Recent Breaches
Breaches
View All →
IEC 62443

Physical Enforcement of Industrial Automation Security

IEC 62443 defines zone and conduit requirements for industrial control system security. Firevault Control provides the physical enforcement layer that ensures zones are truly separated and conduits are genuinely controlled.

Back to Control
Control

IEC 62443

IEC 62443 requires zones and conduits. If those zones are defined by firewall rules rather than physical separation, every firewall misconfiguration is a potential zone boundary failure.

SL 4

Security Level achievable with physical enforcement

100%

Zone boundary physical enforcement

9

Control modules mapping to IEC 62443 requirements

Full

Automated compliance evidence generation

The Compliance Gap

Software-only zone enforcement falls short.

Logical vs Physical Zones

IEC 62443 defines zones and conduits, but most implementations rely on firewalls and VLANs that can be bypassed through misconfiguration or compromise.

Purdue Model Erosion

The Purdue model's hierarchical separation erodes as organisations connect Level 3 systems to cloud services and remote access platforms.

Evidence Gaps

Demonstrating continuous zone enforcement to auditors is difficult when boundaries are defined in software configurations that change frequently.

The Scenario

Scenario: Zone Boundary Failure During Audit

During an IEC 62443 certification audit, the assessor discovers that a firewall rule change made three months earlier had inadvertently created a path between Level 2 (control system) and Level 4 (enterprise) zones. The change was part of a routine maintenance update and had passed through the change management process without flagging the zone boundary violation. For three months, the control system zone was directly reachable from the enterprise network. With Firevault Control, zone boundaries are physical. No software change, configuration error, or routine maintenance can create a path between zones without explicit, multi-party authorised physical activation.

"We passed our IEC 62443 assessment in January. By April, a routine firewall change had created a path from our enterprise zone directly into the control system zone. Nobody noticed for three months. The zone boundary existed only as long as the firewall rules were correct."

IEC 62443 mapping

Where IEC 62443 system requirements meet Control modules.

IEC 62443-3-3 defines seven foundational requirements and the system requirements (SR) beneath them. Firevault Control supplies the physical enforcement that turns those requirements from configurable intent into a boundary that holds.

Reference: IEC 62443-3-3:2013 System security requirements and security levels, mapped against the foundational requirements FR 1 to FR 7.

SEC 01

FR 1 - Identification and Authentication Control

Know who is acting before granting reach.

  • SR 1.1

    Human user identification

    Named identity required for any reach into a protected zone.

    Lock
  • SR 1.13

    Access via untrusted networks

    Remote vendor reach is a time-bound, scoped session, not a standing tunnel.

    RelayLock
SEC 02

FR 2 - Use Control

Authorise the action, not just the user.

  • SR 2.1

    Authorisation enforcement

    Privileged actions require explicit approval before the path opens.

    ExecuteLock
  • SR 2.8

    Auditable events

    Every governed action is captured and sealed beyond casual edit.

    ValidateArchive
SEC 03

FR 3 - System Integrity

Prove the system is in the expected state.

  • SR 3.1

    Communication integrity

    Conduit state is continuously attested with cryptographic evidence.

    Validate
  • SR 3.4

    Software and information integrity

    Golden images and operational data live in tamper-evident offline copies.

    ArchiveValidate
SEC 04

FR 4 - Data Confidentiality

Restrict what data can be reached, not just by whom.

  • SR 4.1

    Information confidentiality

    Sensitive data crosses boundaries only through governed Transfer events.

    TransferLock
SEC 05

FR 5 - Restricted Data Flow

Zones and conduits as physical fact, not policy.

  • SR 5.1

    Network segmentation

    Zone boundaries are physically severed by default. The path does not exist until it is opened.

    FirebreakIsolate
  • SR 5.2

    Zone boundary protection

    Cross-zone reach is a named, time-bound conduit with explicit approval.

    IsolateRelayExecute
SEC 06

FR 6 - Timely Response to Events

See and respond before the blast widens.

  • SR 6.1

    Audit log accessibility

    Audit and conduit state remain readable from a side channel even during an incident.

    ValidateArchive
  • SR 6.2

    Continuous monitoring

    Continuous attestation surfaces boundary drift before it becomes an incident.

    Validate
SEC 07

FR 7 - Resource Availability

Recover from intentional and unintentional events.

  • SR 7.3

    Control system backup

    Recovery copies sit in an offline vault that is not reachable on the live network.

    ArchiveTransfer
  • SR 7.4

    Control system recovery and reconstitution

    Restoration is an authorised, evidenced action with quorum approval.

    ExecuteValidate

Modules & symbols

LockNamed access
RelayTime-bound path
ExecuteApproved action
ValidateIntegrity check
ArchiveDisconnected copy
TransferControlled move
FirebreakPhysical sever
IsolateZone boundary
Direct mapModule satisfies clause

Featured In

TechRadar ProSecurity BuyerYahoo FinanceSecurityBriefChannel Insider

Key Capabilities

Physical Zone Enforcement

Zone boundaries are physical, not logical. No software change can create an unauthorised path between zones regardless of privilege level.

Conduit Control

Every conduit between zones requires multi-party authorisation, operates within defined time windows, and generates full audit evidence.

Continuous Evidence

Automated logging generates continuous IEC 62443 compliance evidence, eliminating the gap between point-in-time assessments.

Purdue Model Alignment

Control modules map directly to Purdue model levels, providing clear, auditable alignment between your architecture and the standard.

Audit-Ready Logs

Tamper-proof logs record every zone boundary state change, conduit activation, and access authorisation for assessor review.

Evidence Preservation

Tamper-evident compliance records are held independently of production systems so audit evidence persists through compromise.

Demo to Live

Adoption Guide

Step 1

Zone and Conduit Assessment

Map your current IEC 62443 zone architecture and identify where logical boundaries should be replaced with physical enforcement.

Step 2

Physical Zone Design

Design physically enforced zone boundaries with Control modules at each conduit, aligned to your target Security Level.

Step 3

Compliance Validation

Deploy in a representative zone boundary with full evidence generation to validate compliance claims before your next assessment.

Step 4

Full Zone Enforcement

Physical enforcement across all zone boundaries with continuous compliance evidence and tamper-proof audit archives.

Step 1

Zone and Conduit Assessment

Map your current IEC 62443 zone architecture and identify where logical boundaries should be replaced with physical enforcement.

Step 2

Physical Zone Design

Design physically enforced zone boundaries with Control modules at each conduit, aligned to your target Security Level.

Step 3

Compliance Validation

Deploy in a representative zone boundary with full evidence generation to validate compliance claims before your next assessment.

Step 4

Full Zone Enforcement

Physical enforcement across all zone boundaries with continuous compliance evidence and tamper-proof audit archives.

Questions

Frequently Asked

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy

    Iec 62443

    How Firevault Control aligns with IEC 62443 industrial automation security standards.

    © 2026 Firevault Limited. Disconnect to Protect®