Plant Network Segmentation Checklist (Purdue)

0%

0 of 29 items complete

9 critical items still open - these are the highest-risk gaps.

Download checklist:

Zone mapping and documentation

Every device is assigned to a Purdue level (0 to 5) in a current asset listCRITICALA network diagram shows each zone, each conduit between zones and the firewall that controls itCRITICALLevel 0 and 1 devices (sensors, drives, PLCs) are on their own VLANs, not on the flat office networkLevel 2 HMIs and SCADA servers sit in a separate zone from Level 3 MES and historian serversEach production cell or line has its own VLAN or subnet where the equipment allows itIP address plan is documented and reserved ranges exist per zone

Industrial DMZ (Level 3.5)

An industrial DMZ exists between the enterprise network (Levels 4 and 5) and the plant zonesCRITICALERP, MES and historian data exchange goes through DMZ servers or brokers, never a direct enterprise-to-PLC pathCRITICALNo server in the DMZ holds long-lived admin credentials for plant systemsPatch and antivirus update servers for the plant live in the DMZ, with a one-way pull into the plant zonesFile transfer to and from the plant uses a scanned staging area, not USB sticks carried by hand

Firewall and conduit rules

Default policy between zones is deny, with explicit allow rules for documented flowsCRITICALEvery allow rule names source, destination, port and an owner, with no any-any rulesRules are reviewed at least once a year and unused rules are removedOutbound internet access from Level 0 to 3 is blocked unless a named exception existsCRITICALInter-VLAN routing for plant zones passes through a firewall, not an unfiltered Layer 3 switchProtocols such as Modbus TCP, EtherNet/IP and OPC UA are limited to the specific device pairs that need them

Remote access and third parties

Vendor and integrator remote access ends in the DMZ through a jump host, not a direct VPN into Level 2CRITICALRemote sessions use multi-factor authentication and named accounts, not shared loginsCRITICALVendor access is time boxed and approved per session or per maintenance windowRemote sessions to plant systems are logged and, for critical systems, recordedContractor laptops are checked or provided by IT before they join a plant network

Monitoring, wireless and resilience

Firewall and switch logs from plant zones are sent to a central log storePassive monitoring or a span port on key switches gives visibility of OT traffic without disturbing control trafficUnused switch ports are disabled and port security or 802.1X is in place on production floor portsWireless networks on the plant floor are separate from the office Wi-Fi and use WPA2 or WPA3 EnterpriseThe plant can keep running safely if the link to the enterprise network is cutCRITICALBackups of switch and firewall configurations are taken and testedSegmentation changes go through change control with a rollback plan

Tick each item that is fully true today. Critical items are the ones that most often decide whether an incident on the office network can reach the plant floor. Fix unticked critical items first.

Optional expert review of your segmentation result

Send us your exported checklist and we will point out the three changes that reduce the most risk for an ERP connected plant.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Work through it with whoever owns the plant switches and firewalls, ideally standing in front of the network diagram. Tick an item only when you can show evidence, such as a firewall rule export, a VLAN list or a screenshot. Partial credit hides risk, so a half-done item stays unticked. When you finish, export the result and sort the unticked critical items into your next change window plan.

Run it per plant, not per company, because plants drift apart
Bring both an IT and an OT person to the review
Keep the exported file as the baseline for next year

What the Purdue levels mean in a plant

Level 0 is the physical process: sensors, actuators and drives. Level 1 is basic control, such as PLCs and safety controllers. Level 2 is supervisory control: HMIs, SCADA and engineering workstations. Level 3 is site operations: MES, historians, quality and batch systems. Level 3.5 is the industrial DMZ, a common addition in IEC 62443 style designs. Levels 4 and 5 are business planning and enterprise IT, where the ERP normally lives. The model is a thinking aid, and modern plants with cloud MES or IIoT gateways bend it, but the principle of controlled conduits between layers still holds.

Reading your result

A plant that ticks nearly everything has a defensible zone design. A plant with the first two groups mostly unticked usually has a flat network where an infected office laptop can scan PLCs. The highest value fixes are normally the DMZ for ERP and MES traffic, a default deny firewall between zones and a controlled remote access path. Segmentation does not have to be done in one outage: many plants start with the firewall between Level 3 and Level 4, then work downward cell by cell.

Common mistakes

The most common error is drawing a Purdue diagram that does not match what is cabled. The second is a firewall with an allow-any rule added during commissioning and never removed. Others include dual-homed engineering workstations that bridge zones, vendor modems left connected, and assuming a VLAN alone is a security boundary when inter-VLAN traffic is not filtered. Also remember that ERP interfaces such as shop floor data collection often need a deliberate, narrow path through the DMZ rather than an exception to the segmentation.

Frequently Asked Questions

Is the Purdue model still relevant for modern plants?

Yes as a vocabulary and a starting design, though cloud MES, edge gateways and IIoT blur the levels. Treat it as a way to define zones and controlled conduits, then adapt it to your real data flows. IEC 62443 zones and conduits build on the same idea.

Do I need a firewall between every Purdue level?

Not always a separate physical firewall per level. What matters is that traffic between zones passes a policy enforcement point with default deny. Many plants use one or two firewall pairs with several zones, plus VLANs and access lists inside a cell.

Where should the ERP sit in the model?

The ERP is a Level 4 business system. Plant floor data that reaches it should come through Level 3 systems such as MES, via the industrial DMZ, rather than through direct connections from the ERP server to PLCs or HMIs.

How often should segmentation be reviewed?

At least yearly, and after any major project such as a new line, an MES rollout or a vendor remote access change. Firewall rule reviews are the part that drifts fastest, so tie them to your change management process.

If your ERP or MES needs live plant data without opening a path from the enterprise network to Level 2, Netray can design read-only integrations that fit a DMZ model. Ask for a short architecture review.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Industry Templates tools

See all

Plant Network Segmentation Checklist (Purdue Model)