The Industry IoT Consortium (IIC) and the International Society of Automation (ISA) have jointly released the IoT Security Maturity Model (SMM): 62443 Mappings for Asset Owners, Product Suppliers, and Service Suppliers. Announced on August 22, 2022, in Boston, Massachusetts, this guidance document extends the earlier IoT Security Maturity Model Practitioner’s Guide by incorporating the service provider role alongside asset owners and product suppliers, along with updated mappings to the ISA/IEC 62443 standards. Ron Zahavi, Microsoft’s Chief Strategist for IoT Standards and co-author of the IoT SMM, highlighted that these standards serve as a critical global framework for industrial automation and control systems (IACS) security, established through the International Electrotechnical Commission (IEC). The IoT SMM enables organizations to assess their current security maturity against target goals and identify improvement opportunities over time. The ISA99 committee developed the 62443 series to address vulnerabilities in Industrial Automation and Control Systems through a systematic risk mitigation approach. Although these standards focus on the maturity of security programs, they do not provide direct practical guidance for achieving the maturity levels. Frederick Hirsch, co-chair of the IIC ISA/IIC Contributing Group, observed that achieving security maturity targets is difficult without such guidance.

The new 62443 mappings align the comprehensiveness levels in the IIC IoT SMM with ISA/IEC 62443 requirements, helping asset owners and product suppliers in IACS to reach appropriate maturity levels aligned with their security needs. Eric Cosman, co-chair of the ISA99 Committee, emphasized the necessity of combining standards with actionable guidance, noting that while ISA/IEC 62443 codifies proven engineering practices, standards alone are insufficient. This joint initiative by IIC and ISA offers the practical direction needed to promote widespread adoption. Pierre Kobes, a member of ISA99 and IEC Technical Committee 65, added that the model assists companies in selecting security measures proportional to their assessed risks, promoting risk-based rather than indiscriminate security enhancements. The detailed IoT Security Maturity Model document, covering 62443 mappings for asset owners, product suppliers, and service providers, is available for download from both the IIC and ISA websites. It includes a full list of contributing authors and notes ongoing efforts to further refine the model with expanded role definitions and guidance for service providers. This development highlights the increasing need for tailored security frameworks in the evolving IoT landscape, particularly as industrial systems adopt complex digital technologies. By aligning practical maturity models with established international standards, organizations can better manage risk, bolster security resilience, and ensure the safe, reliable operation of critical infrastructure in Industry 4. 0 settings.