IEC 62443 · Industrial Control · Operator Interfaces · OT Security

The standard regulates your process and your system. Availability outranks everything else.

Twelve other standards on this site reach your JavaScript indirectly, and 62443 does too — it never names obfuscation, and nothing in it requires or forbids the technique. What makes it worth its own page is a priority inversion that changes the engineering answer: in operational technology, safety and availability come before confidentiality. Once that is true, a runtime guard that can blank an operator console stops being a cautious default and becomes a hazard you have to justify.

The Short Version

Process and records, not code shape

Four contact points, and the sharpest one argues for switching options off.

Availability inverts the adviceEvery failure action except degrade ends by throwing. On a control screen that is the hazard.
The lifecycle is where you scoreReproducible builds, a manifest and an archived symbol map are real evidence.
Segmentation is the controlOn an isolated network a browser-side domain check adds maintenance, not security.
What The Standard Actually Governs

A process, an architecture, and a set of system capabilities

The 62443 series is a family rather than a single document, and the parts that matter to a product team are the ones about how you build and what your product can do. None of them describes source code style, and an assessor will not ask whether your bundle is obfuscated. Knowing which part of the family a question comes from is most of the work of answering it well.

The development lifecycle

A defined process: threat modelling, secure design and implementation practices, verification, defect handling and the ability to service what you shipped. This is the part your build pipeline can produce genuine evidence for.

Technical capabilities of the system

The foundational requirements, covering identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability. These are met by the system, not by the browser.

Zones, conduits and security levels

The architecture is assessed by grouping assets into zones with defined communication paths between them, and assigning a target security level per zone. Where your interface sits in that model matters far more than how its code was written.

The Inversion

Safety and availability come first, and that removes options

This is the section to read if you read only one. Everywhere else on this site, a runtime guard that halts execution when it detects tampering is a defensible default. On an operator interface it is a control that can take away the view of a running process, and the standard's priority order says that is the more serious harm.

What the failure actions actually do

When a guard in this engine trips, it performs the failure action you configured. Blanking needs a document element, reloading needs a location object to reload, redirecting needs a location to assign — and every one of those paths still ends by throwing. The single exception is the degrade action, which raises a custom event, sets a flag and lets your own code decide what happens next. On a control screen that distinction is the whole argument.

Why an operator console cannot fail closed

A blank panel during a process upset is not a security outcome, it is a loss of situational awareness at the moment it is least affordable. Any control that can produce that result has to be weighed against the harm it prevents, and on an isolated control network the harm it prevents is close to nil. If a guard is used at all here, degrade is the only action worth defending in a hazard review.

Guards fail rather than skip when the environment is unusual

The environment checks are written to fail closed by design. The domain lock resolves the hostname and, if there is no usable value, fires the failure action before consulting your allowlist. The browser and operating-system locks both begin by reading the navigator object and take the same failure path when it is absent, and an unrecognised client classifies as unknown, which is never in an allowlist. Panel viewers, embedded runtimes and kiosk shells are exactly the environments where those assumptions break.

Console suppression removes your only field diagnostic

The option that empties the console methods deletes the diagnostic channel a commissioning engineer or a site technician can capture and send you. On installed systems you cannot reach, that is often the only evidence you will ever get about a fault. It is a poor trade on a public website and an indefensible one here.

Contact Point One

The lifecycle, where a build pipeline produces real evidence

This is where protection has something honest to contribute, and it is not the transformation. It is the record that a specific artifact came from a specific source, can be reproduced on demand, and can still be diagnosed years later.

A build you can reproduce

Identifier generation is randomised per build by default. Recording a fixed seed makes the output deterministic, so a released artifact can be rebuilt and compared byte for byte against what you shipped. See reproducible builds.

A manifest that ties source to output

The build can emit a manifest recording a hash of each input and each output. That is the artifact-to-source link an assessor is looking for, and it is stronger evidence than a signed release note because it is checkable.

A symbol map kept for the support life

Archive the map against the released version, with a retention period matched to how long the product is supported rather than to your build system's default. Without it, a fault report from an installed system years later is close to undiagnosable.

Contact Point Two

The component inventory, generated before the transformation

Every serious lifecycle expectation includes knowing what third-party code is in your product and being able to respond when a vulnerability is published against it. Protection interacts with that in one specific way, and the fix is an ordering rule rather than a setting.

