UL 2900-2-2 (industrial control systems cybersecurity), explained

Section 1.1 of the outline states: "This security evaluation outline applies to the evaluation of industrial control systems components." It then lists, "but is not limited to," a long roster of ICS asset types: Programmable Logic Controllers (PLC), Distributed Control Systems (DCS), process control systems, data acquisition systems, historians/data loggers/data storage systems, control servers, SCADA servers, Remote Terminal Units (RTU), Intelligent Electronic Devices (IED), Human-Machine Interfaces (HMI), Input/Output (IO) servers, fieldbuses, and networking equipment for ICS systems — with data radios, smart sensors, controllers, and embedded system/controllers added in a later edition proposal. Section 1.2 draws the same boundary UL 2900-1 draws for the series as a whole: "This outline does not contain any requirements regarding functional testing of products unless where expressly specified" — it tests for vulnerabilities, software weaknesses and malware resistance, not whether the device performs its control function correctly.

The outline's own Introduction states it "refers to" UL 2900-1's general requirements — it is explicitly a Part 2 extension, structured (per its table of contents) around the same broad areas as Part 1: product documentation, risk controls (access control/authentication, remote communication, cryptography, product management), vendor risk management process, known-vulnerability and malware testing, malformed-input and structured penetration testing, and static code/binary analysis.

UL sought American National Standard (ANSI) approval for UL 2900-2-2, the same path UL 2900-1 and UL 2900-2-1 both completed successfully. It did not succeed. Per reporting in ISA's own inTech magazine, an appeal panel convened by UL ruled in favour of an appeal brought by ISA — the International Society of Automation, the standards-development organisation behind the ISA/IEC 62443 series — against UL's bid for ANSI approval. ISA's argument, as reported: UL "failed to follow a key clause in the UL accredited standards procedures that is intended to prevent duplication and overlap," and cybersecurity expert review found the UL document substantially duplicated the already-established ISA/IEC 62443 series covering industrial automation and control systems security.

The practical consequence is durable, not temporary. Per the same reporting, without ANSI approval UL 2900-2-2 is also not eligible to become an internationally recognised standard through the IEC. Independent standards-tracking summaries as recent as 2026 confirm the document is still listed with no recorded ANSI, SCC or DOD approval — a decade after its Issue 1 publication, it remains exactly what it was in March 2016: an Outline of Investigation, not a ratified standard.

The overlap ISA flagged is the same overlap an ICS vendor evaluating UL 2900-2-2 today will notice immediately: technical security requirements for IACS components, secure development lifecycle expectations, and risk-based security levels are already the subject of the much more widely adopted IEC 62443 series — see our guides to IEC 62443-4-1 (secure development lifecycle), IEC 62443-4-2 (component technical requirements), and IEC 62443-3-3 (system security requirements). Where UL 2900-1 and UL 2900-2-1 found a real regulatory foothold through FDA recognition for medical devices, UL 2900-2-2 has no equivalent regulatory anchor in the ICS/OT space — NERC CIP and sector-specific regulation reference IEC 62443 and bespoke frameworks, not UL 2900-2-2.