IEC 62443-4-1 vs. ETSI EN 303 645: Which Security Baseline Fits Your Product?

If you build connected products, you have probably been told you need to comply with IEC 62443 or ETSI EN 303 645, or possibly both. The two standards get lumped together in compliance checklists as though they were interchangeable. They are not. IEC 62443-4-1 defines requirements for a secure product development lifecycle. It is a process standard that tells you how to build products securely. ETSI EN 303 645 defines baseline security provisions for consumer IoT products. It is a product standard that tells you what the product must do. The distinction matters because getting it wrong means teams waste effort applying the wrong type of requirements to the wrong type of problem. 

The two standards in detail 

IEC 62443-4-1 and the development lifecycle 

IEC 62443-4-1 is part of the broader IEC 62443 series for industrial automation security and control systems. It focuses on the secure product development lifecycle and organizes its requirements into eight practice areas: security management, specification of security assurance requirements, secure-by-design architecture, secure implementation with mandatory code review and static analysis, security verification and validation through penetration testing and fuzzing, management of security-related issues after release, security update management, and security guidelines documentation for integrators and end users. 

The vulnerability management practice area aligns closely with what the Cyber Resilience Act demands under Annex I Part II. As we covered in Cyber Resilience Act: The Complete Survival Guide for Manufacturers, the CRA expects manufacturers to operate structured processes for intake, triage, assessment, and remediation of vulnerabilities across the product lifecycle. IEC 62443-4-1 defines exactly this kind of process. 

Each practice area uses maturity levels from 1 through 4. The manufacturer selects the level appropriate to the product's risk context, making the standard scalable: a level 1 process is defined and followed, while a level 4 process is continuously improved based on metrics. 

ETSI EN 303 645 and product requirements 

ETSI EN 303 645 does not prescribe how to build the product. It specifies what consumer IoT products must do once deployed, through 13 baseline provisions covering consumer IoT security and data protection. 

The most impactful provisions prohibit universal default passwords, require manufacturers to publish a vulnerability disclosure policy and provide a contact point, mandate secure software updates with integrity verification and a defined support period, and require that sensitive security parameters like credentials and keys are stored with proper protection. The standard also requires encrypted communication, disabled debug interfaces in production, software integrity verification through secure boot or signed firmware, and input validation across all interfaces. Additional provisions address personal data protection, network outage resilience, telemetry monitoring, user data deletion, and ease of secure installation. 

ETSI EN 303 645 provides a security baseline for consumer IoT. Some radio products may also fall within the RED cybersecurity requirements. For in-scope radio equipment, the harmonized EN 18031-1, EN 18031-2 and EN 18031-3 standards support those requirements, subject to restrictions. To check the likely RED cybersecurity scope and relevant EN 18031 parts for a radio product, use QIMA Cyberexpert and scope your product for free. We explain the wider overlap between the RED and the AI Act in Is Your Radio Device High-Risk? The AI Act & RED Overlap Explained.

How they compare 

The two standards diverge on scope, target environment, and assessment model. IEC 62443-4-1 governs the development process, and a manufacturer can be certified without reference to a specific product, because the certificate applies to the organization's lifecycle security processes. ETSI EN 303 645 governs a specific product's security properties, and the compliance evidence is product-specific. 

IEC 62443 was designed for industrial automation security: factory floors, power grids, water treatment, building automation. The threat models assume long-lived systems and constrained update windows. ETSI EN 303 645 was designed for consumer IoT security: smart cameras, routers, wearables, connected appliances. The threat models assume mass-market deployment and attackers exploiting default configurations at scale. 

IEC 62443-4-1 uses a maturity model where the manufacturer selects a level and demonstrates their processes meet it. ETSI EN 303 645 uses a compliance model where each provision is either met or not. Both standards require vulnerability management, but IEC 62443-4-1 defines the organizational process while ETSI EN 303 645 requires the product to implement specific capabilities. The two complement each other but are not interchangeable. 

