The Purdue model and industrial network zones
In short: The Purdue model divides industrial networks into levels, from sensors on the factory floor up to business systems. Security teams use it to decide where firewalls go, especially the DMZ between IT and OT. Modern IIoT and cloud links do not fit neatly, but the core idea of controlled boundaries still applies.
Where the model comes from
The Purdue Enterprise Reference Architecture was developed in the 1990s to describe how manufacturing systems fit together, from the shop floor to the head office. It was not designed as a security model, but its layered levels became the standard way to draw industrial networks and to place security boundaries. You will see it in vendor guides, audits and exam questions alike.
The levels
| Level | Name | What lives there |
|---|---|---|
| 0 | Physical process | Sensors, actuators, motors, valves: the equipment that touches the real world |
| 1 | Basic control | PLCs, RTUs (remote terminal units), safety controllers running control logic |
| 2 | Supervisory control | HMIs, SCADA servers and engineering workstations for a cell or area |
| 3 | Site operations | Historians, MES (manufacturing execution systems), site-wide servers such as domain controllers for OT |
| 3.5 | IT/OT DMZ | Systems shared between IT and OT: data replicas, remote access gateways, patch and antivirus update servers |
| 4 and 5 | Enterprise | Business planning (ERP), email, corporate IT and the internet |
Safety instrumented systems (SIS), which shut a process down safely if limits are exceeded, are usually shown alongside levels 1 and 2 and kept as isolated as possible.
The DMZ and traffic rules
The most important boundary is level 3.5. The rule of thumb is that no traffic should pass directly from level 4 to level 3 or below. Every flow terminates in the DMZ:
- Business users read a replica historian in the DMZ, not the live one.
- Vendors connect to a remote access gateway in the DMZ with MFA and session recording, and from there to approved systems only.
- Patches and antivirus signatures are staged on a DMZ server and pulled inward, never pushed directly from IT.
- Firewalls on both sides of the DMZ, ideally from different rule sets or teams, with default deny.
Within OT, separate areas or production lines from each other too, so a problem in one cell does not spread to the whole site.
Purdue in the age of IIoT and cloud
Critics point out that modern systems break the neat stack. A wireless vibration sensor at level 0 may send data straight to a cloud analytics service over cellular, skipping every level. Virtualised servers may host level 2 and level 3 functions on the same hardware. The answer is not to abandon the model but to use its intent:
- Identify every path that crosses a level, including cellular and cloud links.
- Make sensor-to-cloud data one-way where possible, using a gateway or a data diode for critical sites.
- Never let a cloud service send control commands to level 1 without strong authentication, approval and logging.
- Group assets into IEC 62443 zones and conduits, which describe security boundaries more flexibly than fixed levels.
Tip: in an exam, draw the levels, mark the 3.5 DMZ with firewalls on each side, and state that connections terminate in the DMZ. That single diagram earns most of the marks.
Practice
At which Purdue level would you find a PLC and at which an HMI?
Why do business users read a replica historian in the DMZ?
A wireless sensor sends data straight to the cloud. How does the Purdue principle still apply?
Key takeaways
- The Purdue model stacks industrial systems from level 0 (process) to 5 (enterprise).
- Level 3.5 is the IT/OT DMZ where cross-boundary connections terminate.
- No direct traffic should pass from enterprise networks into control levels.
- Remote access, patches and data sharing go through the DMZ.
- IIoT and cloud links blur the levels; apply the intent with zones and conduits.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.