Level 3 (Purdue)

What Level 3 Means in the Purdue Model

Level 3 is the site operations layer in the Purdue model. It sits between plant control and enterprise networks, so it is the zone where production supervision, coordination, and operational visibility are concentrated rather than direct field control.

In practice, Level 3 is where organisations often place systems that need broad situational awareness of the plant but should still remain separated from business IT. That position makes it a critical boundary layer, because compromise here can bridge into engineering and supervisory functions.

Why Level 3 Matters for Industrial Segmentation

The Purdue model uses Level 3 as a separation point, not just an architectural label. When this layer is well segmented, it helps limit how far a compromise can spread from office systems into operational technology. When it is flattened or overconnected, the site operations layer can become a transit path for lateral movement.

That is why Level 3 is often a focus for zoning, conduit design, jump host placement, and strict filtering between business networks and operational networks. The goal is to keep supervisory systems reachable for operations without making them an easy bridge into control environments.

Its security value comes from reducing the blast radius of IT-originated threats while preserving the communications needed for plant supervision, reporting, and coordination. In other words, Level 3 is where architectural convenience and operational safety have to be balanced carefully.

How Level 3 Interacts with Supervisory and Engineering Systems

Level 3 commonly hosts systems that observe production, collect operational data, manage site-level workflows, or support engineering operations. Because these systems often sit close to control logic, they can become high-value targets for attackers seeking a path to manipulate processes.

If a threat actor gains a foothold in this layer, the next step may be to reach engineering workstations, abuse supervisory trust, or pivot toward deeper control functions. That makes the layer more sensitive than a typical enterprise network segment, even when it does not directly issue low-level control commands itself.

For that reason, the trust relationships around Level 3 matter as much as the systems it contains. Weak segmentation, shared credentials, remote support sprawl, or unmanaged dependencies can all turn a site operations network into a control-plane exposure.

Design and Governance Expectations for Level 3

Level 3 should be treated as a governed operational zone with clear ownership, defined allowed flows, and strong monitoring of cross-boundary connections. A useful mental model is that this layer should support plant operations without becoming a general-purpose bridge between enterprise and control networks.

Good design usually emphasizes constrained ingress and egress, hardened management paths, and clear separation between supervisory services and deeper control assets. It also requires disciplined change control, because small changes in this layer can have outsized production impact.

Level 3 is not simply a middle tier, it is a control-security boundary. When organisations design it carefully, they reduce the chance that routine IT activity turns into an operations compromise.

Risk and Threat Considerations

Level 3 is attractive to attackers because it can provide a stepping stone from business IT into operational technology. If segmentation is weak, an initial compromise can expand into supervisory systems, engineering workstations, and eventually process-altering actions.

Failure mechanism: Poor network separation, overtrusted remote access, or shared administrative paths can let an intruder move laterally from enterprise systems into the site operations layer and then pivot toward engineering or control functions.

Impact: The result can be unauthorized command execution, logic changes, production disruption, or unsafe operational conditions, especially if monitoring and access controls do not detect the pivot early.

Practitioner Guidance

Why practitioners should care: Treat Level 3 as a security boundary with operational consequences, not as a neutral transit network. Decisions about routing, remote access, and management tooling in this layer can directly affect production resilience.

What to watch for: Pay close attention to broad connectivity between office networks and site operations systems, especially where remote administration, vendor support, or engineering access is involved. Those paths often determine whether the layer is genuinely segmented or only logically separated on paper.

Practitioner takeaway: If Level 3 is not tightly governed, it can become the easiest route from enterprise compromise to plant impact.

Related resources from NHI Mgmt Group

• Level 2 (Purdue)
• Level 1 (Purdue)
• Level 0 (Purdue)
• When does AI agent access become a board-level security concern?