Patch Management for PLCs: Meeting 62443 Without Downtime

IEC 62443 requires that security patches be applied in a timely and controlled manner — but in factories, “timely” can’t mean “whenever Windows Update decides to restart.” Here’s how to meet 62443 patch management goals while keeping uptime intact.

Challenges in OT Environments

• Production runs 24/7 — no easy downtime windows.
• Vendor-certified firmware can’t be replaced arbitrarily.
• Testing patches on live systems risks production stability.

IEC 62443 Requirements

Standard 62443-2-3 defines processes for patch management programs including inventory, evaluation, deployment, and verification steps. The goal: maintain security posture without compromising reliability.

Best-Practice Patch Workflow

1. Maintain an asset inventory with firmware versions and patch history.
2. Subscribe to vendor advisories and security notifications.
3. Validate patches in a test environment or digital twin.
4. Deploy only during controlled maintenance windows.
5. Document all actions and rollback options.

Alternative: Compensating Controls

If a patch can’t be applied, compensate by:

• Restricting network access with firewalls or ACLs.
• Disabling unused services and accounts.
• Monitoring for known exploit signatures via IDS.

Case Example: Automotive Assembly Line

A Tier-1 supplier achieved 100% patch compliance by using shadow PLCs in a staging area. Firmware updates were tested and signed automatically before deployment to production systems.

Related Articles

• IEC 62443 Without Jargon: Zones, Conduits, and Real Controls
• Secure Remote Access to OT Assets: A 62443-Compliant Approach
• Writing a 62443-Compliant Supplier Spec: What to Include

Conclusion

Patch management in OT is about process, not frequency. Documented, tested, and auditable patch workflows meet 62443 and protect uptime — proving that compliance and production can coexist.