ISA/IEC 62443 clearly distinguishes roles to assign cybersecurity responsibilities across the IACS lifecycle. A company that designs and manufactures embedded devices and network components—such as PLCs, RTUs, switches, or control software—but does not install or operate them is classified as a Product Supplier.
Step 1: Definition of a Product Supplier
Within ISA/IEC 62443 (notably Parts 4-1 and 4-2), a product supplier is the entity responsible for developing and delivering IACS products. Their responsibilities include secure product development, vulnerability handling, patch creation, and providing security-related product documentation.
Step 2: Exclusion of operational roles
Because the company does not perform on-site installation, commissioning, operation, or maintenance, it does not qualify as an integration or maintenance service provider. It also does not own or operate the system, so it is not an asset owner.
Step 3: Security responsibility alignment
ISA/IEC 62443-4-1 assigns product suppliers responsibility for secure development lifecycle practices, while 4-2 defines the technical security capabilities the products must support.
Therefore, the correct role is Product supplier.
