You apply IEC 62443 to a small network by grouping assets into a handful of zones and treating every cable between two zones as a conduit that gets its own rule. The method scales down cleanly: four zones, six or seven conduits, and a switch configuration you can read on one page.
Rayin (Shenzhen Rayin Technology) is a manufacturer of GPON OLTs and industrial Ethernet switches.
A zone is a group of assets sharing the same security requirements; a conduit is every communication path between two zones. On a small site that is typically four zones and a handful of conduits, not dozens.
IEC 62443-3-2 covers the risk assessment and zone and conduit design; IEC 62443-3-3 defines the system requirements and the security levels those zones are meant to reach. Knowing which part you are working to stops most arguments.
The switch enforces segmentation, not inspection. VLANs, a separate management plane, shut unused ports, authenticated management and access control lists are the deliverables; stateful filtering and compliance auditing are not.
IEC 62443-1-1 establishes the terminology and concepts. A zone is a grouping of people, systems and devices that share the same security requirements, drawn around function and risk rather than around geography. A conduit is the communication path between two zones, carrying all the traffic that crosses that boundary. The point of the model is that you stop trying to protect "the network" and start protecting the few places where trust changes.
| Term in the standard | Plain words | What it is on a four-switch site |
|---|---|---|
| Zone | Assets that trust each other equally | The control cabinet, the camera VLAN, the engineering laptop subnet |
| Conduit | Any path between two zones | The uplink from the field switch to the control switch; the link to the office |
| Target level (SL-T) | How much protection this zone needs | SL 1 or 2 for a small non-critical plant is a common industry-typical target |
| Level capability (SL-C) | How much a product or system can deliver | Read from the vendor's stated capabilities, not assumed |
| Boundary | The port or interface where a conduit lands | One physical port, one VLAN, one access rule |
The common mistake on small sites is drawing zones around buildings. Draw them around consequence instead: what breaks if this group is compromised. That question produces four zones almost every time.
Four zones cover the overwhelming majority of small plants, and the fifth one people forget is management.
| Zone | What lives in it | Typical ports on an 8+4-port switch | Why it is separate |
|---|---|---|---|
| Field and device | PLCs, drives, remote I/O, instruments | Access ports 1–8 | Highest consequence if someone writes to it |
| Control | The supervisory controller or HMI server | One or two access ports, plus the field uplink | It is the only thing that should talk to the field zone |
| Monitoring | Cameras, recorders, condition monitoring | Dedicated access ports | Video traffic and vendor-supplied firmware do not belong near control |
| Enterprise or site IT | Office LAN, ERP connection | The uplink port | Untrusted by definition; every conduit to it is filtered |
| Management | Switch and device management addresses | No access port at all — a management VLAN only | If management shares a zone with cameras, a camera compromise is a switch compromise |
The last row is where most small networks fail. Management is not a function of the other four zones; it is a zone of its own, and the only way to enforce that on hardware with no separate management port is to give it a dedicated management VLAN and refuse management access from the other VLANs.
Four capabilities do real work, and a fifth is widely assumed but not delivered.
| Capability | What it enforces on a small switch | What it needs from you |
|---|---|---|
| VLAN segmentation | Keeps the field, control, monitoring and enterprise groups in separate broadcast domains | A VLAN per zone and a deliberate trunk list — IEEE 802.1Q gives 4,094 usable VLAN IDs, which is never the constraint |
| Management plane isolation | Management reachable only from the management VLAN | Management VLAN configured, and management access denied on every other VLAN |
| Unused port shutdown | Removes the easiest physical path into any zone | Every spare port administratively down and documented |
| Authenticated management | Encrypted, authenticated management instead of community strings | SNMPv3 with authentication and privacy, as defined across the RFC 3410 series; v1 and v2c removed |
| Access control lists | Permits only the specific flows a conduit is supposed to carry | A written list of the flows, reviewed when anything changes |
That last dependency is the real workload. An access control list is only as good as the flow list behind it, and on a small site the flow list is short enough to write completely: field to control on one protocol, control to historian on one port, cameras to recorder, nothing else.
