In OT security discussions, people often refer to “Level 2” or “the 3.5 boundary” without explaining what they mean.
These terms come from a model that describes how an industrial network is organized. Understanding it helps you follow the discussion, and it also shows where security investment should start.
What the model is
The model was developed at Purdue University to describe how an industrial business is organized, from the equipment on the plant floor to the business systems at the top. It was not originally a security model.
It became one because its layers are the natural places to put security boundaries.
The levels, from top to bottom, are:
| Level | Name | Typical systems |
|---|---|---|
| L4 | Enterprise network | Business systems, email, the internet |
| L3.5 | DMZ | Between the plant and the business |
| L3 | Operations | Historians, domain services, engineering |
| L2 | Supervisory | SCADA servers and operator stations |
| L1 | Control | PLC and DCS controllers, safety systems |
| L0 | Process | Instruments and final elements |
The higher levels contain systems that can be replaced easily, such as office laptops. The lower levels contain systems that must not stop, such as the controllers and valves that run the process.
You may see variations. Some organizations number the enterprise layer as Level 5 and place business planning at Level 4. The numbering matters less than the structure: business systems at the top, the process at the bottom, and a controlled boundary between them.
Why Level 3.5 matters most
Level 3.5 is the only level with a fraction in its name.
It was not part of the original model. It was added because the plant and the business needed a place to exchange data without either side connecting directly to the other.
This area is called a DMZ (demilitarized zone). The plant sends data into it, and the business collects data from it. Neither side connects directly to the other, and no traffic passes all the way through in a single step.
Level 3.5 is usually the level that needs to be built. Most plants already have Levels 0 to 4, because they describe equipment that exists. Far fewer have a properly designed Level 3.5.
Why investment should start at the boundary
This is why the model is relevant to budget decisions as well as engineering ones.
It might seem that security work should start at the lower levels, close to the process, because that is where harm happens. In practice, a security programme should start at the boundary, because that is where threats enter.
Most assessments find the same issue near the top of the list: a single link between the plant network and the business network, added for a valid reason years ago, allowing far more traffic than needed and with no current owner.
Securing that link addresses the route by which most threats reach a control system. Spending the same budget on the lower levels first leaves the main entry point open.
Securing each level
In the order that usually gives the best return:
L3.5, the boundary. This usually gives the highest return. It involves a boundary that allows only the traffic the process needs and, where data should only flow one way, a data diode with no return path.
L3 and L2, the computers. This covers operator stations, engineering workstations and historians. They need protection designed for control systems, because office security software can stop production. Older computers are common at these levels, and application allow listing is often the best approach for them, because it allows only approved software to run.
L1 and L0, control and process. This covers controllers, safety systems and instruments. Security software is generally not installed at these levels. They are protected by the controls at the levels above them, by strict control of who can connect to them, and by the boundary described above. Any proposal to install software on a safety controller should be examined very carefully.
Three questions to ask a supplier
These questions will quickly show whether a supplier understands your plant:
“At which level does this sit?” A good answer names a level. A general answer about “the OT environment” suggests the supplier has not looked at your network.
“Do we have a proper Level 3.5?” Most plants do not. A supplier who says you do, without having checked, has not checked.
“What will you install below Level 2?” The answer is usually “nothing”. A supplier who wants to install software on a controller should be able to justify it in detail.
You do not need to design the network yourself. Knowing the levels helps you ask the right questions and evaluate the answers.
How the model relates to IEC 62443
IEC 62443, the standard most OT security work follows, uses its own terms: zones, which are groups of assets with the same security requirements, and conduits, which are the controlled paths between zones.
The Purdue levels are usually the starting point for defining zones. The two are not the same, and the standard does not require the Purdue model, but in practice a plant’s zones tend to follow its levels, because the levels already reflect the natural boundaries.
Auditors usually think in terms of zones and conduits, while engineers often refer to levels. Both describe the same plant.