The Purdue model is a reference model that arranges industrial control systems in levels, from the physical process up to enterprise IT. Today it is mostly used to plan how plant networks are separated from business networks and the internet.
The model comes from the Purdue Enterprise Reference Architecture (PERA), developed by the Purdue Laboratory for Applied Industrial Control at Purdue University. It was first developed in December 1990 and published a year later. It was written as a guide to enterprise integration, not as a security model.
Its lasting use is network segmentation. Systems are placed on levels by what they do, and traffic between levels is restricted. NIST SP 800-82, the US guide to OT security, names the Purdue model as one industry-recognized way to organize OT network segmentation, next to the ISA-95 levels and a three-tier IIoT architecture. It also suggests a DMZ as the enforcement boundary between the plant and the enterprise network. That DMZ is often drawn as Level 3.5. It was not part of the original model.
The model says where systems sit. It does not say how to secure them. Those requirements come from elsewhere, such as the ISA/IEC 62443 series, which defines requirements and processes for securing industrial automation and control systems.
The Purdue model and ISA-95 share a layered view, and ISA describes ISA-95 as based on the Purdue Reference Model. The difference is the question each answers. ISA-95 asks which function owns which information. The Purdue model, as used now, asks which network a system belongs on. Cloud services and devices that connect straight to the internet do not fit a strict stack of levels, which is why NIST shows an IIoT model beside it.
The Purdue model levels, as extended for network segmentation
| Level | What sits there |
|---|---|
| 5 | External connections: vendor support and cloud access |
| 4 | Business logistics systems and enterprise IT |
| 3.5 | Demilitarized zone (DMZ) between plant and enterprise; not in the original model |
| 3 | Manufacturing operations systems: MES, batch management, laboratory, maintenance and plant performance systems |
| 2 | Control systems that supervise and monitor the process: real-time controls, HMI, SCADA |
| 1 | Intelligent devices that sense and manipulate the process |
| 0 | The physical process |
Questions about Purdue model
How many levels does the Purdue model have?
The usual drawing has Levels 0 to 4, from the physical process to enterprise IT. Security versions add a DMZ at Level 3.5 and sometimes a Level 5 for external connections such as vendor support and cloud access.
What is Level 3.5 in the Purdue model?
It is the demilitarized zone between the plant network and the enterprise network. It was not in the original model. It was added as IT and OT converged, to keep the two sides from talking to each other directly.
Is the Purdue model the same as ISA-95?
No. ISA-95 is based on the Purdue Reference Model and uses similar levels, but it is a standard for integrating business and manufacturing systems. The Purdue model is used mainly to segment networks. NIST SP 800-82 lists them as separate models.
Related terms
ISA-95
ISA-95 is an international standard series, also published as IEC 62264, for integrating enterprise business systems with manufacturing control systems.
IT/OT convergence
IT/OT convergence is the integration of information technology, the systems that handle business data, with operational technology, the systems that monitor and control physical equipment, so data and practices flow between them.
OT cybersecurity
OT cybersecurity is the protection of operational technology, the control systems and networks that run physical processes, against cyber threats, with safety, availability and reliable operation as the first priorities.
SCADA
SCADA (supervisory control and data acquisition) is a computerized system that gathers data from remote or distributed equipment and lets operators monitor and control it.
DCS (distributed control system)
A DCS (distributed control system) is a plant control system in which control functions are spread across many autonomous controllers near the equipment, linked by a network to central operator stations.
Sources
- National Petroleum Council (hosted by the US Department of Energy): Topic Paper 4-14, Purdue Model Framework for Industrial Control Systems and Cybersecurity Segmentation (2019)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)
- ISA: ISA/IEC 62443 Series of Standards
- ISA: ISA-95 Standard, Enterprise-Control System Integration