Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control and IEC 62443

Physical enforcement of industrial automation security.

IEC 62443 defines zone and conduit requirements for industrial control system security. Control enforces those zones physically, and evidences every conduit.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The problem

Software-only zone enforcement falls short.

Zones defined in software are only as strong as the last configuration change.

  1. Zone boundaries are physical, not logical.

  2. Every conduit between zones requires multi-party authorisation.

  3. Automated logging generates continuous evidence that can help support IEC 62443 assessments.

Problem 1

Logical vs physical zones.

Zones are often enforced with firewalls and VLANs that can be bypassed through misconfiguration or compromise.

Answered byPhysical zone enforcement

Problem 2

Purdue model erosion.

Hierarchical separation erodes as organisations connect Level 3 systems to cloud services.

Answered byConduit control

The mapping

Where IEC 62443-3-3 requirements meet Control modules.

System requirements from IEC 62443-3-3, each mapped to the modules that enforce or evidence it.

IEC 62443-3-3 requirement Control modules How Control helps
SR 1.1Human user identification
  • Lock
 Named identity required for any reach into a protected zone.
SR 1.13Access via untrusted networks
  • Relay
  • Lock
 Remote vendor reach is a time-bound, scoped session, not a standing tunnel.
SR 2.1Authorisation enforcement
  • Execute
  • Lock
 Privileged actions require explicit approval before the path opens.
SR 2.8Auditable events
  • Validate
  • Anchor
 Every governed action is captured and sealed beyond casual edit.
SR 3.1Communication integrity
  • Validate
 Conduit state is continuously attested with cryptographic evidence.
SR 3.4Software and information integrity
  • Anchor
  • Validate
 Golden images and operational data live in tamper-evident offline copies.
SR 4.1Information confidentiality
  • Transfer
  • Lock
 Sensitive data crosses boundaries only through governed Transfer events.
SR 5.1Network segmentation
  • Fracture
  • Isolate
 Zone boundaries are physically severed by default.
SR 5.2Zone boundary protection
  • Isolate
  • Relay
  • Execute
 Cross-zone reach is a named, time-bound conduit with explicit approval.
SR 6.1Audit log accessibility
  • Validate
  • Anchor
 Audit and conduit state remain readable from a side channel, even during an incident.
SR 6.2Continuous monitoring
  • Validate
 Continuous attestation surfaces boundary drift before it becomes an incident.
SR 7.3Control system backup
  • Anchor
  • Transfer
 Recovery copies sit in an offline vault, off the live network.
SR 7.4Control system recovery and reconstitution
  • Execute
  • Validate
 Restoration is an authorised, evidenced action with quorum approval.

Alignment, not certification. Control can help support these measures; your assessor decides what satisfies them.

The scenario

Scenario: a zone boundary failure found at audit.

A zone boundary in software exists only as long as the firewall rules are correct. Step through it, or play it through.

Step 1 of 2

Without physical evidence

During an IEC 62443 certification audit, the assessor finds that a firewall rule change made three months earlier had created a path between zones.

It passed change management without flagging the boundary violation, and for three months the control system zone was reachable from the enterprise network.

Boundaries
Logical, configured in software
Evidence
Point-in-time, at each audit

An illustrative scenario.

Capabilities

What you get with every deployment.

Six things Control gives a IEC 62443 programme, from the first boundary to the audit afterwards.

IEC 62443

Physical zone enforcement

Zone boundaries are physical, not logical.

IEC 62443

Conduit control

Every conduit between zones requires multi-party authorisation.

IEC 62443

Continuous evidence

Automated logging generates continuous evidence that can help support IEC 62443 assessments.

IEC 62443

Purdue model alignment

Control modules map to Purdue model levels.

IEC 62443

Audit-ready logs

Tamper-evident logs record every zone boundary state change.

IEC 62443

Evidence preservation

Compliance records are held independently of production systems.

Adoption guide

From gap assessment to continuous evidence.

  1. 1

    Zone and conduit assessment

    Map your current IEC 62443 zone architecture.

  2. 2

    Physical zone design

    Design physically enforced zone boundaries, with Control modules at each conduit.

  3. 3

    Compliance validation

    Deploy at a representative zone boundary with full evidence generation.

  4. 4

    Full zone enforcement

    Physical enforcement across all zone boundaries, with continuous evidence.

Questions

What teams ask about Control and IEC 62443

Mainly IEC 62443-3-3 system requirements, as the mapping shows, with zone and conduit design aligned to IEC 62443-3-2.

Talk to the team about your target security levels. Physical zone boundaries and governed conduits can help support the higher levels, and your assessor decides.

Yes. Firewalls keep inspecting traffic on paths that exist; Control decides whether the path exists.

Every zone boundary state change and conduit activation is logged with who approved it, and held independently of production systems.

All questions

Map Control to your regulator’s language.

Walk through IEC 62443 with the Firevault team and see where physical evidence fits your programme. Alignment, not certification.