IEC 62443-2-4 (security program requirements for IACS service providers), explained

IEC 62443-2-4, "Security for industrial automation and control systems – Part 2-4: Security program requirements for IACS service providers," is the part of the ISA/IEC 62443 series that sets security requirements not for the asset owner who operates an industrial automation and control system (IACS), nor for the vendor who builds its components, but for the System Integrator and Maintenance Service Provider who design, deploy and keep it running. Per the standard's own Section 1 scope — quoted here from ISA's official preview text — it "specifies a comprehensive set of requirements for security capabilities for IACS service providers that they can offer to the asset owner during integration and maintenance activities of an Automation Solution." The current edition, Edition 2.0, was published by IEC Technical Committee 65 on 2023-12-15 and has since been adopted as ANSI/ISA-62443-2-4-2023 and regionally as EN IEC 62443-2-4:2024.

Two roles, one Security Program

The standard's own Figure 2 (reproduced in ISA's preview text) lays out the roles it addresses: an Asset Owner operates the IACS; a System Integrator supplies "integration capabilities (design and deployment)"; and together with ongoing "operational and maintenance capabilities (policies and procedures)," these form what the standard — in Section 1 — collectively calls the service provider's Security Program: "Collectively, the security capabilities offered by an IACS service provider are referred to as its Security Program." A footnote in the same section adds that these capabilities are "in general... policy, procedure, practice and personnel related" rather than purely technical controls, distinguishing 2-4 from the technical, component-level requirements in IEC 62443-4-2.

The standard is explicit about its sibling specification: "In a related specification, ISA-62443-2-1 describes requirements for the Security Management System of the asset owner." Where 62443-2-1 sets requirements for the organization operating the system, 62443-2-4 sets requirements for the organizations building and maintaining it on the asset owner's behalf — the two are designed to be read as a pair.

Security Program functional areas

Compliance and training summaries describing the standard's structure commonly tabulate its requirements under named Security Program (SP) functional areas, frequently labelled SP.01 through SP.12 and covering areas such as solution staffing, architecture, wireless use, Safety Instrumented System (SIS) integration, configuration management, remote access, event handling, account management, malware protection, patch management, backup/restore, and an assurance area confirming the Automation Solution's security policy is actually enforced. This guide was able to confirm the standard's scope, Security Program/Profiles language, and role diagram directly against ISA's own preview text, but the exact SP.01–SP.12 labels and their individual requirement counts come from third-party compliance summaries rather than a page this guide fetched from the paywalled Annex A requirement table itself — treat the precise area list and counts as to be confirmed against a purchased copy of the standard before relying on it for a conformance claim.

Profiles: adapting one standard to many contexts

A recurring theme across ISA/IEC 62443 parts is that not every requirement fits every organization, and 2-4 addresses this directly in its own scope text: "Because not all requirements apply to all industry groups and organizations, Subclause 4.1.4 provides for the development of Profiles that allow for the subsetting of these requirements. Profiles are used to adapt this document to specific environments, including environments not based on an IACS." In practice, this lets an industry group or large service provider define a tailored, smaller requirement set appropriate to its own context — a chemical-plant integrator and a building-automation integrator need not meet an identical checklist — rather than treating the full base standard as a rigid one-size-fits-all bar.

What changed in the 2023 edition

IEC published Edition 2.0 of 62443-2-4 on 2023-12-15, superseding the original 2015 edition plus its 2017 amendment (the version ISA's own preview PDF, cited above, still documents verbatim for the scope and role-diagram language that carries forward). Standards-catalogue listings describe the new edition as retaining the same Security Program and Profiles structure while refreshing cross-references to other 62443 parts. Separately, ISA initiated a new companion standard, ISA-62443-6-1 ("Security evaluation methodology for IEC 62443-2-4"), to define how conformance to 2-4 itself should be assessed — a sign the series still treats verifying a service provider's Security Program as a distinct, ongoing piece of work rather than settled by the base requirements alone. This guide could not fetch the 2023 edition's full requirement text directly; specific clause-level changes from the 2015+2017 baseline should be confirmed against a purchased copy rather than assumed from this summary.

A workable starting point

1. Identify which role you're assessed under first. A System Integrator's design/deployment obligations and a Maintenance Service Provider's ongoing operational obligations draw on the same Security Program functional areas but apply at different points in the Automation Solution's lifecycle — confirm which (or both) your contract scope covers before building evidence.
2. Pair your 2-4 evidence with the asset owner's 2-1 program, since the two specifications are designed to interlock — a service provider's Security Program exists to support the Security Management System the asset owner runs under 62443-2-1.
3. Check whether a Profile already exists for your industry before building a bespoke interpretation of the base requirement set from scratch — Subclause 4.1.4 exists specifically so sector groups can publish a tailored subset.
4. Track cross-references into 62443-3-3 and 62443-4-2. Where your integration work asserts that a security measure is "supported in the Automation Solution," the base standard expects that claim to trace back to a system- or component-level requirement in those parts, not stand alone.
5. Watch for ISA-62443-6-1. Once the companion evaluation-methodology standard is final, it is likely to define how a certification body actually scores conformance to 2-4 — confirm its status before assuming today's self-assessment practices will carry over unchanged.

SoftWSP's OT/ICS assessments can map an integrator's or maintenance provider's existing evidence against IEC 62443-2-4's Security Program functional areas alongside the asset-owner-side 62443-2-1 program: see OT Snapshot.

This guide summarises IEC 62443-2-4's publicly available scope and series-relationship text (via ISA's official preview PDF) plus standards-catalogue and ISA Global Cybersecurity Alliance summaries of the 2023 edition; it is not a substitute for the full purchased standard and does not constitute compliance or legal advice.