IEC 62443-2-1: security program requirements for IACS asset owners, explained

IEC 62443-2-1 is the part of the ISA/IEC 62443 series that sets security program requirements for the asset owner — the organization that operates an industrial automation and control system (IACS) — rather than for the vendors that build the system's components. A standards-catalogue listing of the current edition gives its scope as specifying "asset owner security program (SP) policy and procedure requirements for an industrial automation and control system (IACS) in operation." Where IEC 62443-3-3 and IEC 62443-4-1/4-2 set technical requirements for systems and components, 62443-2-1 sets the operational, policy-level program an asset owner needs to run around whatever systems and components it has in production.

A 2024 rewrite, not a minor update

IEC 62443-2-1:2024 (Edition 2.0, published 6 August 2024) replaces the original first edition from 2010 — a fourteen-year gap reflecting how much the asset-owner security landscape changed in the interim. Per standards-catalogue summaries this guide checked from iteh.ai (a standards reseller publishing IEC's own abstract text) and the compliance-tooling vendor OneClickComply, the second edition made three structural changes:

1. Reorganized requirements into Security Program Elements (SPEs) — a named grouping structure that did not exist in the 2010 first edition.
2. Removed requirements that duplicated an information security management system (ISMS), such as ISO/IEC 27001, rather than asking asset owners to maintain two overlapping control sets.
3. Introduced a maturity model for evaluating requirements, moving away from a binary met/not-met check toward a graded assessment of how well each requirement is actually implemented.

This guide has not independently verified the exact clause-level wording of any of these three changes against a purchased copy of the standard — the points above come from standards-reseller and compliance-vendor catalogue summaries, not from IEC's or ISA's full paywalled text. Treat the structural description as directionally reliable and the specific clause language as to be confirmed before citing it in a conformity claim.

The eight Security Program Elements (SPEs)

The same catalogue summaries describe the 2024 edition's requirements as grouped into eight SPEs:

#	Security Program Element
1	Organizational Security Measures
2	Configuration Management
3	Network and Communications Security
4	Component Security
5	Data Protection
6	User Access Control
7	Event and Incident Management
8	System Integrity and Availability

Secondary summaries this guide checked put the total requirement count at roughly 87, distributed across these eight elements, with each requirement assessed against the maturity model rather than a flat checklist. That specific figure comes from a standards-reseller catalogue page and a compliance-vendor summary — not from a page this guide fetched directly from IEC itself — so it should be confirmed against the purchased standard rather than repeated as a verified IEC count.

Built around legacy systems, not against them

One scope point both catalogue summaries agree on: the standard explicitly accounts for IACS service life exceeding twenty years, and acknowledges that "many legacy systems contain hardware and software that are no longer supported." Rather than mandating technical controls a legacy asset simply cannot run (such as modern patching on an end-of-life component), the standard asks the asset owner to maintain policies and procedures — including documented compensating measures — around that limitation. In practice this means 62443-2-1 does not itself require that an IACS be technically capable of meeting every security program element; it requires the asset owner to have a documented program for managing the gap where a system can't.

Where it sits in the series, and why that matters for operators

ISA's own series overview groups the 62443 standards into four layers — General (1-x), Policies & Procedures (2-x), System (3-x), and Component (4-x). 62443-2-1 sits in the Policies & Procedures group, alongside 2-2 (implementation guidance), 2-3 (patch management) and 2-4 (requirements for IACS suppliers and service providers — the service-provider counterpart to 2-1's asset-owner focus). Wikipedia's summary of the series describes 62443-2-1 as "aimed at operators of automation solutions" and defining "requirements for how security during the operation of plants is to be considered," explicitly pointing to ISO/IEC 27001 — consistent with the 2024 edition's stated goal of removing ISMS duplication rather than asking an asset owner that already runs ISO/IEC 27001 to build a parallel program from scratch.

For a factory operator, the practical split is: 62443-2-1 is the program you run as the entity operating the plant; 62443-3-3 is what you check a system was built to meet before it goes into that plant; 62443-4-1/4-2 are what you'd expect a component vendor to already have done before you buy from them. An asset owner adopting 62443-2-1 doesn't need to separately re-derive the system- and component-level requirements — it inherits them through procurement and system design, and focuses its own program on the operational SPEs above.

A workable starting point

1. Map what you already have under ISO/IEC 27001 (or an equivalent ISMS) first. The 2024 edition's removal of ISMS-duplicate requirements means an asset owner with a working ISMS should start by identifying the gap, not rebuilding security management from zero.
2. Organize existing OT security work under the eight SPE headings — most operators already have fragments of configuration management, access control and incident response; the SPE structure gives those fragments a single home.
3. Expect a maturity assessment, not a binary pass/fail, when evaluating your own program against the 2024 text — plan for "where do we sit on the maturity scale" rather than a simple compliant/non-compliant answer.
4. Document compensating measures for legacy assets explicitly. The standard's own accommodation for systems that can't meet a requirement technically only works if the gap and the compensating measure are written down, not assumed.
5. Confirm specific SPE/requirement counts against the purchased standard before using them in an audit or procurement document — this guide's figures come from standards-catalogue summaries, not a fetched IEC or ISA full text.

SoftWSP's passive OT network assessment gives an asset owner the current-state asset inventory and exposure picture that a 62443-2-1 security program — particularly the Configuration Management and Component Security SPEs — needs as its starting evidence: see OT Snapshot.

This guide summarises standards-catalogue descriptions of IEC 62443-2-1:2024; it is not a substitute for the purchased standard and does not constitute legal or compliance advice.