SOC 2 vs IEC 62443 vs ETSI EN 303 645: Which Does Your Hardware Customer Want?

SOC 2 vs IEC 62443 comes down to what is being evaluated: SOC 2 is a CPA's report on the controls of your organization and the service you operate, while IEC 62443 and ETSI EN 303 645 assess the product itself and the process that builds it. Enterprise IT buyers ask for SOC 2, industrial and OT buyers ask for IEC 62443, and consumer and EU channels ask for ETSI EN 303 645 and, from December 2027, Cyber Resilience Act conformity.

SOC 2 vs IEC 62443 vs ETSI EN 303 645: Organization, Industrial Product, Consumer Device

SOC 2, IEC 62443 and ETSI EN 303 645 test three different things: the company and its service, an industrial product and its development process, and a consumer IoT device. In a typical case, an edge gateway with a cloud management portal draws a SOC 2 request from an enterprise customer's IT security team, an IEC 62443-4-2 question from a utility's OT engineering team, and an ETSI EN 303 645 question from a European retail distributor.

A SOC 2 report says nothing about the gateway firmware, and an IEC 62443-4-2 certificate says nothing about admin access to the cloud portal. In our experience, deals stall when the sales team offers one in place of the other.

What a SOC 2 Report Evaluates for a Hardware Company

A SOC 2 report evaluates the controls over a system that a service organization uses to deliver services, measured against the AICPA Trust Services Criteria. In a type 2 report, the CPA firm also tests whether the controls operated effectively throughout a specified period, and includes its tests and results. A type 1 report covers design only, with no opinion on operating effectiveness.

For a device maker, the system in scope is usually the platform customers log into: device management portals, telemetry pipelines, update servers and the people who operate them. The SOC 2 scoping guide covers how to draw that boundary, and the hybrid and on-prem scoping guide covers the case where the platform runs on your own hardware.

SOC 2 touches product security mainly through CC8.1, which reads: The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. It applies to the service, though the same change process often covers firmware. The Trust Services Criteria guide covers the full set.

What IEC 62443-4-1, 62443-4-2 and 62443-3-3 Evaluate

IEC 62443 is a series of standards for industrial automation and control systems (IACS), and ISA describes it as written for asset owners, product suppliers, integrators and service suppliers. A device maker selling into OT deals with three parts:

Both 4-2 and 3-3 group requirements under seven foundational requirements, from identification and authentication control to resource availability, and map them to security levels SL 1 to SL 4. ISASecure certifies 4-1 (SDLA), 4-2 (CSA) and 3-3 (SSA) through ISO/IEC 17065 accredited certification bodies.

What ETSI EN 303 645 Evaluates for Consumer IoT Devices

ETSI EN 303 645 sets baseline security and data protection provisions for consumer IoT devices connected to a network, and for their interactions with associated services. Examples include smart cameras, door locks, IoT gateways and wearable health trackers. The baseline targets elementary attacks on fundamental design weaknesses, such as easily guessable passwords.

Version 3.1.3 (September 2024) groups its provisions into 13 security clauses and a data protection clause:

• No universal default passwords
• A means to manage reports of vulnerabilities
• Keep software updated
• Securely store sensitive security parameters
• Communicate securely
• Minimize exposed attack surfaces
• Ensure software integrity
• Ensure that personal data is secure
• Make systems resilient to outages
• Examine system telemetry data
• Make it easy for users to delete user data
• Make installation and maintenance of devices easy
• Validate input data

ETSI EN 303 645 defines requirements for the device and leaves testing and certification to other documents. ETSI TS 103 701 supplies test cases for each provision and supports self-assessment, assessment by a customer and third-party assessment by a test lab; the scheme a market or retailer uses decides which it accepts.

Where the EU Cyber Resilience Act and the US Cyber Trust Mark Fit

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) is law, while SOC 2, IEC 62443 and ETSI EN 303 645 are voluntary standards. The CRA applies to hardware and software products with digital elements sold on the EU market, and compliant products carry the CE marking.

The reporting obligations already apply. Manufacturers notify actively exploited vulnerabilities and severe incidents to their CSIRT and ENISA, with an early warning within 24 hours and a main notification within 72 hours. Manufacturers must also set a support period during which they handle the product's vulnerabilities.

CRA conformity assessment depends on the product category. Self-assessment is the default; important class I products can self-assess only by applying harmonised standards; important class II and critical products need third-party assessment.

The US Cyber Trust Mark is a voluntary FCC labeling program for consumer wireless IoT products. On April 13, 2026, the FCC named ioXt Alliance as the new Lead Administrator. On August 11, 2026, the FCC conditionally approved two Cybersecurity Label Administrators and stated that conditionally approved administrators are not yet authorized to approve use of the label; they need ISO/IEC 17065 accreditation and FCC recognition first.

