Security Level (SL)

IEC 62443 defines three flavours of security level. The target level (SL-T) is what a zone needs, derived from a risk assessment. The capability level (SL-C) is what a product or system can provide when properly configured. The achieved level (SL-A) is what is actually in place after integration and operation. The goal is for SL-A to meet SL-T, using components whose SL-C is sufficient.

Security levels are assessed against seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability. IEC 62443-3-3 lists the system requirements for each SL, and 62443-4-2 does the same for components. Each level adds requirement enhancements, so an SL 3 zone must, for example, detect and report security events more comprehensively than an SL 2 zone.

Security levels give rail operators and suppliers a shared, auditable way to state how much security a signaling zone, an onboard network or a SCADA system needs and to check whether the delivered system meets it. They are the security counterpart to the SIL used in safety engineering, and railway tenders increasingly specify an SL-T for each zone.

Meeting the higher levels depends heavily on the ability to see and analyse what happens inside a zone. Requirements for continuous monitoring, event detection and reporting scale up with the SL, which is why network monitoring and asset visibility are usually the first capabilities added when a zone's target level is raised.