Level 2 (Purdue) matters because it is the supervisory control layer where attacks can influence process visibility and operator actions before they reach field devices. Security teams should protect workstations, applications and remote access at this layer, since compromise here can enable unsafe commands, altered setpoints or loss of monitoring. Segment it tightly from higher-trust networks.
Why Level 2 is the security choke point in Purdue
Level 2 is where the process becomes operationally steerable, so compromise here can change what operators see and what commands get issued before anything reaches field devices. That makes it a higher-value target than the plant edge alone: attackers can hide abnormal conditions, force unsafe setpoints, or abuse trusted operator workflows. Security teams should treat this layer as a control plane, not just another network segment.
At this level, the most important assets are supervisory applications, operator workstations, engineering workstations, and the paths used for remote support. If those assets are weakly governed, an intruder does not need direct field-device access to create physical risk. The practical security question is whether the layer can still preserve trustworthy visibility and authenticated control when a workstation, session, or administrative path is compromised.
The Purdue model is especially useful because it forces teams to separate business IT trust from operational trust. The OT Security Guide covers that separation in the context of ICS and SCADA, including Purdue zoning, industrial DMZ design, and OT remote access patterns. At Level 2, that boundary is what prevents routine enterprise compromise from becoming process manipulation.
What security teams should protect at Level 2
Level 2 protection should focus on the places where visibility, command execution, and operator trust intersect. That includes hardening operator and engineering workstations, restricting privileged access to supervisory applications, and controlling any remote administration route that can reach the layer. If an attacker can alter alarms, historian feeds, or HMI state, the team may lose the ability to tell whether the process is truly safe.
Segmentation is not only about isolation in the abstract. The goal is to keep higher-trust office networks, vendor support paths, and general-purpose user systems from sharing a trust boundary with the supervisory layer. Zero trust principles are relevant here because the security posture depends on continuously verifying access rather than assuming that any internal network path is safe. The NIST Cybersecurity Framework 2.0 reinforces that layered approach through governance, protect, detect, respond, and recover functions.
For controls, the layer usually needs stricter authentication, stronger segmentation, and tighter admin privilege than adjacent enterprise zones. The NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it ties access control, identification and authentication, auditability, and configuration management to the kinds of assets that sit at this layer.
How compromise at Level 2 turns into operational impact
Level 2 compromise matters because it creates a bridge between cyber access and process behavior. A hostile change to an HMI, supervisory script, or engineering session can influence operator decisions, delay response to a real process event, or present a false picture of plant state. In practice, that means the attacker may not need to touch the controller directly to achieve damaging outcomes.
One common failure mode is trust abuse through remote access or maintenance tooling. If a remote support channel or admin workstation is overprivileged, the attacker can issue legitimate-looking actions that blend into normal operations. Another failure mode is visibility loss: when alarms, trends, or status displays are manipulated, operators may continue making decisions from a corrupted view of the process rather than from field truth.
For adversary behavior, this layer often sits at the intersection of credential theft, privilege abuse, and lateral movement. The MITRE ATT&CK Enterprise Matrix is useful for mapping those attack paths, while the FIRST standards ecosystem is relevant when incident teams need disciplined response coordination after supervisory systems are touched.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Level 2 depends on tightly governed operator and admin access. |
| Recommendation — Restrict and review accounts that can reach supervisory control assets. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Level 2 should limit who can issue supervisory commands or change process views. |
| Recommendation — Apply least privilege to supervisory workstations and remote admin paths. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | The layer benefits from continuous verification between trusted and higher-trust networks. |
| Recommendation — Enforce explicit verification and micro-segmentation for Level 2 access paths. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Compromise at Level 2 often uses legitimate accounts to reach HMI or engineering tools. |
| Recommendation — Hunt for abuse of legitimate supervisory accounts and admin sessions. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Level 2 protection hinges on controlling access to supervisory systems and remote routes. |
| Recommendation — Tighten authentication and access controls for supervisory-layer systems. | ||
Practitioner Guidance
What to verify: Confirm which systems actually sit at Level 2, which ones can initiate commands, and which remote paths can reach them without strong segmentation or privileged access review. Do not trust an asset inventory that omits engineering workstations, jump paths, or vendor support accounts.
Decision rule: If a Level 2 system can alter process state, alarm behavior, or operator visibility, treat it as operationally critical and apply stricter access, logging, and change control than the surrounding IT environment. If it can only monitor, the risk is lower but still material if the telemetry feeds decisions.
What good looks like: Operator and engineering systems are tightly segmented, remote access is mediated and monitored, and supervisory functions are resilient enough that a single workstation compromise does not collapse process visibility. The practical test is whether the team can still see and control the process if one trusted endpoint is lost.
Practitioner takeaway: Level 2 is where cyber compromise becomes operator deception or unsafe action, so the security objective is not just to block access, but to preserve trustworthy visibility and bounded control under attack.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org