SOC 2, IEC 62443, ETSI EN 303 645, CRA and Cyber Trust Mark Compared

IEC 62443 and ETSI EN 303 645 timelines depend on the certification body or test lab and on existing documentation, so get the assessor's schedule before promising a customer a date. The SOC 2 type 2 period is agreed with the CPA firm at scoping.

Which Certification Each Hardware Customer Type Wants

How One Security Program Feeds SOC 2 and Product Certifications

SOC 2 and the product standards ask for the same security capabilities in several places, so one program built around those capabilities produces most of the evidence for each. The SOC 2 vs ISO 27001 comparison covers the same idea for two organizational frameworks.

The secure development lifecycle is the largest shared piece: one pipeline can produce the change records SOC 2 samples and the lifecycle evidence a 62443-4-1 assessor reviews. The secure development guide for self-hosted GitLab covers that evidence for SOC 2.

Vulnerability handling is the second. A public disclosure policy, dated triage records and a defined support period cover ETSI EN 303 645 clause 5.2, IEC 62443-4-1 defect management, CRA reporting and SOC 2 CC7.1 evidence.

How to Sequence SOC 2 and Product Certifications for a Device Maker

A device maker facing several requests at once can work in this order:

1. List each request by deal value, and note which standard each deal needs.
2. Run a capability assessment and map each security capability to those standards.
3. Build the shared processes first: secure development, vulnerability handling, risk assessment and supplier management.
4. Start the SOC 2 type 2 period for the service, since it needs months of operating evidence.
5. Book the product assessments once threat models, security requirements and lifecycle records cover a full release.

SOC 2 and Product Certifications Answer Different Questions for the Same Deal

SOC 2 shows the company operates its service securely; IEC 62443 and ETSI EN 303 645 show the device is built securely; the CRA makes part of that law in the EU. One program built around shared capabilities answers each buyer with the right document. The SOC 2 for bare metal and on-prem infrastructure page covers the service side for companies that run their own hardware.

Related Guides

• IEC 62443 Explained: 4-1, 4-2, 3-3, Security Levels and Certification for Product Companies
• EU Cyber Resilience Act (CRA): What It Is, Timeline and Requirements for Hardware and Software Makers
• SOC 2 for Hardware Startups: What's in Scope When You Sell Devices, Chips or Appliances

Frequently Asked Questions

What is the difference between SOC 2 and IEC 62443?

SOC 2 is a CPA firm's attestation report on the controls of an organization and the service it operates. IEC 62443 is a series of industrial standards for products and processes: 4-1 covers the secure development lifecycle, 4-2 components and 3-3 systems. Device makers selling to industrial buyers often need both.

Does a SOC 2 report cover my device firmware?

A SOC 2 report covers the system described in scope, which for a device maker is usually the cloud or on-prem platform customers use. Firmware development can fall under the same change controls, but SOC 2 gives no opinion on the device itself; IEC 62443-4-2 or ETSI EN 303 645 assess the device.

Is ETSI EN 303 645 a certification?

ETSI EN 303 645 is a standard of baseline security provisions for consumer IoT devices, and it does not define a testing or certification method. ETSI TS 103 701 provides the assessment method and supports self-assessment, customer assessment and third-party testing. Certification depends on the scheme or program that adopts the standard.

When does the EU Cyber Resilience Act apply to hardware makers?

The Cyber Resilience Act entered into force on 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026. The main obligations, including conformity assessment and CE marking, apply from 11 December 2027.

Can products carry the US Cyber Trust Mark yet?

As of the FCC's August 11, 2026 public notice, the Cybersecurity Label Administrators were conditionally approved and not yet authorized to approve use of the label. They need ISO/IEC 17065 accreditation and FCC recognition first.

Sources

• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• AICPA & CIMA, SOC 2
• ISA, ISA/IEC 62443 Series of Standards
• IEC, IEC 62443-4-1:2018 Secure product development lifecycle requirements
• IEC, IEC 62443-4-2:2019 Technical security requirements for IACS components
• IEC, IEC 62443-3-3:2013 System security requirements and security levels
• ISASecure (ISA Security Compliance Institute), Certification programs
• ETSI, EN 303 645 V3.1.3 (2024-09) Cyber Security for Consumer Internet of Things: Baseline Requirements
• ETSI, TS 103 701 V2.1.1 (2025-05) Conformance assessment of baseline requirements
• European Commission, Cyber Resilience Act
• European Commission, Cyber Resilience Act summary
• EUR-Lex, Regulation (EU) 2024/2847 (Cyber Resilience Act)
• FCC, FCC Selects New Lead Administrator for U.S. Cyber Trust Mark Program (April 13, 2026)
• FCC, Public Notice DA 26-834 on Cybersecurity Label Administrators (August 11, 2026)