This certification is a globally recognized benchmark for secure engineering practices in the development of industrial automation and control systems (IACS) products.
In this increasingly connected environment, gaining this certification shows a company’s commitment to designing and delivering cybersecurity products with security built in from the start.
It can also allay fears among end users across operational technology (OT), critical infrastructure (CI), information technology (IT), and converged IT/OT environments.
IEC 62443 is an international standard for cybersecurity, focusing on IACS and OT domains. IEC 62443’s series of standards defines requirements and processes for implementing and maintaining secure IACS and related products.
They establish security best practices and provide a way to assess security performance. Additionally, it’s a holistic cybersecurity standard bridging the gap between IACS and IT operations and between process safety and cybersecurity.
Certification to Part 4-1 at ML2 shows Fortinet’s secure development processes ended up formalized, documented, repeatable, and consistently practiced. It also aligns with rigorous requirements for engineering discipline, risk management, and product integrity.
Fortinet’s approach to secure engineering ensures that products end up developed with security as a foundational priority. From initial design through testing and release, SPDL embeds threat analysis, secure coding, validation, and supply chain integrity across every product line.
Key aspects of Fortinet’s SPDL and IEC 62443-4-1 include:
- Secure-by-design engineering: Security requirements, threat modelling, and risk assessment are applied before code is written, ensuring products are evaluated against real-world cyber risks early in development.
- Robust validation and testing: Automated and manual security testing at multiple stages helps identify and eliminate vulnerabilities before release.
- Responsible vulnerability disclosure: Fortinet’s FortiGuard Labs Product Security Incident Response team (PSIRT) manages a transparent, proactive vulnerability disclosure process to reinforce customer confidence and foster industry collaboration.
- Supply chain integrity practices: Controls spanning trusted suppliers, firmware hygiene, and dependency management support engineering resilience across the product ecosystem.
Click here for more on Fortinet’s certification.