Industrial control systems were built for reliability, not for facing internet-era attackers, and a single weak path can expose an entire plant. This checker maps your authentication, segmentation, remote access, patching, and monitoring onto the IEC 62443 Security Levels and shows where you fall short of your target.
How it works
IEC 62443 defines four Security Levels by the capability of the attacker each resists:
- SL-1 — casual or coincidental violation.
- SL-2 — intentional attacks using simple means and low resources.
- SL-3 — sophisticated attacks using control-system-specific skills and moderate resources.
- SL-4 — sophisticated attacks with extended resources and high motivation.
The standard organises controls into seven foundational requirements. This tool assesses five of the most safety-critical — identification and authentication, use control, system integrity, restricted data flow (segmentation), and timely response to events. Because security is capped by its weakest link, the achieved level is the minimum across your answers, and any control below your target is listed as a gap.
Example
If your authentication, remote access, patching, and monitoring all reach SL-3 but your network is a flat IT/OT mix scoring SL-1 for segmentation, the achieved level is SL-1. Closing that single gap by introducing zones and conduit firewalls is the highest-leverage fix.
Tips and notes
Prioritise the lowest-scoring foundational requirement first, since it caps everything else. Network segmentation into zones and conduits and removing direct remote exposure are usually the fastest wins. This is an indicative self-assessment, not formal IEC 62443 certification, which requires a full risk assessment and qualified auditors.