IACS stands for Industrial Automation and Control System. It is the formal term that IEC 62443 — the most widely adopted industrial cybersecurity standard in the world — uses to describe the full scope of systems it protects.
If you work with PLCs, SCADA, DCS, safety systems, historians, or any hardware and software that controls a physical industrial process, you are working inside an IACS. And if you are responsible for securing those systems, the IACS boundary is what defines where your cybersecurity program starts and ends.
This guide explains where the term comes from, what falls inside the IACS boundary, how IEC 62443 structures security around it, and why the distinction between IACS and generic “IT systems” matters more than most people realize.
Table of Contents
The IEC 62443 Definition of IACS
IEC 62443-1-1 defines IACS precisely:
Industrial Automation and Control System (IACS): A collection of personnel, hardware, and software that can affect or influence the safe, secure, and reliable operation of an industrial process.
Three things stand out in that definition.
First, it includes people — not just technology. Personnel who operate, maintain, and configure industrial systems are part of the IACS. Security programs that ignore the human element miss a core part of what the standard covers.
Second, it uses the phrase “safe, secure, and reliable.” That order matters. Safety and reliability come before security in industrial environments. Any cybersecurity measure that compromises safety or reliability is, by the standard’s own logic, a failure.
Third, the scope is broad. The standard explicitly lists what falls inside the IACS boundary:
- Industrial control systems — DCS, PLCs, RTUs, intelligent electronic devices (IEDs), SCADA, networked electronic sensing and control, and monitoring and diagnostic systems
- Associated information systems — advanced control, online optimizers, equipment monitors, graphical interfaces, process historians, manufacturing execution systems (MES), and plant information management systems
- Associated interfaces — internal, human, network, or machine interfaces used to provide control, safety, and manufacturing operations functionality
That last point is important. The HMI an operator uses, the network switch that carries Modbus traffic, the engineering workstation that programs a PLC, and the historian that logs process data are all inside the IACS boundary. Security must cover all of them.
What Falls Inside the IACS Boundary
One of the most practical uses of the IACS concept is drawing a clear line around what your cybersecurity program must protect. Here is what sits inside that boundary:
Control Systems
| System | What It Does |
|---|---|
| PLC (Programmable Logic Controller) | Executes real-time control logic — opens valves, starts motors, runs sequences |
| DCS (Distributed Control System) | Controls continuous processes in a single facility — refineries, chemical plants, power generation |
| SCADA (Supervisory Control and Data Acquisition) | Monitors and controls distributed systems across wide areas — pipelines, grids, water networks |
| RTU (Remote Terminal Unit) | Collects field data at remote sites and relays it to SCADA; executes remote commands |
| SIS (Safety Instrumented System) | Independent system that shuts down processes when unsafe conditions are detected |
Operator and Engineering Interfaces
| Interface | What It Does |
|---|---|
| HMI (Human-Machine Interface) | The screen operators use to view process data and issue commands |
| Engineering Workstation | Used to program PLCs, configure controllers, and modify control logic |
| Alarm Management System | Processes, prioritizes, and presents alarms to operators |
Supporting Systems
| System | What It Does |
|---|---|
| Historian | Stores time-series process data for trending, reporting, and analysis |
| MES (Manufacturing Execution System) | Tracks production orders, quality, and scheduling |
| Plant Information Management System | Aggregates and distributes process data across the site |
| Online Optimizer | Runs advanced control algorithms to improve process efficiency |
Networks and Communication
| Component | What It Does |
|---|---|
| Control Network | Connects PLCs, DCS controllers, and I/O modules |
| Supervisory Network | Connects HMIs, SCADA servers, and historians |
| Field Network | Connects sensors, actuators, and field devices to controllers |
| Industrial Protocols | Modbus, DNP3, OPC UA, PROFINET, EtherNet/IP, IEC 61850, IEC 60870-5-104 |
What Sits Outside the IACS Boundary
Enterprise IT systems — ERP, email, corporate file servers, HR systems, web servers — are not part of the IACS. However, when these systems connect to the IACS (through a historian mirror, a data gateway, or a remote access server), the connection point becomes a security boundary that must be protected. This is where the IEC 62443 zone and conduit model comes in.
