How do we apply IEC 62443 to a building project without overshooting?

IEC 62443 is the security standard for industrial automation and control systems. It is comprehensive enough to over-scope a building project if applied without judgement. The work is in setting the Security Level (SL) per zone, not in trying to hit the whole standard everywhere.

A pragmatic scoping pass

• Map the network zones — operator, controller, field. Each zone has its own SL target.
• Set SL-T per zone, not site-wide. A Tier IV data hall operator zone may sit at SL-3; a fan-coil controller zone might run at SL-1.
• Document conformance evidence for the zones at SL-2+. SL-1 needs governance but not the heavier engineering artefacts.
• Validate the segmentation at commissioning. Lab-tested ≠ deployed-tested.

On most projects this lands as a 10-20 page IEC 62443 conformance pack rather than the binder-sized document the full standard could imply.