ISA/IEC 62443 Lead Implementer Course and Certification for US Practitioners

ISA's ISA99 committee and Working Group 10 of IEC Technical Committee 65 write the series together. ISA publishes each document as ISA-62443-x-y, several of them with the ANSI/ISA prefix, the IEC publishes the same document as IEC 62443-x-y, and ISA says the two editions are identical. The asset-owner part was revised as ANSI/ISA-62443-2-1-2024, announced in January 2025: it sets requirements for establishing, implementing, maintaining and continually improving an IACS security program, leaves the choice of approach to the asset owner, and organizes the requirements into security program elements with a maturity model.

Responsibility is shared across everyone who touches a control system. ISA names four stakeholder groups: asset owners, automation product suppliers, integrators who build and maintain control system solutions, and service suppliers who support their operation. In 2021 the IEC recognized the series as a horizontal standard, one shown to apply across a broad range of industries. The course covers each of those roles, from the asset owner's program and its risk assessment to what service providers and product developers must meet.

NIST's Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3, published in September 2023, covers industrial control systems, building automation, transportation and physical access control systems, among others. It maps the tasks of NIST's Risk Management Framework to other standards that apply to OT, IEC 62443 among them; it points to ISA 62443-3-2 for assessing cyber risk where the impact can reach safety, health and the environment; and it names ISA 62443-2-3 among the standards an OT patch management procedure can be based on. Rev. 4 is out as an initial public draft, dated 21 September 2026 and open for comment until 30 November 2026, restructured around CSF 2.0 and its Govern function; until NIST finalizes it, Rev. 3 is the current guide.

CISA's Secure by Demand guide for OT owners and operators, published on 13 January 2025 with contributions from the NSA, FBI, EPA, TSA and international partners, is about buying industrial automation and control products with security designed in. It tells buyers to look for manufacturers that demonstrate adoption of Secure by Design and the ISA 62443 standards, suggests asking whether a manufacturer can show alignment with international standards such as ISA/IEC 62443, and says its considerations align with Security Level 3 of ISA/IEC 62443-4-2 and 62443-3-3. Reading a supplier's claims against those parts and security levels is a skill this course builds.

TSA's Security Directive Pipeline-2021-02G, in force from 3 May 2026 to 2 May 2027, applies to owners and operators of hazardous liquid and natural gas pipelines and liquefied natural gas facilities that TSA has notified are critical. Each needs a TSA-approved Cybersecurity Implementation Plan, which is what TSA inspects against, along with an incident response plan and an assessment plan. The required outcomes include network segmentation designed to keep the OT system running if the IT system is compromised, access control for local and remote access, continuous monitoring and detection, and patching under a risk-based method. The directive names no particular standard, and TSA says it intends to make the requirements permanent through notice-and-comment rulemaking.

On the grid, NERC, which FERC designated as the Electric Reliability Organization on 20 July 2006, sets Reliability Standards that are mandatory for bulk electric system facilities affecting the reliability of the bulk power system. Its Critical Infrastructure Protection standards include BES Cyber System categorization (CIP-002, mandatory and subject to enforcement since 27 December 2016) and supply chain risk management (CIP-013), and CIP-015-1, on internal network security monitoring, becomes subject to enforcement on 1 October 2028.

Drinking water has a statutory duty of its own. Every community water system serving more than 3,300 people must assess the risks to, and resilience of, its system, including its electronic, computer or other automated systems and their security, and must review that assessment at least once every five years.