The overlap is real and useful. Both expect secure-by-design practices, both require published vulnerability disclosure policies, both require secure update delivery, and both expect encrypted communication (though the specific technical security controls for communication sit in IEC 62443-4-2, the component-level standard). Manufacturers who ship products into both markets can reuse work done for one standard when addressing the other. 

Which standard to choose 

If you manufacture components for operational technology environments such as PLCs, SCADA systems, or embedded controllers, IEC 62443 is the primary framework. IEC 62443-4-1 covers the process and IEC 62443-4-2 covers the component-level technical security controls. If you manufacture consumer connected products, ETSI EN 303 645 is what your conformity assessment will be evaluated against. If your product straddles both worlds, you likely need to address both: IEC 62443-4-1 as the organizational foundation and ETSI EN 303 645 for the consumer-facing aspects.

Connection to the CRA and EUCC 

Both standards feed into the regulatory architecture that the Cyber Resilience Act is reshaping. IEC 62443-4-1 process evidence overlaps with CRA Annex I Part II requirements. ETSI EN 303 645 provisions map onto CRA essential requirements for product-level cybersecurity compliance. For manufacturers pursuing EUCC certification, Common Criteria evaluation draws on the same kinds of lifecycle evidence that IEC 62443-4-1 addresses, and the product-level security assurance requirements overlap with both ETSI EN 303 645 and IEC 62443-4-2. We covered this alignment in ​​Navigating EUCC: Practical Steps for Manufacturers to Maintain Compliance and Trust. 

The most efficient path is to build a single product security framework that generates reusable evidence across all applicable frameworks, rather than running separate compliance efforts for each. 

How QIMA CCLab can help you achieve your goals

At QIMA CCLab Cybersecurity Laboratory, we are an accredited IT Security Evaluation Facility (ITSEF) under TrustCB in the EUCC scheme at the Substantial assurance level. We have been running cybersecurity evaluations since 2013 and work with manufacturers across the full compliance lifecycle: 

• Cybersecurity Evaluation: Penetration testing and vulnerability assessment grounded in CC-based methodology, applicable to products evaluated against IEC 62443 or ETSI EN 303 645. 

• Common Criteria Evaluation: EAL4+ evaluations within four months using our agile methodology. 

• Common Criteria Consultancy: Security Targets, design evidence, test documentation, and lifecycle management materials aligned to EUCC, CRA, and related requirements. 

• Cyber Resilience Act Compliance: CRA readiness assessments, gap analysis, and technical documentation support drawing on evidence from both IEC 62443 and ETSI EN 303 645. 

FAQs

What is IEC 62443-4-1? 

IEC 62443-4-1 defines requirements for a secure product development lifecycle within the IEC 62443 series. It covers eight practice areas and uses a maturity model (levels 1 through 4). It applies primarily to manufacturers of industrial automation and control system components. 

What is ETSI EN 303 645? 

ETSI EN 303 645 defines 13 baseline cybersecurity provisions for consumer IoT products. It is the primary harmonized standard under the EU Radio Equipment Directive Delegated Act for connected consumer devices. 

Can a product comply with both standards? 

Yes. IEC 62443-4-1 governs the development process and ETSI EN 303 645 governs the product's security properties. For products that straddle consumer and industrial markets, addressing both provides more complete coverage. 

How do these standards relate to the CRA? 

Both generate evidence that supports CRA compliance. IEC 62443-4-1 maps onto CRA Annex I Part II requirements. ETSI EN 303 645 provisions align with CRA essential requirements for product-level security controls. 

Which standard should I start with? 

Start with the one your market expects. Industrial manufacturers should begin with IEC 62443-4-1 and 4-2. Consumer IoT manufacturers should start with ETSI EN 303 645. If both markets apply, begin with IEC 62443-4-1 because the process foundation makes product-level compliance repeatable.