Compliance FrameworksInternational
IEC 62443-4-2
Component Security Requirements: software integrity, non-repudiation, component provenance.
Component Security Requirements: software integrity, non-repudiation, component provenance.
| Short name | 62443-4-2 |
| Region | International |
| Country or scope | International |
| Sector | Energy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers 62443-4-2
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 15 controls from Safeguard's control catalog for 62443-4-2.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for 62443-4-2 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
IEC62443-4-2-CR7.8 Component Inventory Reporting | Components must support being reported as part of the control system component inventory (IEC 62443-4-2 CR 7.8) | Scan |
IEC62443-4-2-CR3.4 Software and Information Integrity | The component must support verification of the integrity of its software and information, requiring integrity hashes for constituent software (IEC 62443-4-2 CR 3.4) | Scan |
IEC62443-4-2-CR3.4-AUTH Software Authenticity and Provenance | Integrity verification should extend to authenticity of the software source, requiring a named supplier for each component (IEC 62443-4-2 CR 3.4 enhancement on authenticity) | Scan |
IEC62443-4-2-CR2.12 Non-Repudiation of Origin | Non-repudiation requirements imply that the origin and creator of the component's software bill of materials must be recorded and attributable (IEC 62443-4-2 CR 2.12) | Scan |
IEC62443-4-2-VER Component Version Disclosure | Inventory reporting is only useful for defect and patch management when each constituent component carries its version (IEC 62443-4-2 CR 7.8 inventory content) | Scan |
IEC62443-4-2-UID Unambiguous Component Identification | Component security requirements presuppose that each software constituent can be unambiguously identified, e.g. via a package URL (IEC 62443-4-2 component identification requirements) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
CR 1.1 | Component Human User Identification and Authentication |
CR 1.5 | Authenticator Management |
CR 1.8 | Public Key Infrastructure Certificates |
CR 1.14 | Strength of Authentication |
CR 2.1 | Authorization Enforcement at Component Level |
CR 2.8 | Auditable Events at Component Level |
CR 2.12 | Non-Repudiation at Component Level |
CR 3.1 | Communication Integrity at Component Level |
CR 3.4 | Software and Information Integrity |
CR 3.8 | Session Integrity |
CR 3.14 | Integrity of Boot Process |
CR 4.1 | Information Confidentiality at Component Level |
CR 7.2 | Resource Availability |
CR 7.6 | Network and Security Configuration at Component Level |
CR 7.8 | Control System Component Inventory Reporting |
Policy templates
Written for 62443-4-2:
- IACS Component Security Requirements Policy
- IACS Component Secure Configuration and Hardening Policy
And 22 from the standard set, adapted to 62443-4-2.