Why the IACS Term Matters
You might wonder why IEC 62443 uses “IACS” instead of the more common terms like ICS, OT, or SCADA. There are good reasons.
It Is Broader Than ICS
ICS (Industrial Control System) typically refers to the control systems themselves — PLCs, DCS, SCADA. IACS includes those systems plus the supporting infrastructure: historians, MES, engineering workstations, plant networks, and the people who operate them. When you base your security program on the IACS boundary, you cover things that an ICS-only focus would miss.
It Is More Precise Than OT
OT (Operational Technology) is a broad industry term with no formal standards definition. Different vendors and organizations define it differently. IACS has an exact definition in IEC 62443-1-1, with a specific list of included systems. When you say “IACS security,” everyone working with the standard knows exactly what scope you mean.
It Includes People
Most technology-focused terms (ICS, OT, SCADA) describe hardware and software. IACS explicitly includes personnel. That matters because IEC 62443-2-1 requires security training, role-based access, background checks, and personnel security procedures as part of the cybersecurity management system. People are inside the boundary.
| Term | Defined By | Scope |
|---|---|---|
| IACS | IEC 62443-1-1 | Personnel + hardware + software that affect industrial processes. Includes control systems, supporting IT, networks, and interfaces. |
| ICS | NIST SP 800-82 | General term for control systems: SCADA, DCS, PLCs. Does not explicitly include MES, historians, or personnel. |
| OT | Industry convention | Hardware and software that monitors or controls physical equipment. No single formal definition. |
| SCADA | Industry convention | Supervisory control for geographically distributed systems. A subset of ICS. |
How IEC 62443 Structures Security Around the IACS
The entire IEC 62443 standard series is organized around the IACS concept. Every part of the standard refers back to it.
Four Stakeholder Roles
IEC 62443 assigns cybersecurity responsibilities to four groups, all defined by their relationship to the IACS:
Asset owners — organizations that own and operate the IACS. They are responsible for defining security requirements, conducting risk assessments, and maintaining the cybersecurity management system (CSMS). Covered in IEC 62443-2-1.
System integrators — companies that design, build, commission, and configure the IACS. They are responsible for implementing security requirements during system design and deployment. Covered in IEC 62443-2-4 and 62443-3-3.
Product suppliers — manufacturers of IACS components (PLCs, controllers, HMIs, network equipment, software). They are responsible for building security into products through a secure development lifecycle. Covered in IEC 62443-4-1 and 62443-4-2.
Service providers — companies that maintain, patch, or remotely access the IACS after deployment. They are responsible for following security procedures during maintenance and support. Covered in IEC 62443-2-4.
No single party can secure an IACS alone. The asset owner depends on secure products from suppliers. The integrator must design the system correctly. The service provider must maintain it safely. This shared responsibility model is a founding principle of the standard.
Zones and Conduits
IEC 62443 divides the IACS into security zones — logical groups of assets that share the same security requirements. Zones are connected by conduits — controlled communication pathways with defined security rules.
This model gives you a structured way to segment the IACS and control how data flows between different parts of it. The most important boundary is usually between the IACS and the enterprise IT network, typically protected by a demilitarized zone (DMZ).
Security Levels
Each zone within the IACS is assigned a target security level (SL-T) based on the threat it faces:
| Level | Protects Against |
|---|---|
| SL 1 | Casual or accidental violation |
| SL 2 | Intentional attack using simple means and low resources |
| SL 3 | Intentional attack using sophisticated means and moderate resources |
| SL 4 | Intentional attack using sophisticated means with extended resources (nation-state) |
The security level determines which system requirements (SRs) from IEC 62443-3-3 must be met. Higher levels require stronger controls for authentication, access control, encryption, monitoring, and availability.
Seven Foundational Requirements
Every technical requirement in IEC 62443 traces back to one of seven foundational requirements. These apply to the IACS as a whole:
- FR 1 — Identification and authentication control
- FR 2 — Use control
- FR 3 — System integrity
- FR 4 — Data confidentiality
- FR 5 — Restricted data flow
- FR 6 — Timely response to events
- FR 7 — Resource availability
These are not suggestions. They are structured requirements with specific system requirements (SRs) and requirement enhancements (REs) at each security level.
