Glossary · OT cybersecurity
Product supplier
Also known as: Component supplier, Product manufacturer (IEC 62443)
German: Produktlieferant
In IEC 62443, the product supplier is the organization that manufactures and supports a hardware or software product, such as a controller, network device, embedded device or software application, used in industrial automation and control systems. IEC 62443-4-1 and IEC 62443-4-2 address its development process and product requirements.
- OT security
- Standards
In one sentence
In IEC 62443, the product supplier makes and supports components for control systems and follows IEC 62443-4-1 and 4-2 for development and features.
Example
A drive manufacturer, as product supplier, develops its firmware under an IEC 62443-4-1 certified process and publishes security advisories for its drives.
How it applies
- Product development: The product supplier implements a Security development lifecycle (SDL) (IEC 62443-4-1) and provides security capabilities matching a capability security level (IEC 62443-4-2).
- Support: The supplier handles vulnerabilities, publishes Security advisory documents and delivers security updates for the support period. Under the Cyber Resilience Act (CRA), manufacturers of products with digital elements have legal obligations for this in the EU.
- Collaboration: Integrators and asset owners rely on the supplier's information about security features, intended environment and required compensating measures.
- Documentation: IEC 62443-4-1 expects security guidelines for the product: how to install, configure, operate and decommission it securely. This is a documentation deliverable; technical writers should own it together with product security.
Product supplier vs. system integrator
The product supplier delivers components. The System integrator combines components into an automation solution for a specific site. A machine builder is often both: supplier of the machine as a product and integrator of purchased components.