The Purdue Model is a reference architecture that arranges industrial control system (ICS) components into levels, from the physical process at the bottom to the enterprise network at the top. Security teams use it to place firewalls between levels so a compromise in the office network does not reach the plant floor.
What are the levels?
The model comes from the Purdue Enterprise Reference Architecture. Versions differ slightly in the labels, but the common layout is:
Level 0, physical process. Sensors, actuators and the equipment that touches the real world, such as valves, motors and meters.
Level 1, basic control. Controllers such as programmable logic controllers that read sensors and drive actuators.
Level 2, area supervisory control. Operator interfaces and supervisory systems for a production area.
Level 3, site operations. Systems that manage production across a site, such as historians and engineering workstations.
Level 3.5, the demilitarized zone. Often added between operations and enterprise to hold systems that exchange data across the boundary.
Level 4 and 5, enterprise. Business networks, email, enterprise applications and the connection to the internet.
The idea is that traffic should flow in controlled ways between adjacent levels, with the strictest control at the line between IT and operational technology (OT).
Why do security teams use it?
It gives a shared map. Teams can say this system sits at level 2 and should not talk directly to level 4. It supports segmentation, asset inventory by level, and conversations between IT and plant engineers who might otherwise use different words.
NIST SP 800-82 Revision 3, the guide to operational technology security, addresses how to secure OT systems while accounting for their performance, reliability and safety requirements. It gives an overview of typical system topologies, common threats and vulnerabilities, and recommended countermeasures. The ISA/IEC 62443 series sets requirements and processes for implementing and maintaining secure industrial automation and control systems. The 62443 approach organizes systems into zones and conduits, which maps naturally onto Purdue levels, though the two are separate ideas.
Where does the model strain?
The model assumes a mostly hierarchical, mostly isolated plant. Reality has shifted. Cloud analytics read data from controllers. Vendors connect remotely for support. Wireless sensors and edge devices skip levels. Business wants live production data in enterprise systems. Each of these creates paths that cross levels, so a diagram that looks clean may not describe what is connected.
It also says little about identity, patching or software supply chain, which matter in OT as much as network placement. And it can create false confidence: drawing the lines does not mean the firewalls enforce them.
Constructed example: the remote support tunnel
A plant draws a tidy Purdue diagram with a firewall between levels 3 and 4. A vendor installed a cellular modem on a level 2 panel years ago for remote support. It was never recorded in the diagram. An asset walk finds it, with a default password, giving a direct path from the internet to the supervisory network. The model gave the team the language to describe the problem. The discovery came from looking at the plant, not the diagram.
How do you apply it well?
Start from what is actually connected, not from the ideal drawing. Place each asset at a level, then record every connection that crosses levels and its owner. Treat the line between enterprise and operations as a hard boundary with a deny by default policy, and place shared services in a controlled zone between them.
How to check or apply this
- Inventory OT assets by walking the plant and checking network traffic, not just reading documents.
- Assign each asset a level and record all connections that cross levels.
- Remove or document every path that bypasses the enterprise boundary, such as modems and vendor links.
- Enforce deny by default rules at the IT and OT boundary and between sensitive zones.
- Set up a controlled path for remote access with strong authentication and logging.
- Plan patching and changes with the people responsible for plant safety.
Quick check
Is the Purdue Model a security standard?
No. It is a reference architecture. Standards such as ISA/IEC 62443 and guidance such as NIST SP 800-82 describe security requirements.
What is Level 3.5?
A common addition: a demilitarized zone between site operations and the enterprise network where systems that exchange data across the boundary can sit.
Sources
Last reviewed: 18 October 2026.
