62443-2-4

IEC 62443-2-4 — Requirements for service providers

Sets requirements for the security programme of organisations that provide integration and maintenance services to asset owners.

For which role

System integrators and service providers that deliver, install or maintain IACS solutions.

Key topics

•Secure project execution and handover
•Management of remote access by the service provider
•Patch management and change management on behalf of the customer
•Competencies of the service provider's staff

Expected results

•Demonstrable security capabilities of the service provider
•Contractually defined security responsibilities

Relationship to other parts of the standard

Complements -2-1 from the perspective of external parties working on behalf of the asset owner.

Practical example from the energy sector

In a tender, a system integrator demonstrates that remote maintenance sessions on substations always run via a controlled jump host with session recording.