IEC 62443-2-2: rating how well a zone is protected in operation, and using it in the periodic review

The periodic review of a filling line’s control system is nearly done. Functionality, deviations, changes, backups: each section has its evidence. Then comes the paragraph on security, and it reads exactly as it did last year. Firewall in place. Antivirus signatures current. No security incident in the period. The reviewer from quality signs, because there is nothing in it to disagree with.

Now put three questions to that paragraph. Protected to what level? Was that the level the risk assessment asked for when the zone was designed? And is it still true this month, given that the quarterly account review was skipped twice and the integrator’s remote access stayed open after the last shutdown? The paragraph has no answer. It describes equipment; it says nothing about protection.

That gap, between the protection a zone was designed to have and the protection it actually holds in operation, is what the newest part of the ISA/IEC 62443 series deals with.

What was published, and by whom

On 4 December 2025 the International Society of Automation announced ISA-TR62443-2-2-2025, Security for Industrial Automation and Control Systems, Part 2-2: IACS Security Protection Scheme, a technical report for asset owners and operators. The text had already appeared once. In March 2025 the IEC published the same part, under the same title, as a Publicly Available Specification: IEC PAS 62443-2-2:2025, edition 1.0, dated 11 March 2025, prepared by IEC technical committee 65 with the ISA99 committee as liaison.

Two things about the document type matter before anyone builds a procedure on it. A PAS is not an International Standard; under the ISO/IEC Directives it has a maximum life of six years, after which it is either transformed into an International Standard or withdrawn. And the document is frank about its own status. Clause 4 says its concepts are not all reflected in the currently published parts of the series, that none of them contradicts those parts, and that they are input for future editions. So treat it as the committee’s worked method for the operation phase. An auditor cannot cite it against you as a requirement.

What a security protection scheme is

The series already had a word for the organisation’s side of security. IEC 62443-2-1 calls it the security program: the policies and procedures an asset owner defines for its IACS. Part 2-2 adds a word for what protects one system in operation, and defines the security protection scheme as the “set of technical, physical, and process security measures designed to address cyber security concerns of an IACS during operation” (3.1.2).

The scope (clause 1) says what the document is for: guidance on developing, validating, operating and maintaining that set of measures, so that the risks from cyberthreats to each IACS in a facility are managed. Its contents follow the life of a system, from the cybersecurity requirements specification through the design and implementation of the measures and the documentation of the process measures, to validating the scheme and revalidating it periodically in operation (clause 8). Clause 7 assigns the roles: asset owner, integration service provider, maintenance service provider and product supplier.

One small change of wording carries the whole idea. In IEC 62443-3-3 a system requirement reads “The control system shall provide the capability to …”. Part 2-2 notes that, for a system in operation, the same requirement reads “The IACS in operation shall provide the capability to …” (3.1.3, note 3). The subject has moved from a product on a datasheet to your line, as it runs this week.

Three ratings for one zone

The tool the document offers is the security protection rating, SPR, in three types that follow the life cycle (6.7.3).

• Target (SPR-T): the levels of the system security requirements the asset owner wants fulfilled during operation (3.1.5).
• Implemented (SPR-I): the levels the designed technical, physical and process measures can fulfil, assuming the process measures will be carried out in operation with demonstrated repeatability and effectiveness (3.1.6). Clause 8.5.4 calls this a prediction.
• Operated (SPR-O): the levels actually fulfilled at a given point in time during operation, with process measures shown to be repeatable and effective (3.1.7).

Most plants live in the distance between SPR-I and SPR-O. A design can include a perfectly good access control function and a perfectly good procedure for reviewing accounts every quarter. If nobody has done the review since spring, the capability is still there. The protection it was meant to give has gone.

Where maturity comes in

Hence the second input to the rating. Part 2-2 borrows the maturity level from IEC 62443-2-1 and gives it a precise meaning for operation: the level of confidence that the process security measures are carried out by the people in charge with demonstrated repeatability and effectiveness (3.1.8, note 1). Clause 6.2 uses the maturity model of 2-1 to determine SPR values, and Annex B describes a maturity assessment procedure.

Put simply, a rating combines what the technology can do with how reliably the organisation does its share. Take two identical firewall rule sets, one reviewed whenever someone remembers, the other on a schedule with records. Same technical capability, two different ratings.

The document leaves room for local practice too. Clause 6.3 allows alternative rating matrices for internal use, 6.4 groups the security requirements, 6.5 traces the ratings to the security program elements of 2-1, and 6.6 presents views of the results, with a dashboard as an example. For the assessment itself, Annex A gives three example approaches: a detailed requirements-based assessment, a detailed risk-based one, and a simplified evaluation based on questions.

How it fits with 2-1 and 3-2

A GMP site that has followed the series so far already holds two of the three pieces. Part 2-2 is what connects them once the system is running.

