IEC 62443 is the international series of standards for the security of industrial automation and control systems (IACS) — the PLCs, SCADA, and control networks that run a factory. It organises a plant into zones and conduits, assigns each a target security level, and defines requirements for system integrators and asset owners as well as component suppliers. In a vehicle plant it governs the production floor, including the flashing and end-of-line stations.

Why does IEC 62443 matter for automotive?

Because vehicle firmware and cryptographic keys are written into ECUs on industrial control systems inside a factory, and those systems are OT, not IT. A signing key exposed on a flat plant network, or an unsigned image accepted at a compromised flashing station, is a fleet-wide risk introduced at manufacture. IEC 62443 is the discipline that secures the plant that UN R155 expects a CSMS to cover in production.

How does plant OT security relate to UN R155?

UN R155 requires the cyber security management system to cover the vehicle across development, production and post-production. Production runs on plant OT, so a CSMS cannot demonstrate production coverage without evidence that the factory's control systems are secured — and IEC 62443 is the standard that provides that structure. The two are complementary: R155 sets the obligation, IEC 62443 supplies the method for the OT half of it.

IEC 62443 for the vehicle plant: securing production OT

The industrial security standard that governs the factory where the ECU is built and flashed

16 Jul 20264 min readAutoSifu

The standard for the factory, not the car

IEC 62443 is the international series of standards for securing industrial automation and control systems — the operational technology that runs a factory floor. It matters to a vehicle programme for a simple reason: the ECU in the car was built, flashed and provisioned with keys on industrial control systems, and those systems are governed by IEC 62443, not by the vehicle regulations.

This is the standard that sits beside UN R155 rather than inside it. R155 and ISO/SAE 21434 describe how to engineer a secure vehicle and manage cybersecurity across its lifecycle. Neither tells you how to secure a PLC, a SCADA network or a flashing station — because that is the domain of industrial security. When a CSMS has to demonstrate that production is under control, IEC 62443 is where the method comes from.

Zones, conduits and security levels

The core idea in IEC 62443 is that a plant is not one flat network but a set of zones joined by conduits, each with a target security level.

A zone is a grouping of assets with a shared security requirement — for example, the safety-controller network, the MES layer, or the end-of-line programming cell.
A conduit is the controlled communication path between zones. All traffic that crosses a zone boundary passes through a conduit, which is where the boundary controls live.
A security level (SL) expresses how much resistance a zone or conduit must offer, from SL 1 (protection against casual or coincidental violation) up to SL 4 (protection against a well-resourced, motivated attacker). A target SL is assigned from a risk assessment; the deployed controls are then measured against it.

This structure is what turns "secure the plant" into something assessable. Instead of a single perimeter, you have a map of zones, the conduits between them, and a target rigour for each — and you can check the design against the map.

IEC 62443 concept	What it is	Vehicle-plant example
Zone	Assets sharing a security requirement	Flashing / end-of-line programming cell
Conduit	Controlled path between zones	Link from MES to the flashing station
Security level (SL 1–4)	Required resistance to attack	Higher SL on key-handling zones
Asset owner	Party operating the IACS	The OEM / plant operator
System integrator	Party building the solution	The line-equipment integrator

What is in scope inside a vehicle plant

Not every machine on the floor is equally significant to vehicle security. The systems that write software or handle keys are the ones that turn a plant incident into a fleet incident.

Flashing and programming stations. These write firmware into ECUs. A station that accepts an unsigned or altered image is provisioning the fleet with untrusted software. Integrity verification at the station is a production control, not a design one.
Key handling at the line. Signing keys and per-ECU credentials are generated on IT/security infrastructure but consumed at OT stations. Their exposure on the plant network — even briefly, even in logs — undermines the cryptography they support. This is why plant OT and automotive PKI and key management have to be designed as one system.
The MES and control layer. The manufacturing execution system and its PLC/SCADA layer coordinate the line. Compromise here can alter what is built and how, including which image reaches which station.
Remote maintenance access. Line equipment is serviced by vendors over remote connections. That access is a conduit from outside the plant into its most sensitive zones and must be brokered, logged and monitored.

The end-of-line cell deserves particular attention because it holds the widest, least-watched diagnostic and programming access in the whole lifecycle — the argument set out in why the assembly line is in scope for a CSMS.

Why the plant cannot be secured in isolation

A plant secured under IEC 62443 but disconnected from the vehicle and backend security story is only half a solution. The image a flashing station writes came from an IT build pipeline; the keys it uses came from security infrastructure; the vehicle it provisions will later be updated by a backend. The plant is one estate in a converged system, which is the subject of IT/OT convergence in automotive manufacturing security.

IEC 62443 gives the OT estate its structure — zones, conduits, security levels, and the split of responsibility between asset owner, integrator and component supplier. What convergence adds is the requirement to make the boundary between OT and the rest of the system an explicit, defended conduit rather than an assumed gap. The two ideas are complementary: 62443 secures the plant; the convergence lens secures the seams where the plant meets everything else.

From standard to CSMS evidence

For a UN R155 assessment, the value of IEC 62443 is that it produces evidence in a form an assessor can follow. A zone-and-conduit diagram with assigned security levels, a demonstration that flashing stations verify image integrity, and records that remote access is controlled are exactly the kind of production-phase evidence that shows a CSMS extends to the factory. Describing a secure plant is not enough; the records have to show the controls operate on the real line.

The AutoSifu view

The plant is where most CSMS scopes quietly stop, and where an assessor's questions about production most often go unanswered. AutoSifu works one route — compliance, solutioning, and CoC/VTA support — with CIRT in the room, so IEC 62443 zoning and the R155 production requirement are reconciled as one design rather than two. Having the approval body see the plant evidence early is what stops "we assumed the factory was covered" from becoming a finding.

Sources

Questions

What is IEC 62443?: IEC 62443 is the international series of standards for the security of industrial automation and control systems (IACS) — the PLCs, SCADA, and control networks that run a factory. It organises a plant into zones and conduits, assigns each a target security level, and defines requirements for system integrators and asset owners as well as component suppliers. In a vehicle plant it governs the production floor, including the flashing and end-of-line stations.
Why does IEC 62443 matter for automotive?: Because vehicle firmware and cryptographic keys are written into ECUs on industrial control systems inside a factory, and those systems are OT, not IT. A signing key exposed on a flat plant network, or an unsigned image accepted at a compromised flashing station, is a fleet-wide risk introduced at manufacture. IEC 62443 is the discipline that secures the plant that UN R155 expects a CSMS to cover in production.
How does plant OT security relate to UN R155?: UN R155 requires the cyber security management system to cover the vehicle across development, production and post-production. Production runs on plant OT, so a CSMS cannot demonstrate production coverage without evidence that the factory's control systems are secured — and IEC 62443 is the standard that provides that structure. The two are complementary: R155 sets the obligation, IEC 62443 supplies the method for the OT half of it.