EN 50742: safety-related security levels and IEC 62443 working together

Standard, not legislation

The Machinery Regulation sets objectives: Annex III 1.1.9 requires protection against corruption, 1.2.1 safe and reliable control systems. How to meet them is the work of standardisation. EN 50742, Safety of machinery – Protection against corruption, is drafted by CENELEC's technical committee CLC/TC 44X (safety of machinery, electrotechnical aspects) — engineers and experts from industry, test bodies and authorities. Using it as an example of "legislators not understanding technicalities" therefore misplaces the authorship. Whoever disagrees with the method addresses the committee, for instance through a national mirror committee or a public enquiry.

As of the review date, EN 50742 is a draft. The public enquiry ran until early 2026; in Germany it appeared as E DIN EN 50742:2026-03 (VDE 0113-742). A draft gives no presumption of conformity; only a harmonised standard whose reference is cited in the Official Journal does, and only for the requirements it covers.

Two questions, two scales

• SRSL (safety-related security level) asks: how strongly must this safety function be protected against corruption? It runs from SRSL 0 to SRSL 3, is assigned per safety-related function and follows from the safety impact, within the risk assessment of the machine.
• IEC 62443 security level asks: what kind of attacker does this zone, conduit or component resist? It runs from SL 0 to SL 4 and belongs to the security control framework of IEC 62443.

The scales measure different things, so they cannot contradict each other. The SRSL states the protection need from the safety side; IEC 62443 supplies the controls that meet it.

How EN 50742 couples them

The draft shares its risk assessment basis (ISO 12100), its general principles and its information for use requirements across two routes: a self-contained set of process and product requirements, graded by SRSL, for manufacturers who have not adopted IEC 62443, and a route for machinery built on IEC 62443. Requirements include interface protection, identification of software versions and configurations, logging and evidence, and tamper resistance. This is safety-security convergence as normative practice: the safety analysis sets the need, the security framework delivers the measures.

Why the wording matters

When safety and security are discussed in public, the roles have to stay clear: who sets objectives (legislator), who defines the method (standards committees), who applies it (manufacturers), who documents it (technical writers documenting expert knowledge). Blurring these roles makes serious topics look arbitrary. Naming a standard never states that a product complies.