Zones and conduits are the most practical idea in IEC 62443. A zone groups assets with common security requirements; a conduit groups the communication channels between zones. Together they turn segmentation from a drawing into a set of rules you can test.
Yet many segmentation projects stall. The diagram shows clean layers, while the firewall allows broad rules added for a historian project years ago and a shared domain controller quietly connects everything.
Start from the process, not the network
Define zones around consequence and function, not around existing VLANs:
- Which systems, if compromised together, would cause the same consequence?
- Which systems share the same owner, maintenance pattern and vendor?
- Which systems are safety-related and must stay independent?
A safety instrumented system almost always deserves its own zone. Our Site B reference architecture shows a SIS zone connected to the DCS only through a read-only conduit.
Document every conduit
For each conduit, write down:
| Item | Example |
|---|---|
| Zones connected | Site operations ↔ Supervisory control |
| Allowed protocols | OPC UA, historian replication |
| Direction | Data flows up; no inbound engineering |
| Boundary device | Firewall with deny-by-default |
| Justification and owner | Production reporting, owned by OT engineering |
If a flow has no justification, it is a finding.
Watch the hidden conduits
The connections that break segmentation are rarely on the drawing:
- shared identity services and time sources,
- remote access tools installed by vendors,
- dual-homed engineering laptops,
- backup systems that reach every zone.
Our architecture review use case walks through how to find them.
Set target security levels with risk
IEC 62443-3-2 links zones to target security levels (SL-T) through risk assessment. Not every zone needs SL 3. A field device zone may justify SL 1–2, while a protection and control zone in a substation may justify SL 3. See Prioritizing OT cybersecurity risks.
Keep the model alive
A zone model that is not updated with changes is outdated within months. Tie updates to change control: every new connection or device updates the model.
See it in action
Our interactive sector architectures show zones, conduits and example security levels for a substation, gas plant, factory, railway and water utility. Select any zone to see its risks and controls. The Zones & Conduits module keeps your own model current.
Topics: zones and conduits, IEC 62443-3-2, OT network segmentation, industrial DMZ, Purdue model, security level target