Quectel Awarded SGS IEC 62443-4-1 Certification, Completing Its Industrial Cybersecurity Matrix

Quectel said on 29 October that SGS has certified the company to IEC 62443-4-1, the international cybersecurity standard for industrial automation and control systems. In its announcement, Quectel frames the award as proof that it operates a mature security development lifecycle (SDL), with security running through product design, development, testing, deployment, maintenance and ongoing support. The headline reads like another certificate on the wall. What it actually changes sits with procurement and tendering, not on a datasheet.

4-1 certifies the process, not a module

IEC 62443 is a family of standards written jointly by IEC and ISA for the security of industrial automation and control systems. Two parts of that family are routinely confused. IEC 62443-4-1 sets requirements for a secure development lifecycle and is audited against a supplier's processes; IEC 62443-4-2 sets technical security requirements for IACS components and is audited against a specific product. The first asks how security gets built into the way a company develops things. The second asks what security functions a given device offers and which security level it reaches.

The distinction is not pedantry. Holding 4-1 means Quectel can show a third party auditable records at defined process points: requirements analysis, threat modelling, secure design, coding standards, vulnerability handling, patch release and end-of-life. It does not mean any individual module has passed 4-2 product testing. Quectel's announcement does not disclose a certificate number, a validity period, or the products and sites in scope, so nothing in it establishes which part numbers fall inside the certification boundary. That has to be requested per project.

For an OEM the two documents serve different purposes. A 4-1 certificate goes straight into supplier qualification material and answers whether the development process is controlled. A 4-2 report has to map to a part number and answers whether the device being designed in meets the security level the project requires. Treating one as a substitute for the other tends to produce a request for additional documents at the technical evaluation stage.

Three certificates covering three layers

Quectel already held ISO 27001 for information security management and ISO/SAE 21434 for automotive cybersecurity. IEC 62443-4-1 adds the industrial process layer. The audit objects do not overlap:

• ISO 27001 covers the organisation's information security management system — asset inventory, access control, incident response and related management processes.
• ISO/SAE 21434 covers cybersecurity engineering for road vehicles, spanning electrical and electronic architecture activity across the vehicle lifecycle.
• IEC 62443-4-1 covers the secure development lifecycle of an industrial automation and control systems supplier, from requirements through retirement.

Read together, the set covers three separate compliance routes: organisation, automotive product, industrial process. For a module vendor supplying industrial gateways, energy terminals and vehicle programmes at the same time, breadth matters more than the depth of any single certificate. When a customer base is that dispersed, the gap is usually not depth in one layer but the ability to produce all three.

The SDL has to yield evidence, not statements

Quectel describes its SDL as a closed loop spanning design, development, testing, deployment, maintenance and support, and names Finite State, an independent security firm, as a partner for security testing and validation intended to improve resilience and transparency. The value of third-party involvement is that it converts self-declaration into records someone else can review. Industrial security assessments rarely accept a supplier's own description of its process; they ask for test scope, test method and a record of how findings were handled.

A process certificate proves a mechanism exists. It does not prove the mechanism ran correctly on a given project. Vulnerability response times, SBOM delivery format and refresh cadence, penetration test coverage and retest intervals are all things 4-1 requires a supplier to have a process for, while the actual committed values are set in commercial contracts. None of those numbers appear in the announcement, and a buyer should not read the certificate as a stand-in for them.

Why process evidence is scarce in this segment

Module vendors have historically competed on integration, power consumption and the ability to carry a customer through radio regulatory and carrier approvals. A secure development lifecycle is a different kind of investment. It produces documentation rather than a measurable parameter, and its output only becomes visible when a customer's auditors arrive. That is one reason process certificates tend to arrive later than product certificates in this segment, and why they are awkward for a vendor with a narrow engineering organisation: the audit covers how the whole development function works, not one product line.

Quectel's own framing points the same way. It cites its experience in global regulatory and carrier certification as the basis for helping customers complete their own certification work more efficiently and at lower cost, and positions the new certificate as support for AIoT deployments in industrial and critical infrastructure settings. That is a claim about audit time and paperwork, not about how secure any particular device is.

Where it lands in industrial tendering

Procurement in energy, water, rail and discrete manufacturing has moved toward requiring third-party evidence of a secure development process at supplier qualification. When the module vendor upstream can supply a 4-1 certificate, an OEM preparing a bid can narrow the scope of its own self-assessment: instead of arguing through its development process and its suppliers' processes item by item, it maps the certificate onto the requirement and moves on. That is the concrete form of Quectel's claim that the certification helps customers complete related certifications more efficiently and cost-effectively.

Process evidence only carries a bidder through qualification. Once a project reaches technical evaluation, evaluators tend to ask about device-level capability: secure boot support, whether debug ports can be locked, whether firmware updates are signed and verified, and whether a known-vulnerability list is available. Those belong to 4-2 and to product documentation. They run as a second evidence chain in parallel with 4-1, and neither chain closes the other.

HSY Perspective

Competition among module vendors is shifting from RF and power figures to whether compliance evidence can be delivered project by project. A process certificate like IEC 62443-4-1 is not marketing collateral. Its practical value is that it turns the hardest paragraph of an OEM's bid — the part where the company has to prove its development process is controlled — into a third-party document that can be copied into a submission. Quectel now stacks ISO 27001, ISO/SAE 21434 and 62443-4-1, which sit on organisation, automotive product and industrial process respectively. For a supplier whose customers span energy, manufacturing and vehicles, the usual shortfall is not depth in one layer but the ability to produce all three.

The reasoning comes from the structure of the standards. 4-1 audits a supplier's development process, which on the buying side translates into completeness of qualification material. 4-2 audits the technical capability of a specific component, which on the buying side translates into selection parameters and test reports. Quectel's SDL is described as covering design, development, testing, deployment, maintenance and support, with testing validated by an independent firm. What it hands over is process records rather than a conclusion — and process records are exactly the form evaluators accept and the form an OEM can reuse across projects.

The boundary deserves stating plainly: a process certification is not a product certification. The announcement discloses no certificate number, validity period or scope of products and sites, so no specific part number can be inferred to meet 4-2 requirements from this certificate alone. A bid that presents 4-1 as proof of a product's security level will be asked to supply more. The judgement holds where customers treat process evidence as a qualification threshold; it fails where customers evaluate on device-level test reports, because there the certificate is only an entry ticket and the outcome turns on per-project reports and vulnerability response commitments.

Source: Quectel press release, "International certification +1: Quectel awarded IEC 62443-4-1 cybersecurity certification", 29 October 2026, quectel.com.cn