Services > Security
IEC 62443 compliance analysis service
We map applicable IEC 62443 requirements to your products and development processes, identify gaps and help you plan improvements and prepare for assessment.
- Process and product analysis
- Software-first remediation
- Audit-ready results
What we offer
We assess your products and processes against IEC 62443
We assess your products and development processes against applicable IEC 62443 requirements, identify gaps and help you plan improvements and prepare for assessment.
Many companies conduct cybersecurity audits to get a better overview of their current situation. Proekspert supports industrial device manufacturers with self-assessment as they prepare for IEC 62443 certification.
OUR EXPERIENCE
Why Proekspert
Proekspert has 20+ years of experience in developing industrial embedded platforms and service tools. While serving our clients, we follow IEC 62443 standards during analysis and development. Our engineers are skilled in conducting analysis of development processes and products to identify possible vulnerabilities and cybersecurity risks.
Case studies
Trusted by Europe’s leading industrial device manufacturers and automation innovators
Cybersecurity and compliance in action
Client challenge/business need
Danfoss Drives needed to prepare legacy drives to meet strict EU Cyber Resilience Act and IEC 62443 requirements, ensuring continued access to regulated markets. With hardware and protocols never built for modern cybersecurity, achieving compliance without costly redesigns or usability impacts was a critical strategic goal.
Solution at a glance
Proekspert led risk analysis and security feature design for both drive firmware and the configuration tool. We replaced complex certificate-based architectures with role-based access, strong audit logging, streamlined password authentication, and cryptography optimized for legacy hardware, using Mbed TLS and STM Cryptolib. All compliance delivered via software upgrades.
Technologies
C/C++, Microsoft Foundation Classes (MFC), Windows desktop application, role-based access control, audit logging, IEC 62443 compliance processes, vulnerability and penetration testing tools, Mbed TLS, STM Cryptolib, threat modeling (IriusRisk)
Results
- Protected revenue and market access. Regulatory compliance secured continued sales in regulated markets, avoiding costly business risks.
- No hardware redesign needed. Security Level 1 readiness reached through software upgrades, saving time, cost, and hassle for all stakeholders.
- Ready for future audits and certifications. Established a repeatable compliance process – future products pass faster, with less effort.
Testimonials
What our clients say
OUR SERVICE
Key features and benefits
Map processes
We help identify and map product development processes and vulnerabilities
Mitigate security risks
We help suggest security measures to mitigate security risks in your product source code or in the development process
How it works
Standards we take into account
To assess current state of cybersecurity for operational technology in automation and control systems we follow these standards.
IEC-62443-4-1
Requirements for development processes
IEC-62443-4-2
Requirements for product/component
IEC-62443-3-3
Requirements for systems
Tools we use for the IEC 62443 compliance analysis
Threat model visualization to identify cyber security threats (STRIDE methodology)
Security risk structuring to classify exploits and attack vectors (Mitre ICS Matrix)
Software composition analysis to identify and manage open-source components and potential security vulnerabilities in code (Polaris Black Duck)
Static analysis of product source code to detect and fix code defects and ensure code quality and security (Polaris Coverity Scan)
Services
Support for industrial device manufacturing companies
Proekspert provides support for industrial device manufacturing companies at self-assessment or third-party assessment needed in the process of preparing for IEC 62443 certification.
- Identifying and mapping product development processes and vulnerabilities
- Suggesting security measures to mitigate security risks in product source code or in the development process
Results of the assessment services:
- Factual input for product strategy
- Mapped processes
- Mapped vulnerabilities
Preparing for the EU CRA? See our EU CRA compliance service.
FAQ
Everything you need to know
IEC 62443 is an international series of standards that address cybersecurity for operational technology in automation and control systems. The standard describes both technical and process-related aspects of automation and control systems cybersecurity. The purpose of the standard is to help suppliers, system integrators, and manufacturers comply with process requirements and to address security concerns along the supply chain.
Before certification, an assessment must be conducted. There are two possibilities: (1) self-assessment and (2) third-party assessment.
For device and component manufacturers, two parts are usually most relevant. IEC 62443-4-1 sets requirements for a secure product development lifecycle. IEC 62443-4-2 sets technical security requirements for components such as embedded devices, network components and software applications. IEC 62443-3-3 covers security requirements at the system level and is more relevant to system integrators. We help you establish which requirements apply to your product before the assessment starts.
They’re different instruments. The CRA is an EU regulation that sets cybersecurity requirements for products with digital elements sold in the EU. Its reporting obligations have applied since 11 September 2026, and its full requirements apply from 11 December 2027. IEC 62443 is a voluntary standard. Following it doesn’t automatically make a product CRA-compliant, but the two overlap considerably in areas such as secure development, vulnerability handling and security by design, so work done for one supports the other.
Often, yes, but it depends on the product. For Danfoss Drives, we brought legacy drives to IEC 62443 Security Level 1 readiness through software changes alone, with no hardware redesign. Where software can close a gap, we recommend doing it in software. Hardware changes are only proposed where they’re actually needed.
Contact us
Share your challenge with us
Our experienced engineers can help assess cyber risks concerning your product. Leave your contacts below, and let's have a quick online call to see if we are the right partner for you.
Terry London
Product Manager & Partner
Languages: EST, ENG