scope:

This technical specification identifies the relevant aspects of the IEC 62443 series related to security threats and vulnerabilities that are considered for the design and implementation of safety-related control systems (SCS) which can lead to the loss of the ability to maintain safe operation of a machine.

Typical security aspects related to the machine with potential relation to SCS are:

- vulnerabilities of the SCS either directly or indirectly through the other parts of the machine which can be exploited by security threats that can result in security attacks (security breach);

- influence on the safety characteristics and ability of the SCS to properly perform its function(s);

- typical use case definition and application of a corresponding threat model.

Non-safety-related aspects of security threats and vulnerabilities are not considered in this document.

NOTE Non-safety-related parts of the machine control system can also be affected by security threats with possible impact on operation of a machine, such as productivity, performance or quality. For these aspects, refer to the IEC 62443 series.

The focus of this document is on intentional malicious actions. However, intentional hardware manipulation (e.g. wiring, exchange of components) or foreseeable misuse by physical manipulation of SCS (e.g. physical bypass) is not considered in this document.

This document does not cover security requirements for information technology (IT) products and for the design of devices used in the SCS (e.g., product specific standards can be available, such as IEC TS 63208).