Arcanum Technical Director, Lawrie Abercrombie, explores the real value of an ISA/IEC 62443 alignment review and why this practical, real-world appraisal helps organisations identify and prioritise OT security improvements that need to be made.
ISA/IEC 62443 is a phrase I hear more and more often in conversations about operational technology security. It is becoming a common reference point for organisations that need to show they are taking industrial cyber risk seriously. That is a good thing, but it can also create a bit of uncertainty. What does “alignment” actually mean in practice?
The short answer is that it is not about treating OT like corporate IT with a different label. In industrial environments, safety, availability, engineering constraints, supplier dependencies and long asset lifecycles all matter. Good security has to fit that reality so if you’re connecting OT to IT, facing supplier or regulator questions, or inheriting legacy sites, read on.
An ISA/IEC 62443 alignment review looks at where your current OT security arrangements already reflect the intent of the standard, where they fall short and what would need to change. It is not a certification audit. It should not feel like a paper exercise. The useful question is much more practical: “Are we doing the right things, for the right reasons, in a way that stands up to scrutiny?”
When does an ISA/IEC 62443 alignment review need doing?
In my view, an ISA/IEC 62443 alignment review is worth considering if any of the following sound familiar:
- Your OT, industrial control or cyber-physical systems are being connected to enterprise IT, cloud services, remote support tools or third-party monitoring platforms.
- You are planning a new OT deployment, major upgrade, integration project, segmentation programme or digital transformation initiative.
- Customers, regulators, insurers or parent organisations are asking for better evidence of how OT cyber risk is managed.
- You need to set requirements for suppliers, integrators, maintainers or managed service providers, but do not yet have a clear OT-specific baseline.
- You have inherited legacy OT environments and are not sure whether the current controls, architecture and operating practices remain suitable.
- You need an improvement roadmap that reflects operational constraints rather than generic IT security recommendations.
- You are preparing for audit, regulatory scrutiny, acquisition due diligence, board assurance or investment approval.
If several of those points apply, the question is probably not whether ISA/IEC 62443 is relevant. It is how far you are already aligned, where the important gaps sit and what sequence of improvements will reduce risk without undermining safe and reliable operations. ISA/IEC 62443 can look complicated from the outside, but the first step does not need to be. A well-scoped alignment review gives you a grounded view of where you are now, what matters most and what to do next.
At Arcanum, we use an alignment review to give asset owners, operators and organisations with OT dependencies a clear view of how their current approach compares with recognised industrial cyber security good practice. The scope can be focused on a single site, a representative system, a modernisation programme, a supplier-led project or a wider operational estate.
That usually means looking at governance, asset and system understanding, risk assessment, network segmentation, zones and conduits, security level expectations, supplier and integrator responsibilities, operating processes, remote access, maintenance arrangements, incident response and the evidence available to support assurance. One really important thing for any OT operator to know is that the review is non-intrusive with no scanning or testing of live OT systems.
What does a good ISA/IEC 62443 review look like?
The output should be something people can use, like a prioritised roadmap and a board-ready summary. A good review does not just list findings, it explains what is working, where the material gaps are, why those gaps matter and which improvements should be tackled first. It can also support procurement decisions, supplier assurance, programme planning, internal audit, board reporting and regulatory engagement.
One of the reasons I like this type of review is that it helps different parts of the organisation have the same conversation. Experience tells me that engineering, operations, procurement, cyber security and leadership teams invariably see OT risk through different lenses. ISA/IEC 62443 gives them a shared set of concepts, including asset owner responsibility, target security levels and lifecycle security.
It also helps with prioritisation. The review is not about asking whether an organisation is “compliant” in some broad, abstract sense. It is about working out which gaps create real operational, safety, contractual, regulatory or resilience concerns and then deciding what should be done first.
The supplier angle is another important part of the value. Industrial cyber security is rarely delivered by one organisation in isolation. Asset owners, product suppliers, system integrators, maintainers and service providers all play a part. An alignment review can help test whether security requirements are being specified clearly, flowed down properly, evidenced in delivery and maintained through life.
That is why the review can be useful well beyond the cyber security team. It can help shape investment cases, project gateways, assurance activity and leadership briefings without losing sight of how the operational environment actually works.
So, how long does it take? With any cyber maturity or framework/standard aligned review, the duration is entirely dependent on the organisation’s size, complexity, scope and overall maturity of the operational environment being assessed. For a single site, representative OT system or focused project, a review can typically be completed within 2 to 4 weeks, including planning, stakeholder interviews, evidence review, analysis and reporting. During that time we’d typically expect a 2-3 hours of interviews with each key stakeholder.
Larger multi-site estates, complex industrial operations or organisations with numerous suppliers and system integrators may require 4 to 8 weeks or more to ensure sufficient coverage. The objective is not to create unnecessary overhead but to obtain enough evidence to provide a credible view of current alignment, identify material gaps and develop a practical, risk-based improvement roadmap. The level of effort is usually tailored to the scope and operational constraints of the environment being reviewed.
A case in point
A real-world example is a recent review we carried out for a large UK manufacturing organisation operating multiple production facilities and industrial control systems. The client was preparing for a significant digital transformation programme that would introduce new remote access capabilities and increase connectivity between OT and enterprise IT environments. While a number of good security practices were already in place, the organisation lacked a clear understanding of how its existing arrangements aligned with recognised OT security good practice. Through an ISA/IEC 62443 alignment review, we assessed governance arrangements, asset visibility, network architecture, supplier responsibilities, remote access controls and incident response processes. The review identified several areas of strength, including well-established engineering processes and strong operational ownership of critical systems. However, it also highlighted opportunities to strengthen network segmentation as three vendors each had their own remote access route into the plant network and nobody was quite sure where their access stopped, formalise supplier security requirements and improve OT-specific assurance activities.
We provided a prioritised improvement roadmap, giving their senior decision makers a clear view of current risk exposure and a phased approach to enhancing resilience. Our recommendations were aligned to operational constraints and maintenance schedules, enabling the organisation to improve security without disrupting production or impacting safety. The outputs have since been used to support investment decisions, programme planning and ongoing cyber security assurance activities.
If your organisation operates OT, industrial control systems or cyber-physical environments and you are trying to work out whether ISA/IEC 62443 alignment should be part of your next step, get in touch with us for an initial chat where we’ll be happy to share what a typical review covers. We’re an NCSC Assured consultancy and have been doing this before the NIS regulations were published in 2018. We can help you define the right scope, ask the right questions and identify a realistic route towards a stronger OT cyber security posture.
Get in touch with Arcanum today and we can support you to help you review your alignment with ISA/IEC 62443. Book a consultation today.