Scanners recognise code, so run them first

Composition analysis identifies dependencies by recognising known code. Transformed output is much harder to recognise, so a scanner pointed at a protected bundle under-reports and gives you a falsely clean picture. Generate the inventory from your dependency manifests and lock files before the protection step. This is the same ordering rule as every other tool that works by reading code.

Attach the inventory to the release record

The inventory and the artifact have to travel together, because the question that arrives later is always about a specific installed version. Keep them in the same record as the build manifest and the seed, so answering "is this site affected" is a lookup rather than an investigation.

Contact Point Three

Where the interface sits, and where authority sits

The architecture the standard describes already answers the question most teams ask about protecting HMI logic, because it assumes the panel is a view and the equipment is the authority.

The panel renders; the controller enforces

Interlocks, permissive conditions, setpoint limits and command authorisation belong to the equipment that enforces them. A limit checked only in the browser is one that anybody at that workstation can remove, and no build setting changes where the decision is made.

Segmentation is the control, not a browser check

On an isolated network, restricting who can reach the interface is done by the zone and conduit design. A hostname check inside the page adds maintenance and a failure mode without adding a boundary that an attacker on the network would have to cross.

Addressing changes are routine maintenance

Systems reached at an address rather than a name force the allowlist to enumerate addresses, and addressing changes during commissioning, expansion and replacement. That is a lock that breaks on a schedule set by other people's work.

Contact Point Four

The copied panel, which is a real and different problem

Having argued most of the runtime options off this platform, it is worth being clear about the case where protection genuinely earns its place. It is not the intruder on the network. It is the interface leaving with somebody who was legitimately given it.

Integrators, subcontractors and customers hold your code

A delivered operator interface is readable by everyone who receives the system, and in this industry that includes parties who also work for your competitors. Raising the cost of lifting your implementation into a rival product is a commercial control, and it is a legitimate one as long as it is described that way rather than as a security requirement.

Watermarking attributes a copy to a release

A keyed tag embedded in the build lets you take a panel you encountered somewhere unexpected and attribute it to the release it came from. It proves origin rather than preventing copying, and for delivered industrial software that is usually the question that actually gets asked.

Questions

Frequently asked questions

Does IEC 62443 require us to obfuscate our HMI JavaScript?

No. Like every other standard covered on this site, it does not name the technique at all. The 62443 series asks about a development process, a system architecture and a set of technical capabilities: how you identify and authenticate users, how you control what they may do, how you protect integrity, how you handle events, how you keep the system available. The form your source takes is not a subject of the standard. Where protection can contribute is indirect and worth stating precisely: it supports the integrity and tamper-evidence story for code that leaves your premises, and it supports nothing at all in the authentication or use-control requirements, which are met by the system rather than by the browser.

What actually changes when the standard is 62443 rather than an IT one?

The priority order inverts, and that single fact changes which options are safe. Ordinary information security ranks confidentiality first. Operational technology ranks safety and availability first, because the system is controlling a physical process and stopping it has consequences that a data breach does not. Once availability outranks confidentiality, any control that can fail closed on an operator console has to be justified against the harm of that console going blank during an upset. That reasoning removes most of the runtime defenses from consideration on an HMI, and it is the opposite of the conclusion you would reach on a public web page.

Why are runtime guards a poor fit for an operator console?

Because their failure behaviour is designed for a web page, where failing closed is cautious, and on a control system it is the hazard. Every one of the failure actions this engine offers ends by throwing, with a single exception. Blanking the page needs a document element, reloading needs a location object, redirecting needs a location, and all of them throw as well. Only the degrade action, which raises an event and sets a flag for your own code to react to, does not. On an operator screen the difference between raising a flag your application handles and blanking the display is the difference between a logged anomaly and an operator who has lost their process view. If a guard is used here at all, degrade is the only defensible action.

Our HMI is reached by IP address on an isolated network. Does the domain lock work?

It works in the literal sense and it is usually the wrong control. The guard reads the browser's hostname and compares it against your allowlist, so on a system reached at an address rather than a name, the value it compares is that address string, and your allowlist has to contain every address any client might use. That list changes whenever addressing changes, which on a control network is an ordinary maintenance event rather than a rare one. Worse, if the interface is opened in a context with no meaningful hostname, such as a local file or an embedded panel viewer, the guard treats the empty value as failure and fires the failure action before consulting your allowlist at all. On an air-gapped system the control that matters is the network segmentation you already have, not a check running inside the browser.

