---
title: "IT and OT compliance in one place: why IEC 62443 changes the GRC conversation | Evelcra"
description: Why IEC 62443 zones, conduits and security levels need to sit in the same risk model as IT compliance, and what OT security leads should look for.
---

[Insights | Evelcra](https://go.evelcra.com/insights)

# [IT and OT compliance in one place: why IEC 62443 changes the GRC conversation | Evelcra](https://go.evelcra.com/insights/it-and-ot-compliance-in-one-place-iec-62443)

 Written by [Evelcra Team](https://go.evelcra.com/insights/author/evelcra-team) | Oct 19, 2026, 7:14:25 AM

For years, IT compliance and OT security have lived in different worlds. The compliance team runs ISO 27001, NIS2 or PCI DSS in a GRC tool that has never seen a PLC. The engineering team secures the plant against IEC 62443 in spreadsheets and drawings that never reach the auditor. Both are doing serious work, but nobody holds a single picture of risk.

That split is getting harder to defend. Regulation now asks organisations to answer for the operational technology that runs the business as well as for enterprise IT, and boards want one answer, not two. IEC 62443 is a big part of why the GRC conversation is changing.

## What IEC 62443 asks for, in brief

IEC 62443 is a series of international standards for the security of industrial automation and control systems. Without going clause by clause, a few ideas stand out for anyone used to IT-centric frameworks:

- **Zones and conduits.** The system is divided into zones of assets with similar security requirements, connected by conduits that carry communication between them. Security is designed and assessed per zone and per conduit, not just for the site as a whole.
- **Security levels.** Each zone or conduit is given a target security level, from 1 to 4, reflecting the kind of attacker it needs to withstand. The achieved level is then compared against that target.
- **System requirements.** IEC 62443-3-3 sets out system security requirements linked to those levels, so the target directly drives which controls apply.
- **A security programme.** IEC 62443-2-1 addresses the asset owner's security programme: the policies, processes and governance around the technical controls.

## Why the usual tooling struggles

Most organisations end up with a gap between two good but separate sets of tools:

- **GRC suites stop at the firewall.** They handle IT frameworks, policies and audits well, but they were not designed to model zones, conduits or per-cell security levels.
- **OT security tools watch the plant.** They are strong at visibility and detection on industrial networks, but they do not usually manage multi-framework compliance, audit evidence or business continuity.
- **Spreadsheets fill the gap.** Zone and conduit assessments sit in engineering files, disconnected from the risk register and the evidence the auditor reviews.

The result is an accountability gap. OT risk is invisible to governance, IT risk ignores the plant, and risk ratings become assertions rather than something you can trace and defend.

## What a converged approach looks like

If you are an OT or industrial security lead, these are the questions worth asking of any approach, whether tooling or process:

1. **Is there one model of assets, threats, controls and owners** that both IT and OT are assessed against?
2. **Can the plant be modelled as it really is**, with zones containing nested cells, across Purdue levels, and conduits assessed as well as zones?
3. **Are security level targets derived from evidence**, such as consequence, attacker capability and exposure, rather than simply declared?
4. **Do applicable IEC 62443-3-3 requirements and gaps follow from the target**, compared against the controls you actually have in place?
5. **Does an IEC 62443 control count towards other frameworks** where it overlaps, such as ISO 27001 or NIS2, so the evidence is gathered once?
6. **Is risk re-assessed when things change**, for example a new vulnerability or an end-of-life controller, rather than once a year?

## Where NormSentry fits

NormSentry is Evelcra's security, risk and compliance platform, designed to cover enterprise IT and OT/ICS in one system of record.

- **IEC 62443 built in.** Zone, conduit and cell assessment, with cells grouped and governed across Purdue levels 0 to 5. Cells can be nested within zones and each is risk-assessed on its own, then rolled up to its parent.
- **SL-T derived, not declared.** For every cell, conduit and zone, a target security level (SL-T 1 to 4) is computed as the maximum of independent floors covering consequence, attacker capability, boundary exposure, regulatory relevance and organisational policy, so the target reflects the worst-case driver rather than an average.
- **Requirements and gaps per cell.** Applicable IEC 62443-3-3 requirements are generated per cell and compared against live control posture, with a visual topology map and controlled assessment documents in DOCX or PDF.
- **Both parts of the standard.** Framework packs cover IEC 62443-3-3 (51 controls) and IEC 62443-2-1 (126 controls), on the same control schema as ISO 27001, IM8, NIST, PCI DSS, NIS2 and others, so evidence can be reused across frameworks.
- **One risk engine for IT and OT.** A five-stage engine (impact, likelihood, inherent, residual, tolerance) re-runs on change or on schedule, org-wide or scoped to a single cell, with every score traceable to its inputs.
- **Exposure feeds risk.** CVE findings imported from Nessus, OpenVAS or CSV are mapped to affected assets, and end-of-life and end-of-support systems are flagged in the asset register.
- **Deployment options.** Cloud-hosted on Singapore cloud, or fully on-premise.

## Start with one cell

A useful way to test any converged approach is to take one production cell you know well and walk it end to end: its assets, its conduits, how its target security level was set, which requirements apply, where the gaps are, and how that shows up in the risk register the board sees. If that journey crosses three tools and two spreadsheets, you have found your accountability gap.

To see that walk-through on your own estate, [request a NormSentry demo](https://go.evelcra.com/normsentry). MSSPs and integrators serving industrial clients can learn more about [partnering with Evelcra](https://go.evelcra.com/partners).

[View full post](https://go.evelcra.com/insights/it-and-ot-compliance-in-one-place-iec-62443)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Evelcra Team"
  },
  "dateModified" : "2026-10-19T07:14:25.483Z",
  "datePublished" : "2026-10-19T07:14:25Z",
  "headline" : "IT and OT compliance in one place: why IEC 62443 changes the GRC conversation",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://246919967.fs1.hubspotusercontent-na2.net/hubfs/246919967/blog-images/cover-it-and-ot-compliance-in-one-place-iec-62443.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://go.evelcra.com/insights/it-and-ot-compliance-in-one-place-iec-62443",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Evelcra Insights"
  }
}
```