Defense in depth is a core concept of ISA/IEC 62443, and security zones are a structural method to implement it. According to ISA/IEC 62443-3-2 and 62443-1-1, layering can be achieved by nesting zones - creating zones within zones (i.e., subzones) - to enhance protection through multiple barriers.
"Defense in depth is realized through segmentation into zones and conduits. A zone may contain subzones to establish additional layers of security, providing multiple barriers to intrusion."
- ISA/IEC 62443-3-2:2020, Clause 5.3.2 - Zone and Conduit Model
This layered zoning approach enables tiered security controls, reducing the impact of breaches and limiting lateral movement within a network.
References:
ISA/IEC 62443-3-2:2020 - Clause 5.3.2
ISA/IEC 62443-1-1:2007 - Security Zones and Conduits

The ISA99 Committee (which develops the ISA/IEC 62443 series) clearly outlines four key consequences of compromising an Industrial Automation and Control System (IACS):
Endangerment of public or employee safety
Loss of public confidence
Violation of regulatory requirements
Loss of proprietary or confidential information
Economic and operational losses
"Increased product sales" is not listed - in fact, a compromise would likely result in the opposite, such as brand damage and loss of customer trust.
"The scope of the ISA99 Committee includes addressing risks such as the endangerment of public safety, loss of information, and economic harm arising from cyber incidents affecting IACS."
- ISA/IEC 62443-1-1:2007, Clause 1 - Scope and Purpose
References:
ISA/IEC 62443-1-1:2007 - Clause 1
ISA99 Committee Charter and Scope

Security Levels (SLs) in the ISA/IEC 62443 framework define the degree of protection against specific threat actors. SL 3 is designed to protect against intentional violations using sophisticated means with moderate skills, moderate motivation, and IACS-specific knowledge.
"SL 3: Protection against intentional violation using sophisticated means with moderate skills, moderate motivation, and IACS-specific knowledge."
- ISA/IEC 62443-3-3:2013, Table 3 - Target Security Level definitions
This level is commonly applied to systems facing well-resourced threat actors such as organized cybercriminals or advanced persistent threats (APTs), where higher assurance is necessary than what SL1 or SL2 would provide.
References:
ISA/IEC 62443-3-3:2013 - Table 3
ISA/IEC 62443-1-1 - Security Level Definitions
ISA/IEC 62443-3-2 - Security level selection and justification guidance

According to the ISA/IEC 62443 standards, the level of risk an organization is willing to tolerate is determined by the management, as they are responsible for defining the business and risk objectives, as well as the security policies and procedures for the organization. The management also has the authority to allocate the necessary resources and assign the roles and responsibilities for implementing and maintaining the security program. The legal, operations, and safety departments may provide input and feedback to the management, but they do not have the final say in determining the risk tolerance level. References: ISA/IEC
62443-2-1:2010 - Establishing an industrial automation and control systems security program, section 4.2.1.

The File Transfer Protocol (FTP) is an application layer protocol that moves files between local and remote file systems. It runs on top of TCP, like HTTP. To transfer a file, 2 TCP connections are used by FTP in parallel: control connection and data connection. The control connection is used to send commands and responses between the client and the server, while the data connection is used to transfer the actual file. FTP is one of the standard communication protocols defined by the TCP/IP model and it does not fit neatly into the OSI model. However, since the OSI model is a reference model that describes the general functions of each layer, FTP can be considered as an application layer protocol in the OSI model, as it provides user services and interfaces to the network. The application layer is the highest layer in the OSI model and it is responsible for providing various network services to the users, such as email, web browsing, file transfer, remote login, etc. The application layer interacts with the presentation layer, which is responsible for data formatting, encryption, compression, etc. The presentation layer interacts with the session layer, which is responsible for establishing, maintaining, and terminating sessions between applications. The session layer interacts with the transport layer, which is responsible for reliable end-to-end data transfer and flow control. The transport layer interacts with the network layer, which is responsible for routing and addressing packets across different networks. The network layer interacts with the data link layer, which is responsible for framing, error detection, and medium access control. The data link layer interacts with the physical layer, which is responsible for transmitting and receiving bits over the physical medium. References:
* File Transfer Protocol (FTP) in Application Layer1
* FTP Protocol2
* What OSI layer is FTP?3