Which part of 62443 does a protected build actually help with?

The lifecycle part, and mostly through record-keeping rather than through the transformation. A secure development lifecycle asks you to define your process, threat model the product, verify what you built, and be able to service it after delivery. A build that is reproducible from a recorded seed, that emits a manifest of source and output hashes per file, and whose symbol map is archived against the released version, produces exactly the evidence that lifecycle wants: this artifact came from this source, here is how to reproduce it, and here is how to diagnose a report from the field. That is a real contribution and it is worth claiming. Transforming the identifiers is not.

How do we keep an obfuscated build serviceable across a long support life?

By archiving the inputs, not just the outputs, and by treating that archive as part of the deliverable. Industrial products are supported for a decade or more, often by engineers who were not present when the code was written, on installed systems that are updated rarely and reluctantly. If a fault report arrives against a release from six years ago, you need the exact source, the exact configuration including the seed, the symbol map, and a way to rebuild that release and confirm you reproduced it. Without those, protection has made a long-lived product harder to support, which is a genuine engineering cost rather than a theoretical one. Set the retention policy to the support life of the product, not to the retention default of your build system.

Does protection interfere with the software inventory we have to provide?

It should not, provided the inventory is produced from the source side of the build rather than from the shipped artifact. Composition analysis works by recognising known code, and transformed output is much harder to recognise, so a scanner pointed at a protected bundle will under-report. Generate the component inventory from your dependency manifests and lock files before the protection step, attach it to the release, and keep the two in the same record. This is the same rule that applies to every scanner: everything that works by reading code runs before the step that makes code hard to read.

Where should the logic that matters actually live?

On the controller and the server, which is also what the architecture the standard describes already assumes. An HMI is a view onto a process, and the authority for interlocks, permissive conditions, setpoint limits and command authorisation belongs to the equipment that enforces them. A limit checked only in the browser is a limit an operator or anyone with access to that workstation can remove, and no build setting alters where the decision is being made. Treating the panel as a renderer, with every consequential check enforced by the controller or the supervisory service, is both better engineering and a far easier position to defend in an assessment.

Can protecting the HMI code help against an attacker who is already on the control network?

Marginally, and it is important not to oversell it. Someone with a foothold on the network is in a position to observe traffic, replay commands and interact with services directly, none of which involves reading your JavaScript. What protection does address is the narrower case of a copied panel: an integrator, a subcontractor or a customer who takes the interface you delivered and reuses or modifies it. That is a commercial and integrity concern rather than an intrusion one, and it is where a watermark that attributes a copy to a release earns its place. Detection and segmentation address the intruder; protection addresses the copy.

What should we put in the assessment file about this?

State the position plainly rather than implying more. A defensible entry says what the protection step is, that it is applied to the operator interface bundle, that it is not relied upon as a security control for any requirement in the standard, and that the security requirements are met by the system controls you list separately. Then attach the evidence that is genuinely yours: the reproducible build record, the component inventory generated pre-transformation, the archived symbol map and retention period, and the rationale for whichever runtime options you enabled or deliberately left off. An assessor is far more comfortable with a documented decision to leave a guard disabled on availability grounds than with an undocumented one to switch it on.

Related Guides

Other standards and delivery models

Medical device software

The closest neighbour: another lifecycle standard, another regulated sector, and the same conclusion that process and records are what the assessment reaches.

NIS2 and essential entities

The directive many industrial operators fall under, where the obligations attach to the entity rather than to the code.

Embedded and device interfaces

The delivery model behind most industrial panels, including kiosk shells and viewers where the browser assumptions break.

The Cyber Resilience Act

The European product regulation that reaches the same class of devices, with duties around vulnerability handling and support periods.

Next Step

Write the position down before the assessment asks for it

Record three things and most of this topic is closed. State that the protection step is applied to the operator interface bundle and is not relied on as a security control for any requirement in the standard. Record the runtime options you deliberately left off and the availability reasoning behind it, because a documented decision to disable a guard is far stronger than an undocumented decision to enable one. Then attach the evidence that is genuinely yours — the reproducible build record and seed, the manifest, the pre-transformation component inventory, and the symbol map retention matched to the product's support life.