244 results
IEC 62443-2-4 (security program requirements for IACS service providers), explained
IEC 62443-2-4:2023 Edition 2.0 — the part of the ISA/IEC 62443 series that sets security requirements for system integrators and maintenance providers, its 12 Security Program functional areas, Profiles mechanism, and how it pairs with IEC 62443-2-1.
5 min read Updated
IEC TR 62443-3-1 (security technologies for IACS), explained
What IEC/TR 62443-3-1:2009 actually covers: the eight categories of cybersecurity technology it surveys, the eight-point framework used to assess each one, and why it is the series' most dated part.
6 min read Updated
IEC 62443-3-2 (security risk assessment for system design), explained
IEC 62443-3-2:2020's seven Zone and Conduit Requirements (ZCR 1-7), how zones, conduits and target security levels (SL-T) get set, and how the output hands off to IEC 62443-3-3.
4 min read Updated
IEC 62443-3-3: system security requirements and security levels, explained
ISA/IEC 62443-3-3 explained from the standard's own scope text: the seven foundational requirements, capability vs target vs achieved security levels (SL-C/SL-T/SL-A), and where it sits in the 62443 series.
6 min read Updated
IEC 62443-4-1: the secure product development lifecycle, explained
What IEC 62443-4-1 requires of a maker's development process: its eight practices, maturity levels, SDLA certification, and how it relates to 4-2.
5 min read Updated
IEC 62443-4-2: the four component types and ISASecure CSA certification, explained
IEC 62443-4-2's own component taxonomy — software application, embedded device, host device and network device — plus the four ISASecure CSA assessment elements and capability levels that certify against it.
4 min read Updated
IEC 62443-4-2 vs the Cyber Resilience Act and EN 18031: what overlaps, what doesn't
Where IEC 62443-4-2's seven component requirements overlap with the CRA's Annex I and EN 18031, and why none of them give presumption of conformity yet.
4 min read Updated
IEC 62443 and the Machinery Regulation: using 62443-3-3 and 4-2 as working evidence for Annex III
How IEC 62443-3-3 and 62443-4-2's requirements line up with Machinery Regulation 2023/1230 Annex III 1.1.9 and 1.2.1, and what the Regulation's own text does and does not let you claim from them.
4 min read Updated
IEC 80001-1:2021: risk management for IT-networks incorporating medical devices
What IEC 80001-1:2021 (Edition 2) actually requires of organizations connecting medical devices and health software to IT-networks — the SAFETY/EFFECTIVENESS/SECURITY key properties, the RISK MANAGEMENT FILE, and how it differs from IEC 62304 and IEC 81001-5-1.
6 min read Updated
IEC 81001-5-1: security activities in the health software product life cycle, explained
What IEC 81001-5-1:2021 actually requires: its six security-activity clauses, how it extends IEC 62304 and supports IEC 62443-4-1, FDA's recognition of it, and the Transitional Health Software path.
6 min read Updated
IMDRF N70: principles and practices for legacy medical device cybersecurity
What IMDRF's N70 guidance says about legacy medical devices: its cybersecurity definition of 'legacy,' manufacturer and healthcare-provider recommendations, and how FDA's own legacy-device definition traces back to it.
4 min read Updated
IMDRF's Principles and Practices for Medical Device Cybersecurity, explained
IMDRF/CYBER WG/N60FINAL:2020: what the International Medical Device Regulators Forum's cybersecurity guidance says, its Total Product Life Cycle framing, and how it relates to MDCG 2019-16 and FDA's premarket/postmarket guidance.
6 min read Updated
IMDRF N73: principles and practices for SBOM in medical device cybersecurity
What IMDRF's N73 guidance recommends for medical device software bills of materials: generation, management and sharing across manufacturers, healthcare providers and regulators, and how it relates to FDA's Section 524B SBOM duty.
4 min read Updated
in-toto, explained: supply chain layouts, links and attestations
The in-toto framework for software supply chain integrity: layout and link metadata, the in-toto Attestation Framework's Statement/Predicate model, and how it underpins SLSA provenance.
4 min read Updated
The ioXt Alliance Security Pledge and certification programme, explained
ioXt Alliance's 8-principle Security Pledge, its Base/Android/Mobile/Camera/Speaker/Lighting certification profiles, the self-certification vs. Authorized Lab paths — and its April 2026 selection as the FCC's new U.S. Cyber Trust Mark Lead Administrator.
5 min read Updated
ISO 14971: medical device risk management, explained
What ISO 14971:2019 (Third Edition) actually requires: its ten-clause risk management process, what it excludes, FDA's 2019 recognition and the ISO 14971:2007 transition deadline, and how it relates to ISO/TR 24971 and AAMI SW96.
4 min read Updated
ISO 15118 security: Plug & Charge PKI, TLS, and the SLAC MITM gap
CISA's CVE-2025-12357 advisory confirms an ISO 15118-2 SLAC-pairing flaw lets an attacker inject a man-in-the-middle wirelessly via electromagnetic induction, while the separate Brokenwire attack can abort a charging session from 47 meters using under 1 watt of RF power.
9 min read Updated
ISO 24089 (Road vehicles — Software update engineering), explained
What ISO 24089:2023 actually requires: its organizational, project, infrastructure and campaign-level clauses, how it relates to UN R156 and ISO/SAE 21434, and what the 2024 amendment changed.
6 min read Updated
ISO/IEC 18974 (OpenChain Security Assurance Specification), explained
What ISO/IEC 18974:2023 actually requires: its four top-level clauses, the 18-month conformance window, how it differs from SBOM formats and ISO/IEC 5230, and why the full text is free.
5 min read Updated
ISO/IEC 20243 (O-TTPS): mitigating maliciously tainted and counterfeit products, explained
What ISO/IEC 20243's two parts (requirements and assessment procedures) actually require, how The Open Group's O-TTPS standard became an ISO/IEC standard, its 2015-2023 revision history, and the accreditation program behind it.
5 min read Updated
ISO/IEC 27001:2022 (information security management systems), explained
What ISO/IEC 27001:2022 actually requires: the Annex SL clause 4-10 structure, Annex A's 93 controls across 4 themes, the relationship to ISO/IEC 27002:2022, the certification cycle, and where it does and doesn't map to CRA/NIS2.
6 min read Updated
ISO/IEC 27005:2022 (information security risk management), explained
What ISO/IEC 27005:2022 (4th edition) actually covers: the context/identification/analysis/evaluation/treatment process, its event-based and asset-based approaches, and how it supports (not replaces) ISO/IEC 27001's risk clauses.
4 min read Updated
ISO/IEC 27019: information security controls for the energy utility industry, explained
What ISO/IEC 27019 actually adds on top of ISO/IEC 27002 for energy utility process control systems: scope, exclusions (nuclear, telecom), structure, and what changed in the 2024 edition.
4 min read Updated
ISO/IEC 27035 (information security incident management), explained
What the ISO/IEC 27035 series actually covers: the five-phase incident management process (plan and prepare, detect and report, assess and decide, respond, learn lessons), how its 2023 revision of Parts 1-2 relates to ISO/IEC 27001/27002 and NIST SP 800-61, and where NIS2 guidance cites it.
6 min read Updated
Questions about this page?