IEC 62443 Security Levels (SL)
Understand SL-T, SL-C, and SL-A targets, then use QuantLayer to validate capability and measure posture continuously.
Overview
IEC 62443 defines Security Levels (SL) as a measure of confidence that a zone or conduit is free from vulnerabilities and functions as intended. SLs reflect assumed capability and potential threat motivation, driving enhancements.
SL-T, SL-C, SL-A
SL-T (Target): Desired security level for a zone/conduit, derived from risk assessments and documented in the Cybersecurity Requirements Specification (CRS).
SL-C (Capability): What a system or component can provide when properly configured—used to select products and compensating controls.
SL-A (Achieved): Actual security level in operation, measured through continuous monitoring, maintenance, and evidence.
Operationalizing SL in QuantLayer
- Identity strength: hardware-rooted identity, enrollment coverage, credential lifecycle integrity.
- Access posture: least-privilege rules enforced, exceptions tracked, step-up verification when needed.
- Integrity posture: secure boot evidence, firmware/config drift, tamper events, remediation status.
- Segmentation posture: allowed conduits, blocked flow trends, and change approvals.
- Response readiness: alert-to-action timelines, automated containment, and incident reporting.
Example: setting SL-T per zone
- Safety zone: high SL-T, strong integrity monitoring, strict conduit controls, minimal remote access.
- Control zone: high availability requirements, staged enforcement, maintenance-window changes.
- Site DMZ: strong monitoring, brokered services, and tight control of inbound/outbound flows.
- Business/IT zone: standard enterprise controls integrated with OT boundaries and logging.