ISA/IECISA/IEC 62443IEC 62443: System & Component Security RequirementsEASYFree question
A control system must enforce least privilege so that a maintenance role cannot download new logic to a controller. Mapping this to IEC 62443-3-3, the relevant system requirement family falls under:
- A.FR 3 System Integrity
- B.FR 1 Identification and Authentication Control
- C.FR 2 Use Control
- D.FR 5 Restricted Data Flow
Why C is correct
Least privilege and authorization enforcement, including restricting which roles may perform privileged actions like program download, belong to FR 2 (Use Control). FR 1 only establishes who the user is; FR 2 governs what that role is permitted to do.
Know someone studying for ISA/IEC 62443? Send them this one.