Automation and Control System Security Assurance

What it is

ACSSA (Automation and Control System Security Assurance) is one of ISASecure's ISA/IEC 62443 certification programs, corresponding to ISA/IEC 62443-2-1, 2-4, 3-2 and 3-3. ISASecure's own program page gives the full name as "Automation and Control System Security Assurance (ACSSA) Certification"; other ISASecure sources use different expansions for the same abbreviation. This record uses the program page's own wording and does not assert a single official expansion — the variance itself is a known open point.

Unlike ISASecure's product programs, ACSSA certifies a deployed control system and related asset owner policies and procedures, not a product. ISASecure describes the certification object as "a deployed control system and related asset owner policies and procedures."

ISASecure states: "ISASecure IBs and CBs conduct assessments in accordance with ISO/IEC 17020 for IBs and ISO/IEC 17065 for CBs and maintain the confidentiality of suppliers' assessment information at all times." ACSSA is therefore assessed under two accreditation standards: ISO/IEC 17020 for inspection bodies (IBs) and ISO/IEC 17065 for certification bodies (CBs) — an accreditation model that differs from ISASecure's product programs, which use CBs only.

The program is new: ACSSA is at version 1.0.0, described on ISASecure's page as "Effective 17 February 2026." As of 31 August 2026 — after that stated effective date — the page still shows IB/CB registration fees as "TBD (To be released June 2026)." No certified facility list or finalized fee schedule was observed in the sources reviewed as of that date.

Who owns it

ACSSA is owned by ISASecure, a wholly owned subsidiary of the International Society of Automation (ISA); the ISASecure control systems certification program is managed under the ISA Security Compliance Institute (ISCI).

Who assesses it

ISASecure states that ACSSA assessments follow "ISO/IEC 17020 for IBs and ISO/IEC 17065 for CBs," adding inspection bodies (IBs) alongside the certification bodies (CBs) used for ISASecure's other programs. Which named organisations currently hold ACSSA-scope IB or CB accreditation was not verified in the sources reviewed as of 31 August 2026 — the program is new and no assessment-body list specific to ACSSA was found.

Who asks for it

ISA's own announcement of the program names potential beneficiaries: "asset owners, insurance providers, product suppliers, service providers, conformity assessment bodies and government bodies" (isa.org, 2026-08-31). This is the scheme owner's own beneficiary list, not an independent regulator or procurement mandate — no legal or public-procurement requirement to hold ACSSA certification was identified in the sources reviewed as of 31 August 2026; confirm against country-level regulators.