The Purdue Model
A reference architecture that layers an industrial network into levels, from field devices up to enterprise IT, to structure segmentation.
A Map of the Plant Network
The Purdue Enterprise Reference Architecture, adapted widely for ICS security, organizes a plant network into hierarchical levels. It gives engineers a shared vocabulary for where a device belongs and which levels it may talk to. The value is not the diagram itself but the discipline it imposes: traffic should flow between adjacent levels through controlled boundaries, not leap from the top to the bottom.
The Levels
- Level 0: physical process, sensors and actuators
- Level 1: basic control, PLCs and RTUs
- Level 2: supervisory control, SCADA and HMIs
- Level 3: site operations, historians and production management
- Level 3.5: the industrial DMZ, mediating IT and OT
- Level 4/5: enterprise IT and business systems
The Industrial DMZ
Level 3.5 is the crucial addition for security. It is a demilitarized zone that brokers all traffic between operations (Levels 0-3) and enterprise IT (Levels 4-5). No device in IT talks directly to a controller; requests terminate in the DMZ, are inspected, and are re-originated. This breaks the direct path an attacker would otherwise use to descend from a phished laptop to a PLC.
Modern Pressures
Cloud analytics, remote vendor support, and IIoT sensors strain the strict hierarchy. The model remains useful as a baseline, but it is increasingly combined with zero-trust ideas so that trust is not granted simply by being inside a level.
Fusion Context
The Hyperion breeder and burner control architectures are specified against Purdue levels so that safety and machine-protection functions live low in the hierarchy, insulated by the DMZ from business systems and remote access. This keeps the design's most consequential controls the farthest from the internet-facing surface, consistent with defense in depth.