1. IEC 62443-3-2:2020 sets the target. Its zone, conduit and risk method partitions the system into zones and conduits, determines a target security level (ZCR 5.6), writes the cybersecurity requirements specification (ZCR 6.1) and ends with the asset owner’s approval (ZCR 7). If you have done this, you already have the raw material of SPR-T. If not, start from the risk, not from the switch.
2. IEC 62443-2-1:2024 sets the organisation. The second edition, published by the IEC on 7 August 2024, restructures the asset owner’s requirements into security program elements, removes the overlap with an information security management system and introduces a maturity model. Its scope is the security program for an IACS in operation, and it accepts compensating measures where legacy systems cannot technically meet a requirement.
3. IEC PAS 62443-2-2:2025 measures the result. It takes the target from 3-2, the technical capabilities from 3-3 and 4-2 and the maturity of the processes from 2-1, then asks how much of the target is actually met, zone by zone, in operation.

Using it in the periodic review

None of this calls for a new GMP procedure. What it calls for is a better security section in one you already have. EU GMP Annex 11, clause 11, asks that computerised systems be “periodically evaluated to confirm that they remain in a valid state and are compliant with GMP”, and lists what such evaluations should include where appropriate: “the current range of functionality, deviation records, incidents, problems, upgrade history, performance, reliability, security and validation status reports.” Security is on the list. Most reviews give it one sentence.

Clause 12.2 adds the proportionality rule: “The extent of security controls depends on the criticality of the computerised system.” That sits well with the assessment approaches of Annex A. The zone holding batch control and the data behind release gets a detailed assessment; the label printer’s zone can make do with the simplified questions.

The European Commission consulted on a revised Annex 11 from 7 July to 7 October 2025, together with a revised Chapter 4 and a new Annex 22. Until the revision is adopted, the 2011 text quoted above applies, and its periodic evaluation clause is enough to justify the approach.

Eight lines for the security section of a periodic review:

1. The zone and its boundary, by reference to the current zone and conduit drawing, with the drawing’s date.
2. The target: SPR-T, or the target security level from the approved risk assessment, with its reference and date.
3. The technical measures supporting the target, listed against the requirements they fulfil, and whether each is still configured as qualified.
4. The process measures the target depends on (account reviews, backup and restore tests, patch evaluation, log review, remote access approvals), with the number planned and the number done in the period.
5. The operated rating, SPR-O, or a plain statement of which requirements are fully, partly or not met today.
6. The gap between target and operated, requirement by requirement, with a cause for each.
7. The changes in the period that touched the scheme: new conduits, temporary connections, replaced components, new suppliers with access.
8. The decision: the zone remains in a validated and secure state, or a CAPA opens with an owner and a date for each gap.

Line 4 is the one that moves the rating. A site that can show eleven of twelve monthly log reviews done, with records, stands somewhere quite different from a site that can only show the procedure. It is also the line that turns security into a recurring activity instead of a project, the point made in securing OT/ICS: a cycle, not a project.

Where to start

Pick one zone, the one whose loss or manipulation would hurt the product most, and run the eight lines on it at its next periodic review. Take the target from the risk assessment if there is one; if there is none, you have your first finding. Use the simplified, questions-based approach the first time. What you want is to see how far the plant has drifted from the paper, not a score to four decimal places. Then decide whether the PAS method is worth adopting across the site, bearing in mind that a PAS lasts six years at most and that its concepts are expected to move into future editions of the series.

Five common mistakes

The commonest is rating the equipment instead of the zone. A certified component sitting in an unmanaged zone gives that zone no rating at all; the rating belongs to what the measures protect together. Close behind is stopping at SPR-I. A qualification report shows what the design can do, and without an operated rating it says nothing about this year.

• Leaving the procedures out of the rating. On the sites we review, a gap is more often a procedure not carried out than a missing technology, which is precisely why maturity is part of the rating.
• Treating a PAS as a requirement. It is guidance whose concepts are still moving into the series; an internal procedure should cite it as a method, not as a regulatory expectation.
• Leaving the security section to IT. The periodic review is a quality record. A gap between target and operated protection is a decision about the validated state, and quality signs it.

On the day of the review, a zone is protected to the level it actually holds. What the design said is only the starting point.

References

• IEC, IEC PAS 62443-2-2:2025, Security for industrial automation and control systems, Part 2-2: IACS security protection scheme, edition 1.0, 11 March 2025, webstore.iec.ch
• IEC, IEC 62443-2-1:2024, Security program requirements for IACS asset owners, edition 2.0, 7 August 2024, webstore.iec.ch
• IEC, IEC 62443-3-2:2020, Security risk assessment for system design, edition 1.0, 24 June 2020, webstore.iec.ch
• European Commission, EudraLex Volume 4, Annex 11: Computerised Systems, §11 and §12, health.ec.europa.eu
• The starting point: automation.com, Update to ISA/IEC 62443 Series Includes Guidance on Security Protection Schemes for IACS, 4 December 2025, automation.com