Frameworks
Secure industrial automation and control systems with IEC 62443
Securing operational technology without a structured method leaves production lines, utilities and plants exposed.
Tidal brings IEC 62443 into your compliance programme. Assess risk per zone and conduit, set target security levels, and evidence each system requirement against them.
These companies run their compliance on Tidal Control
IEC 62443 in depth
IEC 62443-3-2 sets out how to assess the security risk of an industrial system during design: identify the system under consideration, carry out an initial risk assessment, partition it into zones and conduits, assess the detailed risk per zone and conduit, document the security requirements, assumptions and constraints, and have the asset owner approve the result. Its 32 requirements fall under seven zone and conduit requirement groups (ZCR 1 to ZCR 7).
In practice the zone model often exists as a network drawing and the risk assessment as a separate spreadsheet. When the two drift apart, nobody can say which target security level applies to which part of the plant.
In Tidal each zone and conduit can be an asset with its own risk assessment and target security level, so the design decisions and the risks behind them stay together.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Go beyond IEC 62443
Explore frameworks that complement your OT security programme.
NIST SP 800-82
Want guidance on OT security across the organisation? NIST SP 800-82 Revision 3 tailors the SP 800-53 controls to operational technology.
NIS2
Running critical infrastructure in the EU? NIS2 sets the duty of care that IEC 62443 helps you meet for your OT environment.
CRA
Manufacturing industrial components? The Cyber Resilience Act sets the product security requirements for the EU market.
ISO 27001
Need a management system around your OT controls? ISO 27001 adds governance, risk management and continual improvement.
Integrate with your existing tools
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
IEC 62443 is a series of international standards for the security of industrial automation and control systems (IACS). It covers the whole lifecycle and every role involved: the asset owner who runs the system, the system integrator who builds it and the product supplier who makes the components.
Tidal supports two parts, each as its own framework. IEC 62443-3-2:2020 covers security risk assessment for system design, with 32 zone and conduit requirements in seven groups. IEC 62443-3-3:2019 covers system security requirements and security levels, with 51 system requirements and 49 requirement enhancements, 100 references in total. The parts are certified separately, which is why each is its own framework.
A zone is a group of assets with the same security requirements, such as a control network or a safety system. A conduit is the communication path between zones. IEC 62443-3-2 has you divide the system into zones and conduits, assess the risk for each, and set a target security level that IEC 62443-3-3 then turns into requirements.
IEC 62443 defines four security levels. SL 1 protects against casual or accidental violation, SL 2 against intentional violation with simple means, SL 3 against sophisticated means with moderate resources and SL 4 against sophisticated means with extended resources. In IEC 62443-3-3 each system requirement and requirement enhancement applies from a given security level, so a higher target level adds requirements rather than changing them.
Yes. Certification schemes such as ISASecure and the IECEE CB scheme certify systems, products and processes against parts of the series. IEC 62443-3-3 backs the ISASecure system certification, for example. Tidal keeps the evidence per requirement so you can bring it to whichever scheme your customers ask for.
Many organisations that run OT fall under NIS2 or the Cbw, and manufacturers of industrial components fall under the Cyber Resilience Act. Neither law names IEC 62443, but its risk assessment and system requirements are a recognised way to meet their duty of care and product requirements for industrial environments. Tidal lets you map them onto each other.