--- title: "Purdue Model Diagram, a Working Reference" description: "A labelled Purdue Model diagram for OT and ICS: every level from field devices to enterprise, the industrial DMZ at Level 3.5, and where a physical air gap…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/purdue-model-diagram#webpage", "url": "https://fire-vault.com/learn/purdue-model-diagram", "name": "Purdue Model Diagram, a Working Reference", "description": "A labelled Purdue Model diagram for OT and ICS: every level from field devices to enterprise, the industrial DMZ at Level 3.5, and where a physical air gap…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/purdue-model-diagram#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/purdue-model-diagram#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Purdue Model Diagram, a Working Reference", "item": "https://fire-vault.com/learn/purdue-model-diagram" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Purdue Model Diagram, a Working Reference", "author": { "@type": "Person", "name": "Mark Fermor" }, "publisher": { "@type": "Organization", "name": "Firevault" }, "mainEntityOfPage": "/learn/purdue-model-diagram" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What does a Purdue Model diagram show?", "acceptedAnswer": { "@type": "Answer", "text": "A Purdue Model diagram shows an industrial estate split into six horizontal levels, from Level 0 field devices at the bottom up to Level 5 enterprise at the top, with an industrial DMZ at Level 3.5. The diagram makes explicit what talks to what, and where the boundaries sit between the plant, site operations and the corporate estate." } }, { "@type": "Question", "name": "Why is Level 3.5 drawn as a separate band?", "acceptedAnswer": { "@type": "Answer", "text": "Level 3.5 is the industrial DMZ, an enforced boundary between OT (Level 3 and below) and IT (Level 4 and above). It is drawn as a separate horizontal band because the security posture, identity domain and change process on either side should differ. Systems that must be reachable from both sides live at 3.5, not on the OT plane." } }, { "@type": "Question", "name": "How should the Firevault gold copy appear on the diagram?", "acceptedAnswer": { "@type": "Answer", "text": "The Firevault gold copy is drawn at Level 3.5 or in a dedicated bunker offset from the main stack, with a broken connector to indicate a Layer 1 air gap rather than a live network path. Connection windows are annotated as out-of-band and time-limited. The visual convention makes clear the copy is not reachable while offline." } }, { "@type": "Question", "name": "Can I use a Purdue diagram in an IEC 62443 assessment?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. IEC 62443 asks for a zone and conduit diagram. A labelled Purdue diagram, with zones grouped around the levels and conduits drawn as explicit connections through Level 3.5, is the fastest way to answer that request. Most assessors expect it as a starting point." } }, { "@type": "Question", "name": "Where can I find a printable Purdue Model diagram?", "acceptedAnswer": { "@type": "Answer", "text": "The reference layout on this page is designed to be copied into architecture documents. For a printable or editable version aligned to a Firevault deployment, request the Module Deployment Maps from the Firevault team, which include Purdue diagrams for each supported module." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Why OSS # Purdue Model Diagram, a Working Reference A reference layout of the Purdue Enterprise Reference Architecture, labelled for an OT/ICS security assessment. Every level, the industrial DMZ at Level 3.5, and where the Firevault gold copy belongs. Book a demo ![Corridor of offline storage racks inside a Firevault bunker](/assets/hero-square-bunker-BC9Flanh.jpg) R6.1 L5 Enterprise Corporate identity, cloud, SaaS, ERP Business plane, highest attack surface L4 Site business Site email, file shares, business apps Local IT in the same building as the plant L3.5 Industrial DMZ Jump servers, patch mirror, published historian, Firevault gold copy Enforced boundary between OT and IT L3 Site operations MES, batch, site historian, asset management OT plane, plant-wide coordination L2 Local supervision HMI, engineering workstations, local historians Operator interface to the process L1 Controllers PLC, RTU, safety instrumented systems Deterministic control of the process L0 Field devices Sensors, actuators, motors, valves, breakers The physical process itself Firevault gold copy: lives at Level 3.5 or in a dedicated bunker, drawn with a broken connector to indicate a Layer 1 physical air gap. Connection windows are switched out of band and closed the moment the sync ends. Reference layout adapted from the Purdue Enterprise Reference Architecture (Williams, 1990s). Use as a starting point for a zone and conduit diagram in an IEC 62443 assessment. Continue with the pillar, the segmentation guide and the module maps. [The Purdue Model for OT/ICS security](/learn/purdue-model-ot-ics-security) [OT network segmentation](/learn/ot-network-segmentation) [Module deployment maps](/control) Questions ## Purdue Diagram, Common Questions Straight answers on how Offline Secure Storage® behaves in practice. ### What does a Purdue Model diagram show? ### Why is Level 3.5 drawn as a separate band? ### How should the Firevault gold copy appear on the diagram? ### Can I use a Purdue diagram in an IEC 62443 assessment? ### Where can I find a printable Purdue Model diagram? ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ![David Bailey](/assets/david-bailey-CnLw95Ao.jpg) ![Kenny Phipps](/assets/kenny-phipps-DxIqwaIL.jpg) Online Now Concierge ## Get a Purdue diagram tailored to your deployment Request the Firevault Module Deployment Maps for a Purdue-aligned diagram of your OT estate with the gold copy correctly placed at Level 3.5. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up