2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

The Purdue Model and OT Network Segmentation Explained: Levels, Zones and Conduits

Purdue levels 0 to 5 and the OT DMZ, how ISA/IEC 62443 zones and conduits relate to them, and what NIST SP 800-82 Rev. 3 says about segmentation.

Guides › Study topics

Updated 1 Nov 2026 · 7 min read

On this page
  1. Where the Purdue model comes from
  2. The levels, and where the sources name them differently
  3. Zones and conduits in ISA/IEC 62443
  4. How NIST SP 800-82 Rev. 3 recommends segmenting
  5. Worked example: a small bottling plant
  6. How this fits your exam
  7. Frequently asked questions
  8. Sources

After reading this you will be able to name the Purdue levels 0 to 5, place the DMZ, tell ISA/IEC 62443 zones and conduits apart from levels, and apply the segmentation guidance in NIST SP 800-82 Rev. 3 to a small plant. You will also know where the primary sources label the levels differently.

Where the Purdue model comes from

The Purdue model started as a manufacturing integration model, not a security standard. NIST SP 800-82 Rev. 3 cites it as Williams, "A Reference Model For Computer Integrated Manufacturing (CIM)" (1989), and notes that the ISA95 standard grew from the Purdue Enterprise Reference Architecture (PERA), first published by ISA in 1992. ISA's ISA95 committee bases its interface between control functions and other enterprise functions on the Purdue Reference Model for CIM, starting with the interface between levels 3 and 4. CISA's 2016 defence in depth recommended practice calls the same idea the "SP-99 (Purdue) Model of Control".

NIST SP 800-82 Rev. 3 lists the Purdue model, ISA-95 levels and the three-tier IIoT architecture as industry-recognised models for organising OT network segmentation, alone or combined.

The levels, and where the sources name them differently

Both NIST and CISA number the levels 0 to 5 from the physical process upwards and put a DMZ between Levels 4 and 3, but their labels differ.

Level NIST SP 800-82 Rev. 3, Fig. 16 CISA 2016, Figure 6 What CISA places there
5 Enterprise Enterprise Network Connectivity to the Internet, peer locations and backup or remote offsite facilities
4 Business Planning / Logistics Site Business Planning and Logistics Network Corporate communication, email servers, DNS servers and IT business systems
DMZ DMZ DMZ Components such as the data historian, wireless access point, or remote and third-party access systems
3 Operations / Control Site Manufacturing Operations and Control Operational support and engineering management devices, data acquisition servers and historians
2 Area Control (HMI) Area Control Systems for local or remote area control, such as field located HMIs
1 Controller Network Basic Control PLCs and their controls
0 Field I/O Devices Process Basic input/output devices such as actuators and sensors

Three differences matter. First, both figures draw a second DMZ above Level 5. Second, CISA is not consistent with itself: its Figure 5 labels Level 5 "Internet DMZ" and shows web and email servers there, while its Figure 6 calls Level 5 the "Enterprise Network". Third, the name of the plant DMZ varies. NIST says "DMZ" and, in one place, "OT DMZ". CISA's figures say "DMZ", its Figure 5 also says "Control Center LAN DMZ", and its text says "ICS DMZ" once. Neither document gives the DMZ a level number, so names such as "Level 3.5" or "industrial DMZ" are not terms these two sources define.

Zones and conduits in ISA/IEC 62443

Levels describe function. Zones describe security. ISA's preview of ANSI/ISA-62443-3-2-2020 defines a conduit as a "logical grouping of communication channels that share common security requirements connecting two or more zones", and a channel as a "specific logical or physical communication link between assets". It says zones and conduits are introduced in ISA-62443-1-1. The free preview stops before any zone definition, but NIST describes the idea plainly: an organisation may identify security zones so that security controls can be applied to all systems within the zone.

The 3-2 standard sets requirements for defining the system under consideration, partitioning it into zones and conduits, assessing risk for each zone and conduit, and setting a target security level (SL-T) for each. Its contents list the partitioning requirements as ZCR 3.1 establish zones and conduits, ZCR 3.2 separate business and IACS assets, ZCR 3.3 separate safety related assets, ZCR 3.4 separate temporarily connected devices, ZCR 3.5 separate wireless devices and ZCR 3.6 separate devices connected via external networks.

So how do zones relate to levels? NIST's Fig. 16 draws the 62443 approach as zones (Enterprise, DMZ, Control Center, a control system zone the figure labels BCPS, and SIS) joined by conduits, not as a stack of levels. CISA shows one way to lay zones over levels: an Enterprise Security Zone covering Levels 4 and 5, a Manufacturing Security Zone at Level 3, and a Cell Security Zone covering Levels 0 to 2. A zone can therefore span several levels, and one level can hold several zones. ISA-62443-1-1 (2007) itself says its coverage includes associated systems at level 3 or below of its reference model, and that business planning and logistics systems are not explicitly addressed.

