Architecture
The Purdue model
A layered reference model for industrial systems. It is a design aid, not a law of physics — but the discipline it enforces is what keeps enterprise problems out of the process.
Enterprise / External Services
Business systems and internet services; no direct path to control systems.
Systems
- Corporate applications
- Cloud services
- Internet access
Controls
- Enterprise security stack
- Identity governance
- Egress control
Common mistakes
- Treating enterprise controls as sufficient for OT
- Direct enterprise-to-controller flows
Monitoring
- Standard enterprise detection
- Boundary telemetry toward OT
Enterprise Business Systems
Consumes OT data through the DMZ; never queries control systems directly.
Systems
- ERP
- Business reporting
- Enterprise data platforms
Controls
- Segmentation from OT
- Data consumption via DMZ replicas
Common mistakes
- ERP pulling directly from a control-zone historian
- Shared domain administration with OT
Monitoring
- Enterprise EDR and log management
- Flow monitoring toward the DMZ
Industrial DMZ
The only place IT and OT meet. Sessions and data flows terminate here on both sides.
Systems
- Historian replica
- Jump hosts
- Remote access broker
- Patch and AV distribution
- Data brokers
Controls
- Deny-by-default firewalls both sides
- No protocol passes straight through
- MFA and session mediation
Common mistakes
- Rules that allow a flow to traverse the DMZ untouched
- Jump hosts with internet access
- DMZ hosts joined to the enterprise domain
Monitoring
- Full boundary logging
- Session recording where appropriate
- Rule change auditing
Site Operations
Site-wide services talking down to supervisory systems and outward only through the DMZ.
Systems
- Historian
- OT domain services
- Engineering workstations
- MES
- Backup servers
- Asset management
Controls
- Host hardening
- Privileged access management
- Backup protection
- Patch cadence
Common mistakes
- Engineering workstations with email and browsing
- Backups reachable from everywhere
- Trusts back to the enterprise forest
Monitoring
- Endpoint logs
- Authentication analytics
- Change detection
Supervisory Control
Supervisory polling and operator commands to controllers; data upward to Level 3.
Systems
- HMI
- SCADA servers
- Operator stations
- Alarm systems
Controls
- Role-based operator accounts
- Removable media control
- Application allow-listing where supported
Common mistakes
- Shared operator logins
- Internet access from operator stations
- HMIs directly reachable from IT
Monitoring
- Operator action logs
- HMI peer baselining
- Logon monitoring
Basic Control
Deterministic I/O with Level 0 and supervisory traffic with Level 2. Engineering access only from named hosts.
Systems
- PLC
- RTU
- DCS controllers
- Safety controllers
- IEDs
Controls
- Keyswitch discipline
- Programming conduits restricted
- Program baselines
- Controller access protection
Common mistakes
- Controllers reachable from anywhere in the plant
- Keyswitches left remote-programmable
- No logic baseline
Monitoring
- Program download and mode-change detection
- Protocol peer baselining
Physical Process
Field signalling to controllers over fieldbus, analog loops or Ethernet I/O.
Systems
- Sensors
- Actuators
- Valves
- Motors
- Drives
Controls
- Physical security
- Configuration change control
- Redundant measurement cross-checks
Common mistakes
- Ignoring field devices in the inventory
- Unmanaged asset-management server access
Monitoring
- Device diagnostics
- Configuration change reconciliation
- Value plausibility checks
Why should I care?
Purdue levels are how OT teams talk about blast radius. When you can place an asset at a level, you can reason about who should reach it, what it should say, and what breaks if it stops.
Modern reality
Where the model bends
- Cloud analytics and IIoT devices often bypass the layered hierarchy entirely — treat each as a conduit that must be brokered, not an exception.
- Converged plant networks flatten Levels 1–3 physically; recreate the separation logically with VLANs, firewalls and strict peer lists.
- Virtualisation places supervisory and site systems on shared hosts; the hypervisor and its management network become control-zone assets.
- Remote and distributed assets (substations, lift stations, wellheads) have no physical DMZ — the boundary has to be enforced at the site edge.