Purdue Model vs IEC 62443: Two Perspectives for Securing Industrial Operations
In factories, refineries, and power plants, data flows constantly, from field sensors all the way to business systems at headquarters. That connectivity makes operations more efficient, but it also opens the door to cyber threats. Two frameworks come up most often when organizing and securing these environments: the Purdue Model and IEC 62443.
They are often compared as if you had to choose one. In reality, they look at the same industrial environment from two different perspectives: operations and cybersecurity.
The Purdue Model: Mapping Operational Functions
The Purdue Model (Purdue Enterprise Reference Architecture), which later became the basis of the ISA-95 standard, organizes industrial systems into functional levels. Each level has a defined role, from the physical process up to the business:
- Level 0 – Physical process: sensors, actuators, and field instruments.
- Level 1 – Basic control: PLCs, RTUs, and DCS controllers.
- Level 2 – Supervisory control: SCADA, HMI, and alarm systems.
- Level 3 – Site operations: historians (such as the PI System), MES, and production management.
- Levels 4–5 – Enterprise: ERP, email, and other business systems.
An Industrial DMZ (often called Level 3.5) usually sits between Levels 3 and 4 as a buffer between the OT and IT networks. In short, the Purdue Model answers one question: which functions live where, and how does data flow between them?
IEC 62443: Risk-Based Security
IEC 62443 is a series of international standards for the cybersecurity of industrial automation and control systems (IACS). Its approach is risk-based: the level of protection is driven by risk assessment, not just by where an asset sits in a hierarchy.
Its two key concepts are:
- Zones: groups of assets that share the same security requirements.
- Conduits: controlled communication paths between zones. Any traffic that crosses them must be permitted, monitored, and protected.
Each zone is assigned a target Security Level (SL 1 to SL 4) based on the threats it must withstand. The standard also defines responsibilities for asset owners, system integrators, and product suppliers, making security a shared responsibility across the system lifecycle.
Key Differences
Why You Need Both
The Purdue Model provides the map; IEC 62443 provides the rules for securing it. In practice, system designers usually start with a Purdue map to understand assets and data flows, then apply IEC 62443 risk assessment to define the zones, conduits, and security controls required.
Zone boundaries do not have to match Purdue levels. A single zone can span several levels, and a single level can be split into multiple zones. For example, a safety instrumented system (SIS) is typically placed in its own zone even though it sits at the same level as the process control system.
Functions define roles; zones define protection. That is the essence of how the two frameworks relate.
Conclusion
The Purdue Model helps you understand the architecture, while IEC 62443 helps you secure the operation. Combined, they enable industrial organizations to build systems that are not only connected and efficient, but also secure and resilient against cyber threats.
Understand the architecture. Secure the operation.