How NIST SP 800-82 Rev. 3 recommends segmenting

SP 800-82 Rev. 3 (September 2023) is the current final version. NIST released an initial public draft of Rev. 4 on 21 September 2026, with comments due by 30 November 2026, so check for a final Rev. 4 before relying on section numbers. Rev. 3 recommends:

  • Group first. Grouping components into levels, tiers or zones comes before applying isolation devices between them. Devices may be grouped by management authority, level of trust, functional criticality, data flow or location.
  • Use your data flows. Mapped data flows identify required communications, which are then configured into network devices so that only authorised communications pass.
  • Adjacent levels only. Firewall rules should only permit connections between adjacent levels, tiers or zones. In a Purdue architecture, Level 4 devices should not communicate directly with Level 2, 1 or 0 devices.
  • Control outbound too. Consider making outbound rules as stringent as inbound rules.
  • Route through the DMZ. In its DCS example, communications between the enterprise level and the operations management level are required to go through services within the DMZ.
  • Consider one-way devices. A unidirectional gateway or data diode permits authorised communication in only one direction.
  • Encrypt conduits that leave OT. Consider encryption for connections or conduits that must pass over non-OT segments such as the corporate network or the internet.

Rev. 3 also notes limits. Many Level 0 devices and protocols cannot be authenticated. Some OT components may not support a full zero trust implementation, so NIST suggests applying it to compatible devices such as those at Levels 3, 4, 5 and the OT DMZ. One naming trap: Rev. 3 also has five defence in depth "layers", where Layer 3 is Network Security, not Purdue Level 3.

Worked example: a small bottling plant

Picture one filling line. Sensors and filler valves are wired to a PLC, and a separate safety PLC trips the line on overpressure. Operators use an HMI panel, and a control room holds a SCADA server, an engineering workstation and a historian. Head office runs ERP and email, and a vendor needs remote access. One way to map it:

Asset Purdue level Zone in this design
Level sensors, filler valves 0 Filling line cell
Filler PLC 1 Filling line cell
Safety PLC and its sensors 0 and 1 Safety zone (own zone)
Line HMI panel 2 Filling line cell
SCADA server, engineering workstation, historian 3 Plant operations
Replica historian, vendor jump server DMZ DMZ
ERP, email, office PCs 4 and 5 Enterprise

The conduits follow the rules above: enterprise connects only to the DMZ, the DMZ only to plant operations, and plant operations only to the cell, each through a firewall. Finance wants production counts, but ERP at Level 4 must not poll the PLC. The Level 3 historian pushes data to the replica in the DMZ and ERP pulls from there, the push and pull pattern CISA describes. The safety PLC sits in its own zone, in line with ZCR 3.3 (separate safety related assets), and CISA says the SIS should ideally be on a separate network. The vendor reaches the jump server in the DMZ with the multi-factor authentication for remote access that NIST lists. A vendor laptop plugged in on site is the kind of device ZCR 3.4 (separate temporarily connected devices) addresses.

How this fits your exam

EC-Council ICS/SCADA Cybersecurity. EC-Council publishes a course outline for this certification, not a numbered exam blueprint with objective codes or weights. Module 5, Standards and Regulations for Cybersecurity, lists ISA99, IEC 62443 and NIST SP 800-82 (without naming a revision). Module 6, Securing the ICS network, covers selecting and applying controls to mitigate risk. Module 7, Bridging the Air Gap, lists the guard, the data diode and next generation firewalls. The outline does not name the Purdue model, zones or conduits explicitly. Browse the CertStash exam guides for study plans, and see the ICS/SCADA Cybersecurity practice question pack.

Frequently asked questions

Is the DMZ Level 3.5?

Not in these sources. NIST SP 800-82 Rev. 3 and CISA's 2016 recommended practice both draw the DMZ between Level 4 and Level 3 but give it no number. NIST calls it the DMZ and, once, the OT DMZ. CISA calls it the DMZ, labels it "Control Center LAN DMZ" in Figure 5, and once calls it the ICS DMZ.

Are Purdue levels and 62443 zones the same thing?

No. Levels come from a functional hierarchy for manufacturing integration. Zones are groupings of systems so that security controls can be applied to every system in the zone, connected by conduits, and 62443-3-2 assigns a target security level to each zone and conduit. NIST's Fig. 16 shows the two as separate models, and a zone can cover several levels.

Can Level 4 talk directly to Level 3?

Rev. 3's general rule permits connections only between adjacent levels. With a DMZ between Levels 4 and 3, though, its DCS example requires enterprise to operations communications to go through services within the DMZ, and CISA says each path from the corporate network effectively ends in the DMZ.

Sources

Test yourself with the free ICS/SCADA Cybersecurity practice questions, and use the CertStash guides to plan the rest of your study.