and guides organizations on effective prevention, detection, and response to cyberattacks that could cause unsafe conditions, equipment damage, or operational degradation. The 2019 edition updates the 2014 version by aligning with ISO/IEC 27001, refining terminology, and integrating recent cybersecurity and national practice developments.

Key Topics

• Cybersecurity Program Management:
  IEC 62645 outlines the framework for establishing, managing, and continuously improving computer security programs covering all phases-from development and implementation to operation and retirement of I&C systems. It stresses leadership commitment, clear roles, and documented policies to ensure robust cybersecurity governance.

• Risk Assessment and Graded Approach:
  The standard advocates a risk-based, graded approach to cybersecurity tailored to the significance of specific I&C systems. It provides methods for identifying security degrees based on safety categories, operational impact, and performance degradation risks.

• Lifecycle Security Implementation:
  Comprehensive lifecycle guidance covers system specification, detailed design, integration, validation, installation, operation, maintenance, and retirement phases. This ensures security considerations are embedded throughout the system’s evolution.

• Security Controls and Defense-in-Depth:
  IEC 62645 promotes defense-in-depth strategies, recommending layered security controls to mitigate vulnerabilities. This includes secure architecture, communication pathways protection, security zones definition, and continuous reassessment of controls.

• Alignment with International Standards:
  The 2019 edition harmonizes with ISO/IEC 27001:2013 requirements, supporting integration into existing cybersecurity management systems. It also correlates with other IEC SC 45A standards and the IEC 62443 series, enhancing consistency in the nuclear cybersecurity domain.

Applications

IEC 62645:2019 is primarily designed for nuclear power plants but offers valuable guidance for cybersecurity in I&C programmable digital systems across various nuclear-related facilities, such as research reactors, fuel cycle plants, and small modular reactors (SMRs). The standard helps organizations:

• Develop and maintain effective cybersecurity programs to protect critical operational systems from cyber threats.
• Assess and mitigate cybersecurity risks based on system safety impact and plant availability considerations.
• Implement lifecycle security measures that reduce vulnerabilities during design, operation, and maintenance phases.
• Comply with national and international regulations for nuclear facility cybersecurity.
• Enhance resilience against cyberattacks that can cause safety hazards, equipment failure, or productivity losses.

By adhering to IEC 62645, nuclear operators improve the reliability and safety of their I&C systems, safeguarding critical infrastructure from emerging cyber risks.

Related Standards

• ISO/IEC 27001:2013 – Information Security Management Systems (ISMS)
  IEC 62645 aligns its cybersecurity program requirements with ISO/IEC 27001, facilitating integration with broader organizational ISMS frameworks.

• IEC 62443 Series – Industrial Automation and Control Systems Security
  There is a high-level correspondence between IEC 62645 and the IEC 62443 standard series, which focuses on cybersecurity for automation and control systems in industrial environments.

• IEC 61513 – Nuclear Power Plant Instrumentation and Control Systems – General Requirements for Systems Important to Safety
  Safety categorization processes in IEC 62645 reference criteria established in IEC 61513 to determine security degree assignments.

• Other IEC SC 45A Standards
  These standards cover various aspects of instrumentation, control, and electrical power systems, complementing IEC 62645 by providing additional guidance for cybersecurity in nuclear environments.

Adopting IEC 62645:2019 assists nuclear power plants and associated facilities in establishing rigorous cybersecurity practices for their critical I&C programmable digital systems, balancing safety, reliability, and regulatory compliance effectively.