IEC 62443-1-1 (Terminology, concepts and models), explained

Every time another guide on this site mentions a "Security Level," a "zone," a "conduit," or one of the seven "Foundational Requirements," that vocabulary traces back to one document: IEC TS 62443-1-1:2009, "Industrial communication networks — Network and system security — Part 1-1: Terminology, concepts and models." It is the foundation stone of the whole IEC 62443 series for industrial automation and control system (IACS) security — published in 2009, still a Technical Specification rather than a full International Standard 16+ years later, and still the document every later part of the series points back to for its own definitions.

What it is, and who publishes it

Per the IEC webstore's own abstract, IEC TS 62443-1-1:2009 "is a technical specification which defines the terminology, concepts and models for Industrial Automation and Control Systems (IACS) security. It establishes the basis for the remaining standards in the IEC 62443 series." It was published 30 July 2009 as a first-edition Technical Specification (81 pages) by IEC Technical Committee TC 65 (Industrial-process measurement, control and automation), and corresponds to an identically titled document originally developed by the ISA99 committee and published as ISA-62443-1-1-2007 — the series carries dual IEC/ISA lineage throughout. The IEC webstore lists its stability date as 2027 and its status as current; it has not been withdrawn.

A Technical Specification is a lighter IEC deliverable than a full International Standard, used when the content has not yet reached the level of consensus a normative IS requires. That status has stuck: independent industry commentary on the series describes a second edition of 1-1 as having circulated for committee review at ISA99/IEC TC65 WG10 since around 2021, intended to tighten definitions and bring ontology-level consistency with the rest of the series, but no confirmed publication date for that revision exists as of this guide. The 2009 text, not a draft successor, is what you cite today.

The concepts the rest of the series builds on

IEC 62443-1-1 is not itself a checklist of technical controls — it is a shared vocabulary and a set of reference models. Independent summaries of its published content (the full specification text is paywalled; treat exact clause numbers and wording below as to be confirmed against the purchased document) describe four concepts that recur throughout the series:

Concept	What it establishes
IACS reference model	A functional hierarchy from Level 0 (physical process equipment) up to Level 5 (enterprise systems), used to say where an automation activity sits by function, not by network topology — two devices on the same VLAN can sit at different reference-model levels
Zones and conduits	A zone groups logical or physical assets that share common security requirements; a conduit is the logical grouping of communication channels connecting two or more zones — the vocabulary that IEC 62443-3-2 later applies to actually partition a real system
Security Level (SL)	Defined broadly as a measure of confidence that a system is free from vulnerabilities and functions as intended; later parts of the series split it into SL-T (Target, from risk assessment), SL-C (Capability, what a component or system can deliver) and SL-A (Achieved, what is actually delivered in operation), on a 0-4 numeric scale formalized in IEC 62443-3-3
Seven Foundational Requirements (FR1-FR7)	Identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability — high-level security objectives, not controls themselves, that later parts decompose into System Requirements (3-3) and Component Requirements (4-2)

The specification also defines the IACS boundary itself more broadly than a networking diagram would suggest: an Industrial Automation and Control System covers "a collection of personnel, hardware, software and policies involved in the operation of an industrial process" that can affect its safe, secure and reliable operation — people and policy are explicitly inside the scope, not just controllers and cabling. It further names four principal organizational roles that the rest of the series writes role-specific requirements for: asset owner, product supplier, system integrator, and service provider.

Where each concept actually gets operationalized

1-1 names the ideas; it does not, by itself, tell you how to apply them. The parts of the series that do:

If you need to...	The part that specifies it
Run an actual security risk assessment and partition a system into zones and conduits	IEC 62443-3-2 — Security risk assessment for system design
Set formal Security Levels (SL 0-4) and System Requirements under each Foundational Requirement	IEC 62443-3-3 — System security requirements and security levels
Specify what a single PLC, HMI or gateway must technically do under each Foundational Requirement	IEC 62443-4-2 — Component requirements
Build the secure development lifecycle a component supplier runs to produce 4-2-conformant products	IEC 62443-4-1 — Secure development lifecycle
Run an asset owner's ongoing security program, or set requirements for IACS service providers	IEC 62443-2-1 / IEC 62443-2-4

Related parts of the 1-x sub-series that 1-1 is grouped with — 1-2 (master glossary of terms and abbreviations) and 1-3 (system security conformance metrics) — remain under development at ISA99/IEC TC65 WG10 and are not yet available as finished IEC deliverables, even though later parts of the series reference them. IEC TS 62443-1-5:2023, a newer addition formalizing a scheme for building sector-specific security profiles on top of the horizontal series, has already been published, which gives a sense of how unevenly the 1-x foundation has matured compared with the better-known 2-x/3-x/4-x parts.

Why this still matters for the CRA and EN 18031

None of IEC 62443-1-1's vocabulary carries legal weight on its own: it is a voluntary IEC/ISA technical specification, not an EU harmonised standard, and it predates both the Cyber Resilience Act and EN 18031 by well over a decade. Its practical relevance today is that regulators, auditors and buyers increasingly expect the same terms — zones, conduits, Security Levels, Foundational Requirements — to appear in a manufacturer's own risk documentation, because so much of the rest of the 62443 series, and a fair amount of adjacent OT guidance, assumes this vocabulary as a baseline. See IEC 62443-4-2 vs the Cyber Resilience Act and EN 18031 for where the technical mechanisms line up with current EU law, and NIST SP 800-82 OT security for how a similarly structured zone/conduit model appears in NIST's own OT guidance.

A workable starting point

1. Treat 1-1's terms as the dictionary, not the requirements — if you're writing a risk assessment or a technical file, the enforceable requirements sit in 3-2, 3-3 and 4-2; 1-1 just fixes what the words in those documents mean.
2. Use the reference model (Levels 0-5) to scope a conversation before a tool — deciding whether a given asset is a Level 1 control device or a Level 3 operations-management system changes which part of the series applies to it, before any zone/conduit diagram gets drawn.
3. Don't conflate SL-T, SL-C and SL-A — a component's SL-C (what the datasheet claims it can do) is not the same as the SL-A a specific deployment actually achieves once it's integrated, configured and operated; buyers conflating the two is a common source of disputed security claims.
4. Expect the second edition eventually, but don't wait for it — a revision has been in committee review since roughly 2021 with no confirmed publication date; build your program on the current 2009 text and its stability date of 2027 rather than planning around an unpublished draft.
5. Pair the vocabulary with an actual OT asset inventory — the zone/conduit model is only useful once you know what is actually on the network and at what reference-model level it sits.

SoftWSP's OT Snapshot service builds the passive asset inventory and segmentation picture that IEC 62443-1-1's zone, conduit and reference-model vocabulary is designed to describe: see OT Snapshot.

This guide summarises publicly available descriptions of IEC TS 62443-1-1:2009's scope and structure, cross-checked against the IEC webstore's own catalogue record; it is not a substitute for the purchased ISA/IEC text, where exact clause numbers and definitions should be confirmed, and does not constitute compliance or legal advice.