OT-Knight — An RBJCS brand

Home / Compliance / ISASecure ACSSA

Certification · For asset owners and operators

ISASecure ACSSA certification, from ML1 all the way to ML3

ACSSA (Automation and Control System Security Assurance) is the ISASecure certification for asset owners and operators implementing IEC 62443. It evaluates a deployed control system together with the policies and procedures around it. We guide you along the full roadmap, with insight from our seat on the ACSSA Technical Committee.

4 partsIEC 62443-2-1, -3-2, -2-4 and -3-3
Operating IACSIn operation or operations-ready
3 yearsCertificate validity, with periodic surveillance
Technical CommitteeWe help shape the scheme

Why ACSSA

Independent proof that your plant, not just your policy, conforms

ISO/IEC 27001 certifies a management system; ISASecure CSA, SSA and SDLA certify products and development processes. ACSSA certifies what sits between them: the control system you actually operate. It evaluates the asset owner's security program, the risk assessment, the service providers and the system's technical capabilities, together.

For NIS 2 entities, a certified IACS is strong evidence for supervisors, insurers and group management that OT measures are in place and working.

What is evaluated

The four IEC 62443 parts behind ACSSA

  • IEC 62443-2-1: the asset owner's security program
  • IEC 62443-3-2: security risk assessment for system design, zones and conduits
  • IEC 62443-2-4: security program requirements for service providers
  • IEC 62443-3-3: system security requirements and security levels

Certification is granted by an ISASecure-accredited certification body. Our role is to prepare you, so that the evaluation confirms what you already know.

Our roadmap

Step by step to certification

  1. Eligibility & scopingWhich IACS, which boundaries, who is accountable
  2. Zone partitionZones, conduits and SL-T per IEC 62443-3-2
  3. Gap assessmentAgainst IEC 62443-2-1, -3-2, -2-4 and -3-3 criteria
  4. Close the gapsML1 to ML2 to ML3, planned around your turnarounds
  5. Mock evaluationThen support through the certification audit

Related services and training

How we help

A4

ISASecure ACSSA certification

Eligibility, scoping, zone partition, gap assessment, mock evaluation, support through certification.

 A1

Unified Security Management System

An IEC 62443-2-1 security program integrated with ISO/IEC 27001, ready for ACSSA.

 B2

IEC 62443-3-2 risk assessments

The zones and conduits model and SL-T that the evaluation starts from.

 C4

Assurance & verification

SL verification of the operating system against IEC 62443-3-3.
IC49 · ACSSA for EvaluatorsT1 · Safe & Secure by DesignT3 · Security Program for Asset OwnersT7 · Trust, but Verify

Is your site eligible for ACSSA?

Tell us about the system you want to certify. We will come back with an eligibility view and a realistic roadmap.

Talk to us

Reference: ISASecure ACSSA certification (scheme v1.0.0, effective 17 February 2026).