The IACS Lifecycle
IEC 62443-1-1 defines a lifecycle model for the IACS that security must follow:
Assess — Identify assets, threats, and vulnerabilities. Conduct a risk assessment. Define security level targets for each zone.
Implement — Design and build the security controls. Segment networks. Deploy access controls, monitoring, and endpoint hardening.
Maintain — Operate the CSMS. Manage patches per IEC TR 62443-2-3. Monitor for threats. Audit compliance. Respond to incidents.
Improve — Review the program. Update risk assessments when the threat landscape changes or the IACS is modified. Continuously improve.
The standard makes one point repeatedly: cybersecurity is not a project with a start and end date. It is a continuous process. Organizations that treat it as a one-time effort see their security level decline over time as new threats emerge, systems change, and people forget.
Why IACS Security Is Different From IT Security
The IACS operates under constraints that IT systems do not have. These constraints shape every security decision:
Availability is non-negotiable. You cannot take a water treatment plant offline for a patch window. You cannot reboot a substation controller during peak load. The IACS must keep running.
Real-time performance matters. Control loops operate in milliseconds. A security tool that adds latency to a safety-critical communication path is not acceptable.
System lifecycles are measured in decades. PLCs installed 20 years ago may still run Windows XP Embedded and communicate over Modbus with no authentication. These systems cannot be upgraded without significant downtime and cost.
Physical consequences are real. A misconfigured firewall rule in IT might block email. A misconfigured firewall rule in the IACS might block a safety shutdown command, leading to an explosion, a chemical release, or an equipment failure.
Protocols lack security. Modbus, DNP3, and OPC Classic were designed for reliability, not security. They have no authentication, no encryption, and no integrity checking. Any device that can reach the network can send commands.
These differences are why IEC 62443 exists as a separate standard from ISO 27001. IT security frameworks assume you can patch regularly, reboot when needed, and prioritize confidentiality. The IACS cannot make those assumptions.
IACS vs. IACS Cybersecurity vs. Industrial Cybersecurity
These terms are related but not identical:
IACS is the system itself — the collection of personnel, hardware, software, and networks that control an industrial process.
IACS cybersecurity is the practice of protecting that system. It is the scope defined by IEC 62443. When someone says “IACS cybersecurity,” they mean security within the boundary defined by the standard.
Industrial cybersecurity is the broader industry term. It covers IACS cybersecurity plus organizational strategy, regulatory compliance, IT/OT convergence, and the business context. Industrial cybersecurity is the umbrella. IACS cybersecurity is the technical core underneath it.
Frequently Asked Questions
What does IACS stand for?
IACS stands for Industrial Automation and Control System. It is defined in IEC 62443-1-1 as a collection of personnel, hardware, and software that can affect or influence the safe, secure, and reliable operation of an industrial process.
What is the difference between IACS and ICS?
IACS is broader. ICS (Industrial Control System) typically refers to control systems like SCADA, DCS, and PLCs. IACS includes those systems plus supporting infrastructure — historians, MES, engineering workstations, plant networks — and explicitly includes personnel. IACS is the term IEC 62443 uses; ICS is the term NIST SP 800-82 uses.
What is the difference between IACS and OT?
OT (Operational Technology) is an industry term with no single formal definition. IACS has a precise definition in IEC 62443-1-1 with a specific list of included systems. In practice, the two terms overlap significantly, but IACS is more precise and includes people in its scope.
What standard covers IACS security?
IEC 62443 is the primary international standard for IACS security. It covers the full lifecycle and assigns requirements to asset owners, system integrators, product suppliers, and service providers. NIST SP 800-82 provides complementary U.S.-focused guidance for ICS security.
What industries use IACS?
Any industry that uses automation to control physical processes: energy and utilities, oil and gas, manufacturing, water and wastewater, chemical processing, pharmaceuticals, transportation, mining, food and beverage, and building automation.
Is IACS security the same as industrial cybersecurity?
IACS security is the technical core of industrial cybersecurity. Industrial cybersecurity is the broader term that also covers organizational strategy, regulatory compliance, and business context. Think of IACS security as what IEC 62443 defines. Industrial cybersecurity is the wider industry practice that includes it.