Assure
IEC 62443 consultancy and project support
Translate an IEC 62443 requirement into a defined system boundary, accountable roles, engineering deliverables and traceable verification evidence.
Start with the role, system and decision
Role and responsibility
Asset owners, service providers, system integrators and product suppliers have different responsibilities. The scope identifies who owns each requirement and who must supply evidence.
System under consideration
Define the control functions, assets, zones, conduits and external services in scope. Interfaces and exclusions remain explicit so assurance decisions are not made against an assumed boundary.
Lifecycle decision
Identify whether the immediate need is readiness, risk assessment, requirements, secure design, supplier review, FAT/SAT evidence or handover close-out.
IEC 62443 is a series, not a single checklist. Applicability follows the organisation's role, the system and product boundaries, the contract and the lifecycle stage.
Choose the right workstream
Different engineering questions need different assessments
IEC 62443 readiness assessment
Establish the system boundary, review available evidence and record prioritised gaps before an assurance programme or project decision.
Explore this engagement routeIEC 62443-aligned OT cybersecurity risk assessment
Identify credible threat scenarios, consequences and proportionate risk treatments for the system under consideration.
Explore this engagement routeHow to prepare for IEC 62443: readiness guide
Review the scope, people, architecture, requirements and evidence that should be assembled before an assessment.
Read the guideHow zones and conduits support OT network segmentation
Understand how assets are grouped and how required communication paths are defined, including brownfield constraints.
Read the explainerFAT and SAT cybersecurity evidence checklist
Plan traceable verification evidence for factory acceptance, site acceptance, handover and unresolved assumptions.
Read the checklistFrom requirement to retained evidence
| Stage | Engineering question | Example artefact |
|---|---|---|
| Definition | What is the system, who is responsible and which requirements apply? | System boundary, responsibility and applicability record |
| Risk and requirements | Which scenarios matter, what is the risk basis and what must the design achieve? | Risk register and cybersecurity requirements specification |
| Design | How do the architecture and supplier responses satisfy the requirements? | Zone-and-conduit model, design review and evidence matrix |
| Verification | What can be demonstrated at FAT, SAT and commissioning? | Test records, configuration extracts, exceptions and action tracker |
| Handover | Which assumptions, deviations and residual risks remain? | Close-out record and accepted residual-risk statement |
Worked example: tracing a supplier requirement
- Requirement
- Vendor remote support must be authorised, time-bound and attributable to an individual.
- Design response
- Show the approved access service, identity source, role, connection path, session controls and log destination.
- Verification
- Test approval, account use, expiry or disablement and the expected audit events. Carry site-dependent routing and logging checks into SAT.
- Evidence record
- Link the requirement to the design documents, test record, configuration extract, exception status and responsible approver.
This is a worked technical example, not a completed Meridian client engagement.
Boundaries
Meridian provides engineering support and review. The work does not confer IEC certification, replace the accountable asset owner or supplier, approve residual risk on the client's behalf, or make every part of the series applicable to every project.
Related support and guidance
Related services
Choose this when your project needs specialist engineering capacity. A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.
Start here if you are unsure what applies or where to begin. Establish the boundary, applicable lifecycle context, available evidence and next engineering work before a detailed IEC 62443 assessment or project decision.
Choose this when you need a detailed view against agreed requirements. Requirement-by-requirement review of current arrangements and evidence against an agreed IEC 62443 baseline, producing a classified gap register and remediation roadmap.
Discuss an IEC 62443 requirement
Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.