IEC 62443-4-2 vs NIS2

IEC 62443-4-2 is how an industrial buyer specifies component security in a tender; NIS2 is why the buyer has to. The directive obliges operators to manage supply-chain risk, and the standard is the vocabulary they use to push that obligation onto suppliers.

	IEC 62443-4-2	EU NIS2 Directive
Applies when	Components deployed in industrial automation and control systems	Operators in essential and important sectors in the EU; obligations flow down to their suppliers
Who demands it	Operator procurement and tenders	Operator obligations, passed to component suppliers by contract
What it is	Standard	Directive
Scope	Component-level security requirements at four security levels: identification, use control, integrity, confidentiality, data flow, timely response, availability	Risk management, supply-chain security, incident reporting within 24 hours (early warning) and 72 hours (notification) for operators
In force	2019 edition current	Transposition deadline 17 Oct 2024
Penalties	None; failing it loses the tender	Essential entities up to EUR 10M or 2%; important entities up to EUR 7M or 1.4%
Authoritative text	IEC 62443-4-2 text ↗	NIS2 text ↗

What a product team should do

Pick a target security level (SL-2 is the common ask) and document it per requirement family. That document is what a NIS2-bound operator's procurement team will file as their supplier evidence.

Check your own product

The IoT security scorecard grades a product against these frameworks in 19 questions, and the requirements generator turns the applicable ones into PRD-ready requirements. Both cite the same provisions this page does. The full map is on the regulatory landscape reference.

Sources: IEC 62443-4-2 (official text) and EU NIS2 Directive (official text). Educational reference, not legal advice. See Chapter 18 and Chapter 19 of Tangibles.

← All comparisons