IEC TS 62443-1-5:2023

Overview

IEC TS 62443-1-5:2023 - “Security for industrial automation and control systems - Part 1-5: Scheme for IEC 62443 security profiles” defines a formal scheme for creating IEC 62443 security profiles. The Technical Specification sets requirements for how profiles are selected, written and published (as part of a dedicated IEC 62443 security profiles sub‑series) to ensure consistent, comparable mappings of IEC 62443 requirements for different applications, sectors and conformity assessment activities.

Key topics and requirements

This TS organizes profile creation and validation around clear, documented requirements and a three‑phase process (creation, validation, application). Major technical topics include:

• Security profile content (PR.01): minimum content to be included (see Annex A).
• Selection (PR.02): criteria for selecting relevant IEC 62443 requirements for a profile.
• Contextual mapping (PR.03): declaration and rationale of how selected requirements apply within a specific environment.
• No new requirements (PR.04): profiles must not introduce new normative requirements beyond IEC 62443.
• No modification (PR.05): profiles must not alter the original IEC 62443 requirement definitions.
• Maturity level (PR.06): specifying required maturity (ML) for implementation or processes.
• Security level (PR.07): declaring applicable Security Level (SL) expectations for zones, conduits, devices or systems.
• Security risk evaluation (PR.08): documenting risk assessment for the profile’s intended use.
• Document type (PR.09): classification and metadata for published profiles.
• Process lifecycle (creation, validation, application) and normative Annex A listing minimum profile elements.

These requirements support contextual mapping, enabling consistent interpretation without changing IEC 62443 principles.

Practical applications

IEC TS 62443-1-5:2023 is practical for:

• Asset owners and system integrators defining sector‑specific security expectations.
• Manufacturers and component vendors aligning product claims with standardized profile requirements.
• Conformity assessment bodies seeking comparable assessment criteria for audits and certifications.
• Industry consortia developing application‑specific profiles (e.g., oil & gas, utilities, manufacturing).

Use cases include publishing profiles that specify ML and SL targets, mapping IEC 62443 controls to an industry deployment, or producing documentation for assessment and procurement.

Related standards

• IEC 62443 series (core framework for industrial automation and control systems security)
• IEC TS 62443-1-1 and IEC 62443‑4‑1 / 4‑2 referenced within definitions
• Note: ISO/IEC 15408 “Protection Profiles” uses a different profile scheme but is conceptually similar

Keywords: IEC TS 62443-1-5:2023, IEC 62443 security profiles, industrial automation and control systems, contextual mapping, security level, maturity level, conformity assessment.