SCADA

Assets belong in the same IEC 62443 zone when they share similar security requirements, risk exposure, and trust level, and when segmentation between them would not materially reduce risk relative to its cost and operational impact. In brownfield plants, zoning is often constrained by legacy networks, protocols, and validation burdens, so you typically refine zones iteratively rather than redesigning everything at once.

Common pitfalls include underestimating asset discovery and dependency mapping, trying to bolt on controls without redesigning trust boundaries, ignoring vendor and support constraints, and assuming a retrofit can make a legacy product fully IEC 62443 compliant. In brownfield plants, integration, validation, and lifecycle impacts are often more limiting than the technical security controls themselves.

Security levels for production zones should be based on structured risk assessment, not generic templates. Start from business and safety impact, map assets and data flows, and then align with a reference model (such as IEC 62443 zones and conduits). In brownfield plants, expect mixed levels and compensating controls, and document rationale, traceability, and change control.

You do not need to implement every clause of every IEC 62443 part to be “aligned,” but you cannot cherry-pick controls and imply compliance. In regulated manufacturing, you should be explicit about scope, chosen parts, maturity level, and known gaps, and be careful not to overstate what auditors or customers might interpret as certification.