ODVA's CIP Security spec earns IEC 62443 Security Level 3 certification

TÜV Rheinland has certified ODVA's CIP Security specification against IEC 62443-4-2 at Security Level Capability 3, the tier built for attackers who bring sophisticated methods, moderate resources and skills specific to industrial control systems.

CIP Security is ODVA's cybersecurity technology for EtherNet/IP, and the certification was announced at ODVA's 2026 Industry Conference and 24th Annual Meeting of Members, which concluded October 22 in Faro, Portugal. That puts the news on the desk of the controls engineer writing device specifications for a new line and the OT security lead who has to defend them. Their question is simple: what does a certificate on a specification actually buy at the plant?

A certified spec, then a device-by-device check

CIP Security handles device and user authentication, data integrity and confidentiality, and secure communications between automation devices. ODVA's position, as Automation World relayed it, is that formal certification of the specification against IEC 62443 cements CIP Security as the security framework for EtherNet/IP products and simplifies the compliance path for manufacturers who build it in.

For the engineer writing a device spec, that could mean a named security level to ask for. That's the practical value.

The strongest objection is also the obvious one. A spec-level certificate describes what CIP Security can do when implemented; it does not by itself tell a buyer whether a particular I/O block on the bill of materials implements it, or how fully. For a plant running a mix of legacy and new EtherNet/IP devices, the certificate is a reference point for new purchases, and the installed base stays where it is.

Commissioning and swap-outs get the attention

The less headline-friendly work may matter more to the people on shift. ODVA calls the continued development of CIP Security a major area of progress since its 23rd Annual Meeting, and much of that progress sits in what it calls the CIP Security Pull Model, which includes mechanisms to distribute device authenticity information efficiently.

According to ODVA, the approach can simplify commissioning and replacement of devices, and it supports architectures where conventional configuration methods may not be practical. The CIP Identification and CIP Security schemas that go with it were released in March 2026. That suggests ODVA is targeting the friction of putting security to work in the field, in addition to the paperwork of proving it exists.

EtherNet/IP moves into the process plant

The security news landed alongside a steady push into process industries. Process Device Profiles define common functionality for level, temperature, flow and pressure instruments, which ODVA says improves interoperability and makes it easier to replace an instrument from one vendor with another's.

Ethernet-APL carries the connection the rest of the way. It is a two-wire form of Single Pair Ethernet built for long distances, and in process environments it delivers power and provides intrinsic safety. According to ODVA, this allows EtherNet/IP connectivity to reach further into process facilities and field-level applications. The organization lists Single Pair Ethernet, Ethernet-APL, wireless connectivity and advanced cybersecurity capabilities as technologies that are moving EtherNet/IP into new markets.

ODVA's conference release says two keynote application presentations showed EtherNet/IP at work in process and specialized industrial environments. VEGA's Pat Koenig gave a talk titled "EtherNet/IP over Ethernet-APL Plastics Plant." AUMA's Christian Seiler described EtherNet/IP deployments at a salmon farm and at a wastewater treatment plant.

Interchangeability is the point of the profiles. A plant that standardizes on a common profile for a flow meter has more vendors to call when that meter fails, which is a procurement benefit as much as an engineering one.

Smaller connectors, IPv6 and network maps

Security and process instruments were only part of the technical program. Sessions also covered IPv6, functional safety, time synchronization, robotics interfaces, OpenAPI engineering workflows, firmware updates and electronic data sheets. The two papers that opened the technical track on Wednesday, October 21, show how wide that range was. One deals with the plug on the circuit board. The other deals with how the entire network behaves.

The first introduced a compact connector generically called the ix, standardized under IEC 61076-3-124 and engineered to replace RJ45 in industrial automation. At roughly one-quarter the volume of RJ45, it gives design engineers room to put Ethernet into space-constrained assemblies where a standard RJ45 jack won't fit. According to the paper's abstract, dual metal locking latches and through-hole reflow shield pins deliver PCB retention forces that exceed RJ45.

The electrical claims are just as pointed. According to the abstract, the 360-degree shielded, symmetric-pair contact design holds inductance to 0.14 to 0.45 nH, which it describes as an order of magnitude lower than RJ45. That performance, the abstract says, allows Cat.6A certification for 10GBASE-T, along with improved EMI/ESD immunity. PoE++ (IEEE 802.3bt) is supported, and the connector is offered in IP20 and IP65/67 versions. For a device maker, that combination suggests Ethernet, and any security stack riding on it, could reach products too small for an RJ45 jack.

The second paper comes from Rob Lodesky of HMS Industrial Networks, who has taught and built ODVA seminars on CIP Security and CIP Safety. He argues that topology and protocol conformance alone are not enough to understand industrial networks. The paper reworks eight networking heuristics for EtherNet/IP, with attention to coordination load, concentration points, connection paths, interaction density and communication-function fit.

Its central finding is that reach, resilience and scalability also hinge on the way traffic and control dependencies are spread across a network, the points where bridges link segmented domains, and the places where hubs turn into either helpful coordinators or concentrators of failure. Lodesky presents the framework as a basis for architecture review, segmentation strategy, concentration analysis and resilience-oriented design.

That is a useful counterweight to the certificate for the OT security lead. CIP Security protects the conversation between devices; Lodesky's framework asks where those conversations cross segment boundaries and pile up. A plant could fill a line with SL-C 3-capable devices and still route them through a hub that, in the paper's terms, concentrates failure.

IPv6 got keynote billing too. Joe Labeau of Meta gave the third and final keynote, "A DataCenter's Motivation for IPv6," making the case for IPv6 with EtherNet/IP from an end user's perspective. Having a data center operator make that argument suggests the pressure for IPv6 is coming from users, not only from the supplier side of the room.

Harmonization, and where the proof shows up

ODVA is also working with other standards organizations and industry groups on common approaches to industrial connectivity, energy efficiency and cybersecurity interoperability. That includes work on Ethernet-APL and Single Pair Ethernet, and collaboration through the Industrial Security Harmonization Group (ISHG) on aligning industrial cybersecurity efforts. For a buyer juggling more than one protocol, harmonization work like this could matter as much as any single certificate.

Al Beydoun, ODVA's president and executive director, said the year's work reflected continuing evolution in cybersecurity, interoperability, process automation and new Ethernet technologies. He said ODVA is still focused on two goals: giving end users a technology ecosystem that is open, interoperable and sustainable, and giving vendors a strong base for building the next generation of industrial products. ODVA's 24th Annual Meeting closed by announcing the leadership elected for the organization's 25th term. The closing session also reviewed recent technical accomplishments and laid out priorities for the coming year.

The signal worth watching next is on vendor datasheets: how many EtherNet/IP products start citing CIP Security alongside IEC 62443-4-2 SL-C 3, and whether Pull Model support appears next to it. ODVA is listed among exhibitors for SPS 2026 in Nuremberg, which organizers say is a few weeks out, so that floor is the next place to put those questions to vendors in person. Conference papers are available in ODVA's proceedings library for engineers who want the detail first.