The seven Foundational Requirements (FRs) form the foundation of IEC 62443. All detailed requirements in IEC 62443-3-3 (system level) and IEC 62443-4-2 (component level) are organised around these seven categories. Anyone who understands the FRs can place the rest of the standard much faster.
The seven requirements in brief
- Identification and Authentication Control (FR1) — know who or what requests access, before you grant access.
- Use Control (FR2) — determine what an authenticated user is actually allowed to do.
- System Integrity (FR3) — protect systems and data against unauthorised manipulation.
- Data Confidentiality (FR4) — protect sensitive information against unauthorised disclosure.
- Restricted Data Flow (FR5) — segment the network into zones and conduits.
- Timely Response to Events (FR6) — detect and respond to security events in a timely manner.
- Resource Availability (FR7) — ensure that systems withstand disruption and remain available.
Why this division is handy
Instead of thinking in separate technical measures, the FR division helps to place a vulnerability or measure within a broader security goal. A hardcoded password in firmware, for example, directly touches FR1 (identification and authentication), while missing network segmentation between office IT and a substation touches FR5. This division is also used in the vulnerability database of this platform to indicate which FRs are relevant to a specific CVE.
From FR to Security Level
For each FR, IEC 62443-3-3 and -4-2 work out concrete requirements per Security Level. FR1 (identification and authentication), for example, grows from "unique identification of users" at SL 1 to "multi-factor authentication for critical functions" at higher levels.
Practical example from a substation
When assessing a new station controller, each FR is checked to see whether the device meets the requirements set: does it support individual accounts (FR1)? Can access be restricted per role (FR2)? Are firmware updates cryptographically verified (FR3)? Is management traffic encrypted (FR4)? Does the device support network segmentation at port level (FR5)? Does it generate usable logging (FR6)? And does it keep functioning when the connection to the control centre is lost (FR7)?
See the interactive FR visualisation for extensive examples, common mistakes and implementation tips per requirement.