IEC 62443 and your OT asset inventory
IEC 62443 is the international series of standards for the security of industrial automation and control systems. It covers the people who own and operate those systems, the integrators who build them, and the manufacturers who make the components. It is not law in the UK, but it is the reference many customers, insurers and integrators use when they ask how your OT is secured.
Everything starts with the inventory
The parts of IEC 62443 aimed at asset owners describe a security programme for the site: assessing risk, segmenting networks into zones, controlling access, managing change and planning for recovery. Every one of those steps assumes you already know what is installed.
You can’t assess the risk of a controller you don’t know you have, put it in the right zone, or patch, back up or replace it. So in practice, the first piece of evidence anyone asks for is an inventory: each device, what it is, where it sits, what software and firmware it runs, and who is responsible for it.
What supports alignment
An asset inventory. Every PLC, HMI, drive and network device, recorded with manufacturer, part number, firmware, location and lifecycle status. In Command Centre, each device sits on the machine it controls, so the record follows the structure of the site.
Configuration and program records. The software and version each device is programmed with, and a backup of its program stored against it, with each change kept as a new version.
Change control. Every program revision and record change logged with who made it and when, so you can show what changed and that it was controlled.
Lifecycle and obsolescence planning. Devices that are discontinued or phasing out can no longer be patched or easily replaced, which makes them a risk in their own right. Knowing which ones you have is the basis for a migration plan. See the automation parts lifecycle index.
Controlled remote access. Remote access is where many OT security incidents start. Connect sessions are authorised before they start, closed when support ends, run over TLS 1.3 with no always-on VPN, and logged.
Aligned, not certified
Products and services can be designed around IEC 62443 principles without being certified against it, and the difference matters. ECS describes Command Centre and Connect as IEC 62443 aligned. They support the asset, change and access parts of a security programme. They do not on their own make a site compliant: that needs an assessment of the whole system against the parts of the standard that apply.
Where to start
If you have no current inventory, build that first. A Capture site audit records every device, takes the backups and checks lifecycle status in one visit, without scanning your production network.