The Purdue Reference Model: Levels 0 Through 5
The Purdue Enterprise Reference Architecture (PERA), formalized in the ISA-95 standard and widely adopted in ICS security as the "Purdue Model," organizes industrial systems into hierarchical levels to limit the blast radius of a network compromise. Understanding these levels is foundational to any OT segmentation design:
- Level 0 — Physical Process: Sensors, actuators, motors, valves. Communication is typically analog (4–20 mA) or simple digital. No IP networking at this layer.
- Level 1 — Basic Control: PLCs, RTUs, DCS controllers. Protocols include Modbus RTU/TCP, PROFIBUS, DeviceNet, EtherNet/IP, DNP3. Devices at this level have limited or no authentication.
- Level 2 — Supervisory Control: HMIs, SCADA servers, DCS engineering stations. Windows-based systems running FactoryTalk, Wonderware, or Inductive Automation Ignition.
- Level 3 — Site Operations: Historians (OSIsoft PI, AspenTech), Manufacturing Execution Systems (MES), batch management. The boundary between Levels 3 and 4 is where the IT/OT divide historically occurs.
- Level 4 — Site Business Planning: ERP systems, corporate Active Directory, email. Traditional IT domain.
- Level 5 — Enterprise Network: Corporate WAN, cloud connectivity, remote access infrastructure.