What does a Purdue Model diagram show?

A Purdue Model diagram shows an industrial estate split into six horizontal levels, from Level 0 field devices at the bottom up to Level 5 enterprise at the top, with an industrial DMZ at Level 3.5. The diagram makes explicit what talks to what, and where the boundaries sit between the plant, site operations and the corporate estate.

Why is Level 3.5 drawn as a separate band?

Level 3.5 is the industrial DMZ, an enforced boundary between OT (Level 3 and below) and IT (Level 4 and above). It is drawn as a separate horizontal band because the security posture, identity domain and change process on either side should differ. Systems that must be reachable from both sides live at 3.5, not on the OT plane.

How should the Firevault gold copy appear on the diagram?

The Firevault gold copy is drawn at Level 3.5 or in a dedicated bunker offset from the main stack, with a broken connector to indicate a Layer 1 air gap rather than a live network path. Connection windows are annotated as out-of-band and time-limited. The visual convention makes clear the copy is not reachable while offline.

Can I use a Purdue diagram in an IEC 62443 assessment?

Yes. IEC 62443 asks for a zone and conduit diagram. A labelled Purdue diagram, with zones grouped around the levels and conduits drawn as explicit connections through Level 3.5, is the fastest way to answer that request. Most assessors expect it as a starting point.

Where can I find a printable Purdue Model diagram?

The reference layout on this page is designed to be copied into architecture documents. For a printable or editable version aligned to a Firevault deployment, request the Module Deployment Maps from the Firevault team, which include Purdue diagrams for each supported module.

Why OSS

Purdue Model Diagram,
a Working Reference

A reference layout of the Purdue Enterprise Reference Architecture, labelled for an OT/ICS security assessment. Every level, the industrial DMZ at Level 3.5, and where the Firevault gold copy belongs.

R6.1

Enterprise

Corporate identity, cloud, SaaS, ERP

Business plane, highest attack surface

Site business

Site email, file shares, business apps

Local IT in the same building as the plant

L3.5

Industrial DMZ

Jump servers, patch mirror, published historian, Firevault gold copy

Enforced boundary between OT and IT

Site operations

MES, batch, site historian, asset management

OT plane, plant-wide coordination

Local supervision

HMI, engineering workstations, local historians

Operator interface to the process

Controllers

PLC, RTU, safety instrumented systems

Deterministic control of the process

Field devices

Sensors, actuators, motors, valves, breakers

The physical process itself

Firevault gold copy: lives at Level 3.5 or in a dedicated bunker, drawn with a broken connector to indicate a Layer 1 physical air gap. Connection windows are switched out of band and closed the moment the sync ends.

Reference layout adapted from the Purdue Enterprise Reference Architecture (Williams, 1990s). Use as a starting point for a zone and conduit diagram in an IEC 62443 assessment.

Continue with the pillar, the segmentation guide and the module maps.

The Purdue Model for OT/ICS security OT network segmentation Module deployment maps