What is a conduit?
A conduit, in IEC 62443, is a logical grouping of communication channels that connects two or more zones and shares a common set of security requirements. All communication that crosses a zone boundary passes through a conduit; traffic within a single zone does not need one. A conduit covers both the physical means (cables, switches, firewalls, radio links) and the logical ones (protocols, VPN tunnels, permitted data flows). Together with the zone, the conduit is the core of the zones and conduits model, the way you divide an industrial automation network according to risk.
🧠 What exactly is a conduit according to IEC 62443?
The terms come from IEC 62443-1-1 and are worked out into a design process in IEC 62443-3-2 (edition 1.0, June 2020). A conduit is not a device but a bounded set of communication channels for which you define requirements as a whole, carry out a risk assessment and record a target security level (SL-T).
| Term | Meaning | Example |
|---|---|---|
| Zone | Group of assets with common security requirements and a clearly defined boundary | PLC zone, SCADA/HMI zone |
| Communication channel | One specific logical or physical connection between assets in two zones | Modbus TCP connection from a SCADA server to PLC 12 |
| Conduit | Bundle of channels between the same zones with the same requirements | All process communication between supervisory and basic control |
| Access point | Where a channel crosses the zone boundary | Firewall port, VPN gateway, serial gateway |
| SL-T | Security level 1–4 the conduit has to achieve | SL-T 2 for an internal process conduit |
A few properties that are often overlooked:
- A conduit can connect more than two zones - for example a single management network that reaches several process areas, provided all its channels share the same requirements.
- A conduit can consist of one service or several carriers - a single Ethernet segment, but also a combination of fibre, radio and a serial link.
- A conduit may pass through another zone - only if that zone cannot compromise the channels, for instance through an encrypted tunnel across a shared network.
- A conduit is effectively a special kind of zone - with its own boundary, assets and risk assessment, but without sub-conduits. Where zones may be nested, a conduit cannot be split into subordinate conduits.
🔄 What is the difference between a conduit, a firewall and a VLAN?
A conduit is a design concept with a set of requirements; a Firewall or VLAN is a means of meeting those requirements technically. Confusing the two leads to weak designs in practice, for example when a VLAN without filtering is treated as a “conduit”. A VLAN separates broadcast domains but does not protect the zone boundary: without access rules at layer 3, any device in one VLAN can still reach any device in the other as soon as traffic is routed.
| Means | What it does | Role in a conduit |
|---|---|---|
| Managed Switch with VLANs | Logical separation of segments | Basis for segmentation, not enough as the only boundary protection |
| Industrial Firewall / Next-Gen Firewall | Allows or blocks traffic by address, port and protocol | Core of boundary protection with default deny |
| Protocol filtering / DPI | Inspects industrial function codes | For example allowing only read-only Modbus commands |
| Data diode | Physically enforced one-way traffic | Conduits where data only needs to flow outwards |
| VPN / TLS | Encryption and integrity of the channel | Conduits over shared or external networks |
| Jump Server in the IDMZ | Controlled management access with authentication | Remote access and vendor conduits |
| IDS / IPS | Detects or blocks anomalous traffic | Visibility of what actually crosses the conduit |
🔐 What does IEC 62443-3-3 require of a conduit?
IEC 62443-3-3 (2013) contains the technical system requirements per foundational requirement. These are the most relevant for conduits:
| Requirement | Title | What it means for the conduit |
|---|---|---|
| SR 1.13 | Access via untrusted networks | Monitor access through untrusted networks and approve it explicitly |
| SR 3.1 | Communication integrity | Protect the channel against manipulation of messages |
| SR 4.1 | Information confidentiality | From SL 2, confidentiality in transit over untrusted networks; at SL 4 also across every zone boundary |
| SR 5.1 | Network segmentation | Separate the control system network logically or physically from other networks |
| SR 5.2 | Zone boundary protection | Monitor and control traffic at the zone boundary; enhancements for deny by default, allow by exception, island mode and fail close |
| SR 6.2 | Continuous monitoring | Monitor traffic and security status continuously |
Which requirements and enhancements apply follows from the conduit’s SL-T. A conduit with SL-T 1 may need only simple filtering; a conduit with SL-T 3 usually calls for strong authentication, encryption over untrusted networks and continuous monitoring. In practice a conduit is often rated at least as high as the highest-rated zone it connects; otherwise the connection becomes the weakest link into that zone.
