IEC 62443 and remote access for machine builders

Last updated: October 20, 2026

IEC 62443 is a voluntary international standard, not a regulation. No EU law makes conformance to it mandatory by itself, though a customer or a contract may still require it. See IEC 62443, explained for that distinction in full. This page is an overview of how the standard's general approach relates to remote access specifically, in plain terms, not a clause-by-clause reading of the standard's own text.

The general approach

IEC 62443 is a functional standard: it sets objectives for security performance rather than prescribing one specific technical solution. Its general approach, as the standard's own publisher describes it, is risk-based: it groups a system into zones with defined, controlled connections between them, and sets a target security level for each zone based on the risk it faces, rather than applying one fixed rule everywhere. Source: ISA, publisher of the ISA/IEC 62443 series

Where remote access fits

A remote-access connection is one of the controlled paths this risk-based approach applies to. A customer asking about IEC 62443 conformance is generally asking how you manage that path: who it reaches, how it is controlled, and whether its risk has been assessed, rather than asking for a specific product or technology. This page deliberately does not quote or paraphrase the standard's own clause text, since IEC 62443 is a paid, licensed standard, not a freely published one like an EU regulation; for the standard's actual requirement wording, its publisher is the source, not a summary.

How this differs from NIS2, the CRA, and the Machinery Regulation

NIS2, the Cyber Resilience Act, and the Machinery Regulation are EU law: they bind whoever they apply to, regardless of whether that party has heard of them. IEC 62443 is a standard a customer, insurer, or contract can choose to require, but no EU law requires it by itself. A machine builder can face some or all of these at once, for different reasons.

Related guides

IEC 62443, explained and Preparing to answer a customer's security questionnaire.

This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.