Quiz Entry - updated: 2026.10.13
What is the difference between a process standard and a control standard in product security, with examples?
A process standard says how to develop securely (activities, roles, lifecycle), for example IEC 62443-4-1, ISO/SAE 21434 or Microsoft SDL. A control standard says which security measures the product must have, for example IEC 62443-4-2, ETSI EN 303 645 or FIPS 140-3.
| Process standards (how you build) | Control standards and hybrids (what the product has) |
|---|---|
| Common Criteria part 3, assurance requirements (ISO 15408-3) | Common Criteria part 2, functional requirements (ISO 15408-2) |
| ISO/SAE 21434, automotive | EN 18031, radio equipment cybersecurity |
| IEC 62443-4-1, IACS component development process | IEC 62443-4-2, IACS component security measures |
| ISO 81001-5-1, health software security lifecycle | ETSI EN 303 645, consumer IoT |
| CLC/TS 50701, railway | FIPS 140-2/-3, cryptographic modules |
| Microsoft SDL, OWASP SAMM | NIST CSF, CSA Cloud Controls Matrix, NIST SP 800 series |
Both are needed and they often come in pairs, such as 62443-4-1 with 4-2 or CC part 3 with part 2. A product can have every required control and still be insecure if the process that built it skipped testing. A perfect process proves nothing if the controls it produced are too weak for the threat.
Go deeper:
OWASP SAMM — an open process maturity model to compare with IEC 62443-4-1- Information security standards (Wikipedia) — overview of the standards named here