IEC 62443 vs NIST 800-82: how the controls map

IEC 62443 and NIST SP 800-82 are the two documents most OT security programs in the US end up reading side by side. They agree on most of what matters for network segmentation, but they are different kinds of document, written for different readers, and they number everything differently. This guide sets them next to each other and maps the requirements a firewall review can speak to from one to the other.

What each document is

ISA/IEC 62443 is an international series of standards for industrial automation and control systems, developed by the ISA99 committee and published by both ISA and the IEC. It covers policies and programs, system design and requirements, and component requirements. Two parts matter most for segmentation: IEC 62443-3-2, which asks the asset owner to partition the system into zones and conduits and set a target security level (SL-T) for each, and IEC 62443-3-3, which lists the system security requirements (SRs) grouped under seven foundational requirements. The standards are licensed documents, and products, processes and systems can be certified against some parts.

NIST SP 800-82 Rev. 3, the Guide to Operational Technology (OT) Security, was published by the US National Institute of Standards and Technology in September 2023. It is free, it is guidance rather than a standard, and nothing is certified against it. It explains OT risk and architecture, applies the NIST Cybersecurity Framework to OT in section 6, and includes an OT overlay of the SP 800-53 Rev. 5 security controls in Appendix F.

How they differ

	IEC 62443	NIST SP 800-82r3
Kind of document	International standard series	US government guidance
Cost	Licensed	Free
Certification	Available for some parts	None
Core segmentation idea	Zones and conduits, each zone with a target security level	Segment and isolate IT and OT; permit only between adjacent levels, tiers or zones
How requirements are written	System requirements (SRs) by foundational requirement, with enhancements by security level	Recommendations by Cybersecurity Framework function, plus SP 800-53 controls tailored for OT
Reference architecture	None required	Names the Purdue model, ISA-95 levels and the three-tier IIoT architecture as options

Neither one requires the Purdue model. Both treat it as a common way to draw zones; see the Purdue model guide.

How the requirements map

The table below takes the IEC 62443-3-3 requirements that a firewall configuration and its traffic log can give evidence for, and lists the SP 800-82r3 sections that address the same theme, with the SP 800-53 controls from its OT overlay. The mapping is by theme. It is not an official crosswalk from either body, and neither column replaces reading the source.

Theme	IEC 62443-3-3	NIST SP 800-82r3 section	SP 800-53 control
Separate OT from other networks	SR 5.1 Network segmentation	5.2.3.1 Network Architecture; 6.2.1.3 Network Segmentation and Isolation	SC-7 Boundary Protection
Control what crosses each boundary	SR 5.2 Zone boundary protection	5.2.3.1 (only adjacent levels, tiers or zones); 6.2.1.3 (deny-all, permit-by-exception where possible)	SC-7 Boundary Protection; AC-4 Information Flow Enforcement
Business traffic stops in a DMZ	SR 5.2 Zone boundary protection	5.2.3.1 (DMZ as an enforcement boundary); 5.4.1 (enterprise traffic through DMZ services, Fig. 18)	SC-7 Boundary Protection
Keep email, web and similar traffic out of OT	SR 5.3 General purpose person-to-person communication restrictions	Section 5 introduction (internet access, email and remote access typically not allowed on OT networks)	SC-7 Boundary Protection
Remote and vendor access	SR 1.13 Access via untrusted networks	6.2.10 Remote Access	AC-17 Remote Access
Cleartext across a boundary	SR 4.1 Information confidentiality	6.2.3 Data Security (PR.DS)	SC-8 Transmission Confidentiality and Integrity
Only the services the system needs	SR 7.7 Least functionality	6.2.4.1 Least Functionality (PR.IP-1)	CM-7 Least Functionality
Log what crosses	SR 2.8 Auditable events	5.2.3.2 Centralized Logging; 6.2.6.1 Logging (PR.PT-1)	AU-2 Event Logging; AU-12 Audit Record Generation
Watch the boundaries	SR 6.2 Continuous monitoring	5.2.3.3 Network Monitoring; 6.3.2.1 Network Monitoring (DE.CM-1)	SI-4 System Monitoring
Know what is on the network	SR 7.8 Control system component inventory	6.1.1 Asset Management (ID.AM); 6.1.1.1 Mapping Data Flows	CM-8 System Component Inventory

Two differences show up when you read across a row:

• Strength is set differently. IEC 62443 ties how strong a control must be to the zone’s target security level: the first enhancement of SR 5.2, deny by default and allow by exception, applies from SL 2 upward. SP 800-82r3 has no security levels; it recommends deny-all, permit-by-exception “where possible” and leaves the rigor to the organization’s risk management.
• Architecture is more explicit in SP 800-82r3. The adjacent-level rule (“only permit connections between adjacent levels, tiers, or zones”) and the guidance that Level 4 should not reach Levels 2, 1 or 0 directly are written out in section 5.2.3.1. IEC 62443 reaches the same place through conduits: a path the conduit list does not include should not exist.

The IEC 62443 guide and the NIST SP 800-82r3 guide cover each document on its own.

Which one should you follow?

Often both. IEC 62443 gives the structure an assessor or certification body expects: zones, conduits, target security levels and named system requirements. SP 800-82r3 gives free, detailed guidance and the SP 800-53 controls that US federal and many sector programs already speak. A finding written against one usually has a counterpart in the other, so a review that cites both lets the same evidence serve an IEC 62443 program and a NIST-based one.

Firewall evidence covers only part of either document. Both also ask for policies, training, physical security, incident response and recovery, which no firewall can show.

How SegAudit reports against both

SegAudit’s audit report cites the IEC 62443-3-3 requirements each finding relates to, and its NIST SP 800-82r3 overlay restates the same findings with the SP 800-82r3 section, figure and SP 800-53 controls. The compliance crosswalk marks each IEC 62443-3-3 requirement in the table above as supported, partial or a gap from the firewall evidence, next to NIST CSF 2.0 and the other frameworks a client may answer to. Neither is a certification. See frameworks for the full list.

Common questions

Is NIST SP 800-82 based on IEC 62443?

No. They were written separately, by NIST and by the ISA99 committee, and SP 800-82r3 refers to ISA/IEC 62443 throughout; they agree on most network guidance. SP 800-82r3 says its adjacent-level concept applies to ISA/IEC 62443 architectures too, and both treat the Purdue model as a common reference rather than a requirement.

Can one assessment cover both IEC 62443 and NIST SP 800-82?

For the network part, largely yes. The same firewall rules and traffic give evidence for IEC 62443-3-3 SR 5.1 and SR 5.2 and for SP 800-82r3 section 5.2.3.1 with SC-7 and AC-4. Cite both in each finding. The rest of each document still needs its own evidence.

Do I need IEC 62443 certification to follow NIST SP 800-82?

No. SP 800-82r3 is guidance with no certification of its own, and following it does not require IEC 62443 certification. Some customers, sectors or contracts ask for one or the other, so check what applies before choosing where to put the effort.