Implementing IEC 62443 Security Zones

When to Use

• When designing a greenfield OT network architecture for a new industrial facility
• When retrofitting security zones into an existing flat OT network after an assessment finding
• When implementing network segmentation to comply with IEC 62443-3-2 certification requirements
• When upgrading from basic VLAN segmentation to policy-enforced zone/conduit architecture
• When an IT/OT convergence project requires defining security boundaries between enterprise and operational networks

Do not use for IT-only network segmentation (see implementing-network-microsegmentation), for cloud-native workload segmentation (see securing-kubernetes-on-cloud), or for physical security zone design without a cyber component.

Prerequisites

• Completed OT network security assessment with asset inventory and traffic flow analysis
• Understanding of IEC 62443-3-2 zone/conduit design process and the Purdue Reference Model
• Industrial firewalls capable of deep packet inspection for OT protocols (Palo Alto with OT Security, Fortinet OT, Cisco ISA-3000)
• Network switches supporting VLANs, 802.1Q trunking, and port security
• Approval from operations management for network architecture changes during maintenance windows

Workflow

Step 1: Perform Zone Partitioning Based on Risk Assessment

Partition the IACS into zones based on functional requirements, security requirements, criticality, and consequence of compromise. Each zone contains assets with common security requirements.

# IEC 62443-3-2 Zone Definition Document
facility: "Petrochemical Refinery - Unit 3"
assessment_date: "2026-02-23"
standard: "IEC 62443-3-2:2020"

zones:
  - zone_id: "Z1-SIS"
    name: "Safety Instrumented Systems"
    purdue_level: 1
    security_level_target: "SL 3"
    criticality: "Safety Critical"
    assets:
      - "Triconex 3008 Safety Controller (SIS-01)"
      - "Triconex 3008 Safety Controller (SIS-02)"
      - "SIS Engineering Workstation"
    security_requirements:
      - "Physically isolated from all other zones (air-gapped)"
      - "Dedicated engineering workstation with removable media controls"
      - "No remote access permitted under any circumstances"
      - "Change management requires dual authorization"
    allowed_conduits: []  # No network conduits - fully air-gapped

  - zone_id: "Z2-BPCS"
    name: "Basic Process Control System"
    purdue_level: "1-2"
    security_level_target: "SL 2"
    criticality: "High"
    assets:
      - "Allen-Bradley ControlLogix PLCs (PLC-01 through PLC-12)"
      - "Rockwell FactoryTalk View HMIs (HMI-01 through HMI-06)"
      - "Engineering Workstation (EWS-01)"
    security_requirements:
      - "Industrial firewall at zone boundary with protocol inspection"
      - "Read-only access from Level 3 for data acquisition"
      - "Write access restricted to engineering workstation subnet"
      - "USB ports disabled on HMIs"
    allowed_conduits: ["C1-BPCS-OPS"]

  - zone_id: "Z3-OPS"
    name: "Site Operations"
    purdue_level: 3
    security_level_target: "SL 2"
    criticality: "Medium"
    assets:
      - "OSIsoft PI Historian (HIST-01)"
      - "OPC UA Server (OPC-01)"
      - "MES Application Server (MES-01)"
      - "Alarm Management Server (ALM-01)"
    security_requirements:
      - "Firewall between operations and control zones"
      - "Firewall between operations and DMZ"
      - "No direct internet access"
      - "Antivirus with OT-approved signatures"
    allowed_conduits: ["C1-BPCS-OPS", "C2-OPS-DMZ"]

  - zone_id: "Z4-DMZ"
    name: "Industrial Demilitarized Zone"
    purdue_level: 3.5
    security_level_target: "SL 2"
    criticality: "Medium"
    assets:
      - "PI-to-PI Interface (DMZ-HIST-01)"
      - "Patch Management Server (DMZ-WSUS-01)"
      - "Remote Access Jump Server (DMZ-JUMP-01)"
      - "Data Diode - Waterfall Security (DMZ-DD-01)"
    security_requirements:
      - "Dual-homed firewalls on both sides"
      - "No direct traffic traversal - all connections terminate in DMZ"
      - "Data diode for unidirectional historian replication"
      - "Jump server with MFA for remote access"
    allowed_conduits: ["C2-OPS-DMZ", "C3-DMZ-ENT"]

  - zone_id: "Z5-ENT"
    name: "Enterprise Network"
    purdue_level: 4
    security_level_target: "SL 1"
    criticality: "Low (from OT perspective)"
    assets:
      - "Corporate systems accessing OT data"
    security_requirements:

…