Security for industrial automation and control systems - secure product development lifecycle requirements.
The standard specifies process requirements for the secure lifecycle of a product intended for industrial automation and control systems (IACS): security requirements definition, secure design and implementation, verification, defect handling, patch management and product retirement.
It applies to hardware, software and firmware. It is addressed to product manufacturers and maintainers; it does not apply to integrators or end users.
Certification of a manufacturer’s process according to IEC 62443-4-1 means the supplier has a defined process for handling vulnerabilities and delivering patches throughout the device lifecycle - important for a 30-year rolling-stock service life.
