Representative engagement
IEC 62443 Gap Assessment for a Control-System Upgrade
A representative IEC 62443 gap assessment for a control-system upgrade where project requirements exist but responsibility and evidence are not yet traceable.
Client profile
Regulated industrial operator
Client situation
An industrial operator was progressing a control-system upgrade where IEC 62443 requirements had been referenced within project documentation. The project team had already produced substantial engineering information, but it was unclear how individual cybersecurity requirements mapped to the System under Consideration, which party was responsible for satisfying them, and what evidence would ultimately be required for acceptance. The client needed a traceable relationship between requirements, design decisions, verification activities and project evidence.
The engagement
What the client needed
- confirm the assessment boundary and System under Consideration
- clarify asset-owner, integrator and supplier responsibilities
- agree the IEC 62443 assessment profile, publications and exclusions
- review existing evidence against the agreed requirements
- define additional verification needed through design review, FAT, SAT and handover
How Meridian would approach it
- establish the System under Consideration, external interfaces and relevant lifecycle context before assessing individual requirements
- agree the applicable requirement baseline and responsibility for each item
- map existing documents and engineering evidence against the agreed profile
- classify requirements as demonstrated, partially demonstrated, not demonstrated or outside the agreed scope
- turn incomplete evidence into specific engineering, verification or ownership actions rather than a generic compliance finding
What the client would receive
- applicability and responsibility record
- System under Consideration definition
- requirements and evidence matrix
- classified gap register
- prioritised verification and remediation plan
What this would enable
Client outcome
The project team would receive a traceable requirements-and-evidence baseline, defined responsibility boundaries and a prioritised gap register that could be worked through alongside the remaining engineering programme.
Representative engagement: this scenario is based on common industrial requirements and shows how Meridian would approach the work. It is not presented as a completed client engagement.
From example to a defined engagement
Related services
Choose this when you need a detailed view against agreed requirements. Requirement-by-requirement review of current arrangements and evidence against an agreed IEC 62443 baseline, producing a classified gap register and remediation roadmap.
Have a defined OT or IEC 62443 question?
Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.