Industrial switchgear and control infrastructure

Services

IEC 62443 Gap Assessment

Requirement-by-requirement review of current arrangements and evidence against an agreed IEC 62443 baseline, producing a classified gap register and remediation roadmap.

Discuss a Gap Assessment View services

Agree the requirement baseline before assessing gaps

A gap assessment compares the current state with an agreed set of requirements. The first task is to establish the organisation's role, the system or product boundary, applicable publications and editions, contractual requirements, responsibilities and exclusions.

Without that baseline, a long checklist can misclassify requirements, assign responsibility to the wrong party or imply that every part of the IEC 62443 series applies in the same way.

Inputs used to set the baseline

Your organisation’s role, system or product boundary and relevant customer specifications
Agreed requirements and available policies, design records, risk assessments and verification evidence
Access to responsible engineering, operational, supplier or product-development representatives through an agreed confidential channel

Missing evidence is not automatically a failed control. The gap register records whether a requirement is unmet, evidence is unavailable, applicability is unresolved or the item sits outside the agreed scope.

Five assessment profiles within one service

Select one profile or combine profiles where the organisation holds more than one responsibility. The scope must name the publication and edition, assessed boundary, exclusions and responsibility split.

Asset owner programme

IEC 62443-2-1

Governance, policies, accountable roles, operational practices and programme evidence.

Integrator or service provider

IEC 62443-2-4

Security processes and evidence for integration, maintenance and other IACS service activities.

System risk and security

IEC 62443-3-2 and 3-3

System risk assessment, zones and conduits, security requirements and system capability evidence.

Secure product development

IEC 62443-4-1

Secure development lifecycle processes and the records produced through them.

Component requirements

IEC 62443-4-2

Technical security capabilities for an IACS component within the stated product boundary.

These are assessment profiles within the IEC 62443 Gap Assessment. They are not separate products, and an assessment does not provide certification or guarantee compliance.

Gap assessment focus by organisational role

Asset Owner / Operator

Owns or operates the industrial system and remains accountable for operational risk, governance and acceptance decisions.

Typical organisations

Utilities and infrastructure operators · Process and manufacturing site operators · Owners of operational technology estates

Common trigger

A programme, site or project needs a clear responsibility boundary, risk basis and evidence plan.

IEC 62443 context

• IEC 62443-2-1 for the asset owner security programme
• IEC 62443-3-2 and 3-3 for system risk, design requirements and verification

Relevant technical capabilities

Assess Risk Segment Assure

Problems this role often needs to resolve

IEC 62443 Requirements and Evidence Poor Asset Visibility Project Cybersecurity Assurance

• Asset owner programme against an agreed IEC 62443-2-1 profile
• System risk and security requirements against agreed IEC 62443-3-2 and 3-3 requirements

Start with a readiness review

System Integrator / IACS Service Provider

Designs, integrates, commissions or maintains industrial automation systems within an agreed customer and project scope.

Typical organisations

Control system integrators · Automation and electrical contractors · IACS maintenance and support providers

Common trigger

Customer requirements must be translated into delivery processes, engineering records and acceptance evidence.

IEC 62443 context

• IEC 62443-2-4 for security programme requirements for IACS service providers
• IEC 62443-3-2 and 3-3 where the scope includes system risk, design or verification

Relevant technical capabilities

Assure Assure Document Segment

Problems this role often needs to resolve

Supplier Package Integration Project Cybersecurity Assurance IEC 62443 Requirements and Evidence

• Integrator or service-provider processes against an agreed IEC 62443-2-4 profile
• System delivery evidence against agreed IEC 62443-3-2 and 3-3 requirements

Discuss engineering support

Product Supplier / Product Developer

Develops or supplies industrial automation products and is responsible for the product lifecycle and stated component capabilities.

Typical organisations

Industrial software developers · Control and protection product suppliers · Component and embedded-device developers

Common trigger

A product roadmap, customer requirement or assurance review needs a defined development and component evidence baseline.

IEC 62443 context

• IEC 62443-4-1 for the secure product development lifecycle
• IEC 62443-4-2 for technical security requirements of IACS components where applicable

Relevant technical capabilities

Assure Document Assure

Problems this role often needs to resolve

IEC 62443 Requirements and Evidence Project Cybersecurity Assurance

• Secure product development against an agreed IEC 62443-4-1 profile
• Component capabilities against agreed IEC 62443-4-2 requirements

Discuss a gap assessment

OEM / Machine Builder / Package Supplier

Delivers a machine or packaged system that combines products, integration work and project-specific interfaces.

Typical organisations

Machine builders · Skid and package-system suppliers · OEM engineering and delivery teams

Common trigger

A packaged system must meet customer requirements and integrate into the site without unclear responsibility or evidence gaps.

IEC 62443 context

• IEC 62443-2-4 where the organisation performs integration or service-provider activities
• IEC 62443-3-2 and 3-3 for the packaged system where system responsibilities are in scope
• IEC 62443-4-1 and 4-2 only where the organisation develops products or claims component capabilities

Relevant technical capabilities

Assure Assure Document Segment

Problems this role often needs to resolve

Supplier Package Integration Project Cybersecurity Assurance Insecure Remote Access

• Select an agreed profile from IEC 62443-2-4, 3-2, 3-3, 4-1 or 4-2 according to the actual role
• Separate package evidence from site-dependent requirements and exclusions

Start with a readiness review

The applicable IEC 62443 publications and requirements depend on the organisational role, system or product boundary, lifecycle stage, contractual requirements and agreed scope. These references do not state certification or compliance.

Assessment and gap classification

1.Establish the current state
2.Agree relevant requirements and responsibilities
3.Identify gaps
4.Record supporting and missing evidence
5.Define remediation actions
6.Agree a prioritised roadmap

Supported

The evidence demonstrates the requirement within the assessed boundary and lifecycle stage.

Gap or weakness

The current arrangement does not meet the agreed requirement, or the control design is materially deficient.

Unresolved evidence

The control may exist, but the review cannot establish it from the available record. A named evidence action is required.

Worked example: supplier account management evidence

Requirement	Evidence reviewed	Finding	Closure evidence
Privileged engineering activity uses individually attributable accounts.	Account list, role configuration, FAT procedure and sample security log.	Named accounts are configured, but the FAT procedure does not test attribution and one shared support account remains enabled.	Approved disposition for the shared account plus revised test record showing user identity, assigned role and generated log event.

This is a worked technical example, not a completed Meridian client engagement.

Outputs and boundaries

Assessment outputs

Applicability and responsibility record for the agreed requirements
Assessment matrix linking requirements, current state and evidence
Gap register distinguishing deficiencies, unavailable evidence and items outside scope
Prioritised remediation actions with proposed owners and dependencies for agreement
Roadmap, written report and findings workshop

Outside the assessment

Formal certification or acting as an accredited certification body
A claim that the whole IEC 62443 series applies to every organisation or product
Implementation, intrusive testing or a separate detailed risk assessment unless separately scoped

Compare the other engagement routes

OT Cybersecurity Engineering Support

Choose this when your project needs specialist engineering capacity.

IEC 62443 Readiness Review

Start here if you are unsure what applies or where to begin.

Related capabilities and guidance

Discuss the scope with Meridian

Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.

Discuss a Gap Assessment