IEC 62443 requires zones, conduits, access control, and authenticated communications for industrial control systems. BlastShield implements all of these natively — through a software overlay that works on your existing OT infrastructure, including legacy devices that can never be patched.
IACS Security Mgmt System
System Security Requirements
BlastWave publishes compliance mappings. BlastWave is not certified or accredited to any regulatory framework, and no vendor product confers compliance on an operator. This page describes how BlastShield controls support specific required outcomes under IEC 62443. It supports, but does not replace, an operator's own implementation plan, assessment plan, and formal determination by IEC.
IEC 62443 is the international standard series for security in Industrial Automation and Control Systems (IACS). Developed by ISA and adopted by IEC, it provides a comprehensive framework that applies to asset owners, system integrators, and product suppliers across every sector that operates industrial control infrastructure — manufacturing, energy, oil and gas, water, transportation, and beyond.
Unlike NERC CIP (which is mandatory for specific US bulk power entities), IEC 62443 is increasingly referenced by regulators worldwide and required by critical infrastructure operators in Europe, Asia, and the Middle East. It is the de facto language of OT security compliance globally.
The standard's core model — Zones and Conduits — provides the architectural framework for segmenting IACS networks into logical groups of assets with similar security requirements, and controlling all communication between those groups. BlastShield is purpose-built to implement this model.
Who adopts IEC 62443? Asset owners building IACS security programs, system integrators responsible for delivering secure ICS solutions, and product suppliers certifying components for critical infrastructure use. If your organization operates, integrates, or supplies industrial control systems, IEC 62443 is your compliance framework.
IEC 62443 organizes OT assets into defined security zones and controls communication between them through protected conduits. BlastShield supports both with identity-based segmentation and authenticated, encrypted connections.
A logical grouping of assets with the same security level and policy requirements. Assets in a zone can communicate internally without crossing a conduit.
.svg)
A logical path grouping communications between zones. Every conduit is a controlled access point with defined authentication, encryption, and authorization requirements.
How BlastShield maps to this model: The BlastShield Security Gateway acts as the conduit control point between zones. Assets within a zone communicate through BlastShield's overlay network. Every inter-zone communication is a BlastShield-authenticated tunnel — no credentials, no policy, no tunnel. The Orchestrator defines which users and devices belong to which zone, and which conduits they may traverse. Changes propagate in real time without firewall rule changes or downtime.
IEC 62443-3-3 defines 51 System Security Requirements (SRs) across seven Foundational Requirements (FRs). Below are the SRs most directly addressed by BlastShield.
SR / FR
Requirement
How BlastShield Delivers
Coverage
FR 1 · SR 1.1
Human User Identification & Authentication
Identify and authenticate all human users before access
Human users are cryptographically identified before a tunnel is established. The BlastShield Authenticator provides passwordless multi-factor authentication: a QR challenge-response, a local biometric check, and a private key held in the device keystore that is never transmitted. There is no password to phish, reuse, or steal.
Directly addresses, for access mediated by BlastShield. Local console login at the asset itself is outside the path of any network access product.
FR 1 · SR 1.2
Software Process and Device Identification & Authentication
Identify and authenticate software processes and devices
The BlastShield Agent installs on servers, and the BlastShield Client installs on Windows, macOS, and Linux endpoints. Each authenticates the device before any connection is permitted, and a device that has not authenticated is not reachable and cannot initiate a connection.
Supports. BlastShield authenticates the device. It does not identify or authenticate individual software processes running on that device, which is a host-level capability.
FR 2
Authorization Enforcement
Enforce authorization on all access to IACS components based on least-privilege principles
An administrator can terminate an active session from the Orchestrator. Deleting an entity revokes its access and terminates its active sessions within seconds, and the deletion is recorded in the configuration change log with the acting user and a timestamp. Where session recording is enabled, BlastAccess captures activity up to the moment of termination.
Supports. Termination is operator-initiated, not an automatic inactivity timeout.