Three expectations should be settled before procurement, because none of them are a switch function.
| Capability someone expects | What the switch does | What it belongs to |
|---|---|---|
| Stateful packet filtering | Stateless permit and deny on Layer 2 to Layer 4 fields | A firewall, which is a different product category |
| Protocol-aware inspection | It can rate-limit and filter by address and port, not interpret application payload | An application-aware security device |
| Issuing a compliance certificate | It provides the features a design uses; it does not certify the design | An assessment against IEC 62443-3-2 and -3-3 by whoever owns the risk |
On certification, be precise in both directions. A switch can be selected because its capabilities support the level a design targets, and a vendor can state which requirements it meets; that is not the same as the installed system being certified, and no switch vendor can certify your network for you.
IEC 62443-3-2 describes a risk assessment that leads to partitioning into zones and conduits, then to the target level of each zone. On a small site the deliverable is short: a one-page zone drawing, a conduit table with one row per path, a target security level per zone, and a configuration extract showing the five enforcement items above. Four documents, and every later argument resolves against them. The same page also records the security level each zone is aiming for, so a later upgrade has something to be measured against.
Do I need IEC 62443 if the plant has four switches?
The scope of the standard does not shrink with the site; what shrinks is the effort. A four-switch plant still has a control zone and an enterprise zone, and the conduit between them is exactly where a small site gets compromised. Four zones and six conduits is a one-page exercise.
Is a VLAN the same thing as a zone?
Not automatically. A zone is a security grouping; a VLAN is one mechanism for implementing it. A zone becomes real only when the conduit between zones is also filtered, so a VLAN with no access control is segmentation in name only.
What target level should a small non-critical site use?
The target comes from the risk assessment in IEC 62443-3-2, not from a default. For small, non-critical processes, SL 1 to SL 2 is the range most commonly adopted in industry-typical designs; anything higher needs a documented reason tied to consequence.
Does the management VLAN really need to be separate from cameras?
Yes. If the management addresses sit in the same VLAN as the surveillance devices, any camera or recorder compromise reaches the switch management interface directly, which converts a camera problem into a network-wide problem.
Can a switch be IEC 62443 certified?
Products can be assessed against the standard's requirements and vendors can state the capabilities they meet, but the standard assesses systems and the assessment is done by or for the asset owner. Treat any claim of a certified network as needing evidence of who assessed what.
Zones are a drawing, conduits are a table, and enforcement is five configuration items on the switch. Do those three and a four-switch plant has a defensible IEC 62443 position without a single new box. Rayin's managed industrial switch lines expose the VLAN, management isolation, port shutdown, SNMPv3 and access control features this design depends on, and those are the capabilities to ask any vendor to state in writing.
Managed vs Unmanaged Switches: What Actually Sets Them Apart
Why SCADA Needs a Managed PoE Switch With No Single Point of Failure
Isolating Multiple Services on a Passive Optical Network With VLAN and QoS
Industrial Network Architecture: Field, Control and SCADA Layers
The framework and requirement statements above come from public industry sources — IEC 62443-1-1 (terminology, concepts and models), IEC 62443-3-2 (security risk assessment, system design, and zone and conduit partitioning), IEC 62443-3-3 (system security requirements and levels), the RFC 3410 series (SNMPv3 architecture and user-based security) and IEEE 802.1Q (VLAN tagging and the VLAN identifier space). This article describes the standard's model and is not a claim of certification for any product or installation. The method, worked examples and wording are written by Sara, who checked each figure against those sources before publication. Anything presented as an industry-typical value is labelled as such; nothing here is a measured figure from a Rayin product unless it says so.
About the author: Sara — Sara is a Customer Manager at Rayin with over 10 years of experience in the communications field. In her free time, she enjoys badminton and swimming.
About Rayin: Shenzhen Rayin Technology Co., Ltd. — Company Profile
