The Purdue Model industrial network reference architecture is the framework that most industrial cybersecurity professionals use as their starting point when designing OT network segmentation IIoT defences — defining the hierarchical levels from physical process sensors at Level 0 to enterprise business systems at Level 5, and establishing the IT-OT network security zones boundaries that prevent cyber threats from propagating from IT networks into the OT control systems that run physical industrial processes. Originally developed by Theodore Williams in 1989 as a production management reference architecture and later adopted by ISA-99 (the predecessor to IEC 62443) as the reference model for industrial DMZ network design, the Purdue ISA-99 model has been the dominant conceptual framework for industrial network security for over two decades. Understanding the Purdue Model industrial network — and its limitations when applied to modern IIoT deployments where direct field device-to-cloud connectivity breaks the strict hierarchical data flow the model assumes — is essential for anyone designing or reviewing OT security architecture for industrial plants deploying IIoT gateways and cloud connectivity alongside existing SCADA and DCS infrastructure. This blog explains the Purdue model levels, the industrial DMZ network design that separates OT from IT, how the model must be adapted for OT network segmentation IIoT connectivity, and the practical IT-OT network security zones architecture that modern industrial facilities use.
Purdue Model Industrial Network: Six Levels Explained
- Levels 0–2 — OT Control Levels: The operational core of the Purdue Model industrial network. Level 0 contains physical process equipment (sensors, transmitters, valves, motors) that cannot run network security software and must be protected by network isolation. Level 1 contains PLCs, RTUs, and safety systems that run real-time control — these systems have flat, fast network connectivity requirements that conflict with deep packet inspection firewalls. Level 2 contains SCADA servers and HMIs that supervise and configure Level 1 devices — these are the traditional targets of OT cyberattacks because compromising a SCADA server gives an attacker influence over hundreds of field devices. OT network segmentation IIoT architecture treats Levels 0–2 as the highest-sensitivity zone, isolated from all external connectivity.
- Level 3 — Manufacturing Operations Zone: Level 3 in the Purdue ISA-99 model hosts Manufacturing Execution Systems (MES), batch management, production historians, and process data servers that coordinate production across multiple control cells. Level 3 systems communicate upward to business systems and downward to Level 2 SCADA — making this the level where IT-OT network security zones boundaries are most critical. Historian servers at Level 3 typically collect data from Level 2 SCADA via OPC-DA or Modbus and make it available to Level 4 business systems — but they must do so through the Industrial DMZ, not via direct network connections.
- Level 3.5 — Industrial DMZ Network Design: The industrial DMZ network design at Level 3.5 is the engineered security boundary between OT and IT in the Purdue Model industrial network. Two firewalls create the DMZ buffer: Firewall 1 (OT-facing) only permits specific protocols from Level 3 systems to DMZ servers (e.g., OPC-DA historian write, Modbus read-only); Firewall 2 (IT-facing) only permits specific queries from Level 4 business systems to DMZ servers (e.g., SQL read-only, REST API GET). No direct Layer 3 routing between OT and IT networks exists — all data traverses DMZ servers. OT network segmentation IIoT adds an IIoT gateway zone at this level, with its own conduit to the cloud.
- IIoT Adaptation of the Purdue Model: Modern IIoT gateways create architectural tension with the strict Purdue ISA-99 model: a gateway at Level 1 collecting Modbus data from field instruments and publishing via MQTT to a cloud platform has a direct OT-to-internet connection that violates the Purdue model hierarchy. Best practice OT network segmentation IIoT resolves this by creating a dedicated IIoT gateway zone between Levels 2 and 3 — firewalled from the Level 1–2 OT network (inbound read-only Modbus only) and with controlled outbound MQTT to cloud through the DMZ or a separate cloud conduit — maintaining IT-OT network security zones integrity while enabling IIoT connectivity.
Purdue Model Industrial Network: Security Zone Architecture
| Purdue Level | Zone Name | IT-OT Network Security Zones — Key Security Control |
|---|---|---|
| Level 0–1 | Field Device Zone (OT) | Physical isolation; no external network; OT network segmentation IIoT enforced at Level 2 boundary |
| Level 2 | Control Zone (OT) | Purdue model industrial network — OT firewall; no internet; SCADA/HMI only |
| Level 3 | Manufacturing Zone (OT) | Historian, MES; read-only data export upward through DMZ only |
| Level 3.5 | Industrial DMZ | Industrial DMZ network design — dual firewall; no direct OT-IT routing; data transfer servers |
| Level 4–5 | Enterprise / Cloud (IT) | IT security standards; cloud access through DMZ conduit — Purdue ISA-99 model boundary |
OT Network Segmentation IIoT with Precisol Automation
Precisol Automation's Serial IIoT Gateway is deployed in the IIoT gateway zone of the Purdue Model industrial network — collecting Modbus RTU/TCP field data from Level 1–2 OT devices through a dedicated read-only firewall rule, and publishing via MQTT TLS to the cloud through the industrial DMZ network design conduit. The PreciCloud IoT Cloud Dashboard sits in the cloud/IT layer of the IT-OT network security zones architecture, receiving data through the secure MQTT channel without any direct OT network exposure.
See IT-OT secure connectivity in practice in our IT-OT bridge for process automation case study, or explore remote monitoring for Modbus PLCs for the gateway zone architecture in a real OT network segmentation IIoT deployment.
Frequently Asked Questions
What is the Purdue Model for industrial networks?
The Purdue Model industrial network (Purdue ISA-99 model) organises industrial automation into six hierarchical levels: Level 0 (field devices) → Level 1 (PLCs/RTUs) → Level 2 (SCADA/HMI) → Level 3 (MES/historian) → Level 3.5 (industrial DMZ) → Level 4–5 (IT/enterprise). It defines IT-OT network security zones boundaries that prevent cyber threats from propagating between IT and OT. OT network segmentation IIoT design uses this model to position firewalls, DMZ servers, and IIoT gateways.
How does the Purdue Model apply to IIoT and cloud connectivity?
Modern IIoT creates tension with the strict Purdue ISA-99 model by requiring direct field-to-cloud connectivity. Best practice OT network segmentation IIoT adds a dedicated IIoT gateway zone at Level 2.5–3.5 — firewalled from Level 1–2 OT (read-only Modbus inbound) and with controlled MQTT TLS outbound to cloud through the industrial DMZ. This maintains IT-OT network security zones integrity while enabling IIoT cloud connectivity for predictive maintenance and remote monitoring.
What is the Industrial DMZ in IT-OT network security zones?
The Industrial DMZ network design at Purdue Model Level 3.5 is a buffer zone between OT (Levels 0–3) and IT (Levels 4–5) created by two firewalls. DMZ servers (historians, jump servers, patch servers) allow controlled data transfer without direct OT-IT network routing. IT-OT network security zones require that no direct TCP/IP path exists between field devices and enterprise systems — all data traverses DMZ servers with protocol inspection and logging. IIoT gateways connect to cloud through this DMZ conduit.