FR 3 · SR 3.1
Communication Integrity
Protect the integrity of transmitted information
BlastShield tunnels use AES-256-GCM authenticated encryption, which protects traffic in transit against disclosure and against undetected modification. The protection is applied by BlastShield, so it does not depend on the transported protocol offering any of its own.
Directly addresses, for traffic in transit through BlastShield. Integrity of software or data at rest is out of scope.
FR 4 · SR 4.1
Information Confidentiality
Protect the confidentiality of information at rest and in transit
Traffic between BlastShield endpoints is encrypted end to end. There are no plaintext credentials on the access path, no inbound open port, and no concentrator. Network cloaking means that the existence of a protected asset is not disclosed to an unauthorized scanner.
Supports, for information in transit. Confidentiality of information at rest, on the asset or in a historian, is out of scope.
FR 5 · SR 5.1
Network Segmentation
Segment the IACS network from other networks using boundary protection devices
Software-defined segmentation creates cryptographic zone boundaries without hardware changes, new VLANs, or ACL re-architecture. A compromised device in one zone cannot probe or reach a device in another. Where BlastShield is deployed in Layer 2 isolation mode, with the switch forwarding traffic to BlastShield, that separation extends to devices on the same broadcast domain.
Supports. Software-defined segmentation is a different mechanism from physical network segmentation, and an assessor may treat the two differently.
FR 5 · SR 5.2
Zone Boundary Protection
Monitor and control communications at zone boundaries
The BlastShield Security Gateway is the enforcement point at the zone boundary. It permits only authenticated, authorized tunnel connections, and silently drops everything else, including scans, probes, and unauthenticated protocol requests. Where connection logging is enabled, which is off by default and set per policy at deployment, every crossing attempt is logged and exports to a syslog destination you control.
Supports. BlastShield enforces at the boundary and produces the records. It performs no anomaly detection and raises no behavioral alerts, so boundary monitoring and alerting come from your monitoring platform.
Three capability areas sit outside BlastShield, and one sits partly inside. Where a capability appears here as out of scope, source it elsewhere in your architecture.
BlastShield protects the integrity and authenticity of traffic in transit. It does not verify the integrity of software or data at rest, it does not inspect content, and it provides no malicious code protection.
BlastShield is not a monitoring product. Where connection logging is enabled, which is off by default and set per policy at deployment, it records access attempts, and it records configuration changes and exports both. It performs no anomaly detection, intrusion detection, or behavioral analysis.
BlastShield does not back up or restore anything, and it provides no recovery capability.
BlastShield does not enumerate your estate and does not discover what sits silent on it, so it is not an inventory tool. What it does is make an incomplete inventory less dangerous. Policy is default-deny, so an asset that every inventory method missed is denied the moment it tries to communicate, and where connection logging is enabled that attempt is recorded.
A Security Level describes a control system, assessed as a whole. BlastShield is one component within such a system, so the level is not ours to claim and not ours to deliver.
The hardest part of IEC 62443 compliance isn't the architecture — it's the 15-year-old PLCs and RTUs at the center of it. BlastShield protects these assets without requiring any changes to them.
Legacy IACS components with known, unpatched CVEs are isolated in their own zone with a BlastShield boundary. The vulnerabilities exist — but they are never reachable. No scan can find them. No exploit can land on them.
IEC 62443 requires security without compromising availability. BlastShield deploys as a software overlay — no IP changes, no production outages, no firewall rule migrations. Zones and conduits are live in hours, not months.
IEC 62443 requires that remote access to IACS components travel through a defined, authenticated conduit. BlastShield's SRA solution implements exactly this — a verified, encrypted, least-privilege conduit for every remote maintenance session, with session recording.
Unlike NERC CIP, which applies to a specific regulated sector, IEC 62443 is the security standard for any organization operating industrial automation and control systems.
Our OT security engineers work with operators on the zones, conduits, and access control portions of their IEC 62443 programs. Schedule a demo and we'll walk your environment against the SRs on this page.
Our Privacy Policy applies.
.svg)
Privacy Policy | Cookie Policy | © 2026 BlastWave, Inc. All Rights Reserved
This website uses cookies to ensure you get the best experience. More Info