What are the eight practices of IEC 62443-4-1, and how is maturity graded?
SM security management, SR specification of security requirements, SD secure by design, SI secure implementation, SVV security verification and validation testing, DM management of security-related issues, SUM security update management, SG security guidelines. Each practice is rated on a CMMI-based maturity level 1 to 4.
* Security management wraps everything; four practices cover development, two the post-launch phase, and one the customer. *
| # | Practice | Covers |
|---|---|---|
| 1 | SM Security management | Management system, roles and responsibilities, development and supplier security |
| 2 | SR Security requirements | Product context, threat modelling, requirements management |
| 3 | SD Secure by design | Principles such as defence in depth, best practices, design review |
| 4 | SI Secure implementation | Secure coding, implementation review |
| 5 | SVV Verification and validation testing | Requirements and mitigation testing, vulnerability scanning and pentesting, tester independence |
| 6 | DM Security-related issues | Vulnerability handling: receive, review, assess, address, disclose, review periodically |
| 7 | SUM Security update management | Update qualification and documentation, patching of third-party software, delivery, emergency patching |
| 8 | SG Security guidelines | Product documentation for defence in depth, hardening, secure operation, disposal, account management |
The order mirrors a lifecycle. SM wraps everything, SR to SVV are development, DM and SUM are post-launch, and SG is what the customer gets to run the product securely. The maturity level (1 to 4, modelled on CMMI) grades how well the organisation performs each practice.