11 module pages
From context to compliance
The IEC 62443 analysis follows a structured workflow: define the SUC, map the zones, assess security levels, and measure compliance.
1
Contexte & SUC
Complete study scoping—administrative information, scope, regulations, and assessment team.
- Study identification Title, facility, organization, reference, version, start date, and end date.
- Description of the System Under Consideration (SUC) Functional and physical scope—what is included in the study and what is excluded.
- Parties prenantes Owner, integrator, operator, and service providers—with roles and responsibilities.
- Applicable regulations IEC 62443, NIS2, and sector-specific directives (energy, water, chemicals, transport).
- Assessment-team composition List of members and roles—included on the report cover page.
- Analysis-level selection One, two, or three ZCR levels—activates the corresponding pages in the menu.
2
SUC diagram
Graphical map of the industrial system—components, communication flows, and IT/OT interfaces.
- Graphical component mapping PLCs, HMIs, sensors, and networks—a visual representation of the industrial system.
- Communication flows Representation of flows between components—protocols, direction, and criticality.
- IT and external interfaces Identification of connection points with the IT network and external systems.
- Drag-and-drop Add components from an OT symbol library—no graphic-design skills required.
- High-resolution SVG export Included in the Word report—with print quality guaranteed.
- Automatic legend by component type PLC, HMI, Historian, Firewall, Switch industriel — codage couleur configurable.
3
ZCR Niveau 1
Initial analysis—definition of Security Zones and communication Conduits, with an SL-T for each zone.
- Zones (Z) and Conduits (C) Definition of security zones and communication conduits at level 1.
- Association composants ↔ zones Assignment of SUC components to each zone—automatically inherited from the diagram.
- SL-T par zone Security Level Target defined by zone according to business needs (SL 1 to SL 4).
- Matrice zones × conduits Visualization of inter-zone flows—identification of critical conduits.
- SUC diagram inheritance Components and flows imported automatically—ensuring consistency across pages.
4
ZCR1 vulnerabilities
Identification and rating of vulnerabilities by zone at level 1—including compensating measures.
- Identification of vulnerabilities by zone Structured inventory for each zone defined at level 1.
- Vulnerability categories Physical access, network, software, configuration, and human factors—IEC 62443 classification.
- Impact × likelihood rating Risk level for each vulnerability—criticality matrix.
- Mesures compensatoires Existing and planned—linked to the remediation plan.
- Link to the remediation plan Remediation actions generated automatically from critical vulnerabilities.
5
ZCR Niveau 2
Analyse approfondie — SL-A vs SL-T, exigences Foundational Requirements IEC 62443-3-3 par zone.
- Subdivision into subzones In-depth analysis—with the option to create subzones for complex systems.
- SL-A assessed by zone Security Level Achieved—direct comparison with the SL-T defined at level 1.
- Exigences FR (Foundational Requirements) IEC 62443-3-3—FR 1 to FR 7 assessed by zone: IAC, UC, SI, DC, RDF, TRE, and RA.
- SL-T vs SL-A gaps Identified and quantified—the basis of the remediation plan.
- Table and radar views by zone Two representations for reviews and executive presentations.
6
ZCR Niveau 3
Detailed analysis of System Requirements (SRs) by zone—with SL-C by component and compliance evidence.
- System Requirements (SR) par zone Detailed analysis of IEC 62443-3-3 requirements for each zone.
- SR compliance by status Compliant / Partially compliant / Non-compliant / N/A—with justification.
- SL-C par composant Security Level Capability assessed component by component using manufacturer datasheets.
- Compliance evidence Documentation, tests, and audits—attachments or references linked to each SR.
- Detailed remediation plan Priorities, estimated resources, and owners—included in the report.
7
Metrics & SL levels
Configuration of security levels SL 1 → 4—mapping tables, overall metrics, and history.
- Configuration SL 1 → 4 Labels, descriptions, colors, and thresholds—adaptable to the sector context.
- Correspondances SL ↔ exigences SL ↔ FR ↔ SR mapping table in accordance with IEC 62443-3-3.
- Overall metrics Average SL, minimum SL, and percentage of compliant zones by level—summary view.
- Assessment history Track progress over time—comparison before and after remediation.
8
Compliance
Overall dashboard—FR 1–FR 7 radar, zone × FR heat map, and SL-T/SL-A/SL-C comparison.
- Overall compliance dashboard Compliance percentage by zone, FR, and SL level—executive view.
- Compliance radar by FR FR 1 (IAC) to FR 7 (RA)—visual identification of deficient Foundational Requirements.
- Zone × FR heat map Instant identification of weak points—color-coded by compliance level.
- Comparaison SL-T / SL-A / SL-C par zone Consolidated view of all three levels in one table.
- Automatic gap generation List of gaps to close—exported to the remediation plan.
9
Pilotage
Remediation-measure tracking—owners, deadlines, and statuses—with dynamic SL-A updates.
- Remediation-measure tracking Owner, deadline, and status (In progress / Completed / Overdue) for each measure.
- Indicateurs d'avancement Completed / ongoing / overdue measures—operational dashboard.
- Automatic SL-A update The SL-A is recalculated after measures are implemented—making progress visible.
- Simplified Gantt view Timeline view of the remediation plan—identification of critical milestones.
10
IEC 62443 report
Complete IEC 62443-compliant report generated in one click—with editable Markdown sections and Word and Excel exports.
- Complete report in one click IEC 62443-compliant—SUC context, diagram, ZCR zones, compliance, and remediation plan.
- Editable Markdown sections Each section contains customizable text with tokens
{variable}. - Styles Word configurables Font, colors, header, and footer—profile saved by organization.
- Export Excel Compliance matrices and remediation plan—with formulas and filters.
- Embedded SUC diagram High-resolution SVG automatically included in the Word report.
Sections disponibles : Cover page, SUC context, diagram, level 1/2/3 ZCR analysis, compliance table, FR radar, heat map, remediation plan, and conclusion.
11
Library
Standard OT components, vulnerabilities, and IEC 62443-recommended compensating measures—shared across the group.
- Standard OT component library PLCs, HMIs, industrial switches, OT firewalls, sensors, and historians—ready to use.
- Standard vulnerability library By component type and sector—enhanced by the IEC 62443 community.
- Compensating-measure library IEC 62443 recommendations by FR, SL level, and component type.
- Import from group libraries Share reference data across projects in the same organization.
- Partage inter-projets Approved business standards shared across the organization—capitalizing on expertise.
