Glossary · OT cybersecurity
Industrial automation and control system (IACS)
Also known as: IACS
German: Industrielles Automatisierungs- und Steuerungssystem (IACS)
In IEC 62443, an industrial automation and control system (IACS) is the collection of personnel, hardware, software and policies involved in the operation of an industrial process that can affect or influence its safe, secure and reliable operation. It includes controllers, HMIs, networks, engineering tools and the people and procedures around them.
- OT security
- Standards
In one sentence
In IEC 62443, an IACS is the people, hardware, software and policies that can affect the safe, secure and reliable operation of a process.
Example
The IACS of a water treatment plant includes the PLCs and remote stations, the SCADA servers, the engineering laptops, the network and the operating procedures of the control room staff.
How it applies
- Engineering: IEC 62443 uses IACS as its scope term. Because it includes people and policies, securing an IACS covers organizational measures as well as technical ones.
- Operation: The Asset owner operates the IACS; the System integrator builds the automation solution; the Product supplier delivers the components. Each role has its own IEC 62443 parts.
- Compliance: Using the IACS term signals that a document follows the IEC 62443 frame, which helps when mapping to NIS 2 or CRA obligations. Following the standard supports, but does not by itself establish, compliance with those laws.
- Documentation: In security documentation, define early whether "system" means the product, the automation solution or the whole IACS. Mixing these scopes is a common source of misunderstanding between supplier and operator.
IACS vs. ICS
Industrial control system (ICS) usually refers to the technical control system. IACS in IEC 62443 is broader and explicitly includes personnel and policies.