Maybe a related question:

How do you keep the IEC 62443-4-1 auditors happy?