The Purdue Model

A reference architecture that layers an industrial network into levels, from field devices up to enterprise IT, to structure segmentation.

A Map of the Plant Network

The Purdue Enterprise Reference Architecture, adapted widely for ICS security, organizes a plant network into hierarchical levels. It gives engineers a shared vocabulary for where a device belongs and which levels it may talk to. The value is not the diagram itself but the discipline it imposes: traffic should flow between adjacent levels through controlled boundaries, not leap from the top to the bottom.

The Levels

• Level 0: physical process, sensors and actuators
• Level 1: basic control, PLCs and RTUs
• Level 2: supervisory control, SCADA and HMIs
• Level 3: site operations, historians and production management
• Level 3.5: the industrial DMZ, mediating IT and OT
• Level 4/5: enterprise IT and business systems

The Industrial DMZ

Level 3.5 is the crucial addition for security. It is a demilitarized zone that brokers all traffic between operations (Levels 0-3) and enterprise IT (Levels 4-5). No device in IT talks directly to a controller; requests terminate in the DMZ, are inspected, and are re-originated. This breaks the direct path an attacker would otherwise use to descend from a phished laptop to a PLC.

Modern Pressures

Cloud analytics, remote vendor support, and IIoT sensors strain the strict hierarchy. The model remains useful as a baseline, but it is increasingly combined with zero-trust ideas so that trust is not granted simply by being inside a level.

Fusion Context

The Hyperion breeder and burner control architectures are specified against Purdue levels so that safety and machine-protection functions live low in the hierarchy, insulated by the DMZ from business systems and remote access. This keeps the design's most consequential controls the farthest from the internet-facing surface, consistent with defense in depth.