The Purdue Model Explained: Designing IT/OT Network Zones That Actually Work

The Purdue Enterprise Reference Architecture - often just called the Purdue model - organizes industrial networks into levels from the physical process up to the enterprise. It is not a law, but it is the clearest mental model for deciding where firewalls, DMZs, and data flows belong.

The Levels at a Glance

• Level 0 - physical process: sensors, actuators, motors.
• Level 1 - basic control: PLCs, RTUs, drives, safety controllers.
• Level 2 - supervisory: HMIs, engineering workstations, SCADA servers.
• Level 3 - site operations: historians, batch management, asset management, OT monitoring.
• Level 3.5 (DMZ) - the demilitarized zone: shared services such as patch repositories, remote access jump hosts, and data mirrors.
• Level 4 - enterprise IT: ERP, office networks, cloud services.

Why the DMZ Matters

Direct connections between Level 3 and Level 4 are the single most common architectural mistake in older plants. The DMZ breaks that path: enterprise users reach only mirrored, read-only services, and OT systems never accept inbound connections from IT. This is the pattern IEC 62443 and most vendors recommend.

Common Pitfalls

• Placing the historian on the IT side and letting IT poll OT devices directly - keep acquisition on OT, mirror to the DMZ.
• Flat networks where a compromised HMI can reach every PLC - segment by cell or process area.
• Treating the model as a checklist - smaller plants legitimately collapse levels, but the security boundaries between process, operations, and enterprise should remain.