Free Tool · IEC 62443-2-1 / IEC 62443-3-3

ICS Cybersecurity Maturity Assessment

Evaluate your industrial control system against IEC 62443-2-1 and IEC 62443-3-3. 32 questions across 8 security domains — firmware, network segmentation, access control, logging, incident response, physical security, and asset inventory. Output: maturity score 0–100, per-section bar chart, gap list with clause references.

▶ 1. Target Security Level
4 Q
IEC 62443-2-1 §4.2
Security Level (SL 0–4) formally defined for the target system
IEC 62443-3-3 §5.2
Consequence analysis performed to justify target SL
IEC 62443-3-3 §5.3
Industry sector / asset type aligns with IEC 62443 SL targets
IEC 62443-2-1 §4.3
SL justification documented and signed off by asset owner
▶ 2. Firmware & Change Management
4 Q
IEC 62443-3-3 SR 7.4
All firmware is digitally signed by the vendor
IEC 62443-3-3 SR 7.5
Firmware authenticity verified before installation (hash/Sig check)
IEC 62443-2-1 §4.5.3
Formal change-control procedure for firmware updates exists
IEC 62443-2-1 §4.5.4
Updates tested in staging/isolation environment before production
▶ 3. Network Segmentation
5 Q
IEC 62443-3-3 SR 3.1
OT network divided into zones (e.g., field, supervisory, corporate)
IEC 62443-3-3 SR 3.2
Data flows between zones documented as conduits
IEC 62443-3-3 SR 3.3
Demilitarised zone (DMZ) separates corporate IT from OT
IEC 62443-2-1 §4.6.2
Firewall rules reviewed and updated at least annually
IEC 62443-3-3 SR 3.4
IDS/IPS or equivalent monitoring at zone boundaries
▶ 4. Access Control
5 Q
IEC 62443-3-3 SR 1.4
Multi-factor authentication enforced for all remote access
IEC 62443-3-3 SR 1.5
Role-Based Access Control (RBAC) implemented for operator accounts
IEC 62443-3-3 SR 1.6
Least-privilege principle applied (default deny, need-to-know)
IEC 62443-2-1 §4.7.3
Credentials rotated on a defined schedule (≤180 days for privileged)
IEC 62443-3-3 SR 1.7
Inactive sessions timeout automatically (<30 min)
▶ 5. Logging & Monitoring
5 Q
IEC 62443-2-1 §4.8.2
Centralised SIEM or log aggregation platform deployed
IEC 62443-2-1 §4.8.4
Logs retained for ≥6 months (security incident investigation)
IEC 62443-3-3 SR 5.2
Automated alerting thresholds defined and active
IEC 62443-3-3 SR 5.3
Log integrity protected (tamper-evident, immutable write-once)
IEC 62443-2-1 §4.8.5
Logs reviewed proactively (not only after an incident)
▶ 6. Incident Response
4 Q
IEC 62443-2-1 §4.9.2
Documented incident-response playbooks exist for ICS-specific scenarios
IEC 62443-2-1 §4.9.4
Recovery plan defined with RTO/RPO targets for critical systems
IEC 62443-2-1 §4.9.6
Incident-response exercises performed at least annually (tabletop or live)
IEC 62443-3-3 SR 5.1
Defined escalation paths and contact list accessible 24/7
▶ 7. Physical Security
3 Q
IEC 62443-2-1 §4.10.2
Control cabinet access restricted (key/card, audit trail)
IEC 62443-2-1 §4.10.3
CCTV or equivalent surveillance on critical OT areas
IEC 62443-2-1 §4.10.5
Perimeter barriers (fencing, locked rooms) prevent casual physical access
▶ 8. Asset Inventory
3 Q
IEC 62443-2-1 §3.4.2
OT asset inventory current (updated within 12 months)
IEC 62443-3-3 SR 2.1
Assets tagged with unique identifiers and network coordinates
IEC 62443-3-3 SR 3.1
Asset inventory informs network segmentation decisions
Related tools
ICS Cybersecurity Risk Register (FMEA) SCADA/ICS Network Topology Builder Substation Protection