Indian IEC 62443 Deep Dive — SL Levels 1-4 + Foundation Requirements + ISA 99 + NERC CIP

IEC 62443 Security Level (SL) framework for Indian MEP — SL 1 (casual), SL 2 (typical commercial), SL 3 (DC + metro + smart-meter), SL 4 (power grid + petchem + defence). 7 Foundation Requirements (FR1-FR7) + 14 control families. Indian project SL distribution: 62 % no formal SL, 18 % SL2, 4 % SL3, 1 % SL4. Cost varies 25-385 Cr on 50,000 m² mixed-use by SL. Three failures: SL not specified at tender causing retrofit cost-overrun, SL on PLC but not on field devices breaking chain integrity, annual recertification missed.

Indian IEC 62443 deep dive framework

IEC 62443 is the gold standard for ICS / OT cybersecurity. 4-part series: 62443-1 (terminology), 62443-2 (program), 62443-3 (system technical security), 62443-4 (component requirements + security development lifecycle). Indian MEP + Power + Petchem + Defence projects increasingly mandate IEC 62443-3-3 + 4-1/4-2 certification. Standards stack — IEC 62443-1-1 + 1-2 + 2-1 + 2-3 + 2-4 + 3-2 + 3-3 + 4-1 + 4-2 + IEEE 1686 + NERC CIP + ANSI/ISA 62443 (USA equivalent) + CSA SL-Level Security Levels.

IEC 62443 SL (Security Level) framework — by MEP application

Three Indian IEC 62443 deep-dive failures

1. SL not specified at tender — Indian projects tender BMS without SL level requirement. Then face cost-overrun when SL 2-3 retrofitted. Specify target SL at concept stage per IEC 62443-1-1.
2. SL on PLC but not on field device — IEC 62443 + ISA 99 require SL-equivalence across the entire chain (sensor + field controller + DDC + supervisor). Indian projects often achieve SL2 at DDC but field sensors are SL0 = chain only as strong as weakest link.
3. Annual SL recertification missed — IEC 62443-3-3 SL cert valid 1-2 years. Indian sites obtain at commissioning + never renew. Specify annual recertification + SL drift assessment.