Operations and asset management team reviewing industrial control system priorities

Stakeholders

Organisational responsibilities and the people involved

IEC 62443 responsibilities follow the organisation's role in the lifecycle. People and functions within those organisations then turn requirements into decisions, engineering work and evidence.

OperationsEngineeringAssuranceLeadershipSuppliers

Which organisational responsibility applies?

Use the organisation's actual responsibility for the assessed system, service or product. A company may hold more than one role, but each boundary and responsibility must be stated clearly.

Asset Owner / Operator

Owns or operates the industrial system and remains accountable for operational risk, governance and acceptance decisions.

Typical organisations

Utilities and infrastructure operators · Process and manufacturing site operators · Owners of operational technology estates

Common trigger

A programme, site or project needs a clear responsibility boundary, risk basis and evidence plan.

IEC 62443 context

• IEC 62443-2-1 for the asset owner security programme
• IEC 62443-3-2 and 3-3 for system risk, design requirements and verification

Relevant technical capabilities

Assess Risk Segment Assure

Problems this role often needs to resolve

IEC 62443 Requirements and Evidence Poor Asset Visibility Project Cybersecurity Assurance

Start with a readiness review

System Integrator / IACS Service Provider

Designs, integrates, commissions or maintains industrial automation systems within an agreed customer and project scope.

Typical organisations

Control system integrators · Automation and electrical contractors · IACS maintenance and support providers

Common trigger

Customer requirements must be translated into delivery processes, engineering records and acceptance evidence.

IEC 62443 context

• IEC 62443-2-4 for security programme requirements for IACS service providers
• IEC 62443-3-2 and 3-3 where the scope includes system risk, design or verification

Relevant technical capabilities

Assure Assure Document Segment

Problems this role often needs to resolve

Supplier Package Integration Project Cybersecurity Assurance IEC 62443 Requirements and Evidence

Discuss engineering support

Product Supplier / Product Developer

Develops or supplies industrial automation products and is responsible for the product lifecycle and stated component capabilities.

Typical organisations

Industrial software developers · Control and protection product suppliers · Component and embedded-device developers

Common trigger

A product roadmap, customer requirement or assurance review needs a defined development and component evidence baseline.

IEC 62443 context

• IEC 62443-4-1 for the secure product development lifecycle
• IEC 62443-4-2 for technical security requirements of IACS components where applicable

Relevant technical capabilities

Assure Document Assure

Problems this role often needs to resolve

IEC 62443 Requirements and Evidence Project Cybersecurity Assurance

Discuss a gap assessment

OEM / Machine Builder / Package Supplier

Delivers a machine or packaged system that combines products, integration work and project-specific interfaces.

Typical organisations

Machine builders · Skid and package-system suppliers · OEM engineering and delivery teams

Common trigger

A packaged system must meet customer requirements and integrate into the site without unclear responsibility or evidence gaps.

IEC 62443 context

• IEC 62443-2-4 where the organisation performs integration or service-provider activities
• IEC 62443-3-2 and 3-3 for the packaged system where system responsibilities are in scope
• IEC 62443-4-1 and 4-2 only where the organisation develops products or claims component capabilities

Relevant technical capabilities

Assure Assure Document Segment

Problems this role often needs to resolve

Supplier Package Integration Project Cybersecurity Assurance Insecure Remote Access

Start with a readiness review

The applicable IEC 62443 publications and requirements depend on the organisational role, system or product boundary, lifecycle stage, contractual requirements and agreed scope. These references do not state certification or compliance.

People and functions we work with

These pages describe the people involved in delivery and decision-making. They do not assign the organisation's IEC 62443 role.

Operations and asset management team reviewing industrial control system availability and support priorities

Operations & Asset Management

For teams balancing availability, safe change and long-term support across legacy systems, supplier access, backups and limited outage windows.

Review support

Engineering and design team reviewing industrial control system architecture and project evidence

Engineering & Design Teams

For project engineers who need cybersecurity requirements translated into architecture decisions, supplier actions and FAT/SAT evidence.

Review support

OT and cybersecurity team reviewing network visibility, segmentation and remote access controls

OT & Cybersecurity Teams

For teams examining asset visibility, trust boundaries, remote access and exposure across brownfield control networks.

Review support

Compliance and assurance team reviewing traceable OT cybersecurity evidence and action close-out

Compliance & Assurance

For teams that need requirements, evidence, exceptions and open actions traced through review and close-out.

Review support

Senior Leadership

For leaders deciding which OT risks need immediate action, planned investment or explicit residual-risk acceptance.

Review support

Vendor and system integrator team preparing industrial cybersecurity deliverables and review responses

Supplier & Integration Project Teams

For people working in system integrators, product suppliers, OEMs and package suppliers. The organisation's IEC 62443 responsibility is identified separately before requirements are assigned.

Review support

Not every team needs the same cybersecurity support

A single OT cybersecurity issue can affect multiple teams in different ways. A flat industrial network may represent an architecture concern for engineering teams, an availability risk for operations, an assurance gap for compliance teams, and an investment decision for leadership.

Meridian helps teams agree the system boundary, assess the impact of proposed changes and record who owns each action.