🔧 How do you design and document a conduit?
IEC 62443-3-2 describes the process as a set of Zone and Conduit Requirements (ZCRs). For conduits it comes down to six steps:
- Map the actual data flows - combine the asset inventory with passive traffic analysis; existing plants often turn out to have connections nobody knew about.
- Group channels into conduits (ZCR 3.1) - channels between the same zones with the same requirements form one conduit. Under ZCR 3.4 to 3.6, wireless links, external networks and temporarily connected devices get their own zones and therefore their own conduits.
- Assess the risk per conduit (ZCR 5) - which threats apply, what happens if the connection is abused, and which SL-T is needed. A cyber risk assessment in HAZOP style links this to process safety.
- Record the characteristics (ZCR 6.3 and 6.4) - a conduit drawing plus a description per conduit.
- Implement and verify - set up firewall rules, protocol filtering and logging, then test that only the named traffic passes. The achieved level (SL-A) must at least equal the SL-T.
- Manage the conduit - every new connection goes through change management; firewall rule management stops temporary exceptions from becoming permanent.
Under ZCR 6.4, a conduit description includes characteristics such as:
| Characteristic | Example for conduit C3 |
|---|---|
| Name and identifier | C3 – Supervisory ↔ Basic control |
| Accountable organisation | Process automation department, Rotterdam site |
| Logical and physical boundary | Industrial firewall FW-03 and the fibre ring between control room and plant |
| Connected zones | Supervisory (SCADA, HMI) and Basic control (PLCs, Remote IO) |
| Permitted data flows | Modbus TCP 502 and OPC UA 4840, only from SCADA servers to known PLC addresses |
| Direction and functions (part of the data flows) | Sessions initiated only from the supervisory level; writes limited to named registers |
| SL-T | 2 (illustrative; follows from the risk assessment) |
| Assumptions | Engineering access does not use C3 but a separate management conduit |
🏭 Which conduits will you find in a plant?
| From | To | Typical conduit implementation |
|---|---|---|
| PLC zone | SCADA/HMI zone | Industrial firewall or layer-3 switch with access lists, only the protocols needed |
| SCADA zone | MES zone | Firewall with protocol filtering and fixed servers on both sides |
| MES zone | ERP/IT zone | Always through the IDMZ: replica historian or data broker, no direct sessions between IT and OT |
| Vendor or external network | Maintenance zone | Remote access through a Jump Server in the IDMZ with MFA, opened only temporarily |
| Basic control | SIS zone | Read-only status data; writes only through a fixed engineering procedure |
| Process network | Monitoring platform | Data diode when data may only flow outwards |
A guest network should have no conduit into OT zones at all. Visitors and service engineers who need access go through a controlled remote access or maintenance conduit. Preventing lateral movement across those connections is exactly what conduits are for.
🧱 Why do conduits matter for Dutch and European regulation?
Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet) and the Cybersecurity Decree (Cyberbeveiligingsbesluit) have been in force as the national implementation of NIS2. The duty of care calls for risk-based security of network and information systems, including OT. A documented zones and conduits model shows which connections exist, why they are needed and how they are secured. Supervisory authorities and auditors increasingly ask for exactly that.
The model has also spread into sector-specific rules. The railway specification CLC/TS 50701 builds its cybersecurity approach on IEC 62443, and ENISA, together with the European Rail ISAC, published guidance on setting up zones and conduits for railway systems. In the water sector and at Seveso (Brzo) sites, network segmentation with controlled connections is a standard part of the security approach.
❓ Frequently asked questions
Does communication within a zone need a conduit?
No, a conduit is only needed for communication that crosses a zone boundary. Within a zone, the common security requirements of that zone apply. If part of the zone needs stronger protection, you make it a sub-zone with its own conduit to the rest.
Which security level does a conduit get?
A conduit gets its own target security level (SL-T) from the risk assessment under IEC 62443-3-2. In practice that level is often at least that of the highest-rated zone the conduit connects. A weakly protected conduit into an SL-T 3 zone would otherwise undermine the protection of that zone.
Is a VPN connection a conduit?
A VPN is a means within a conduit, not the conduit itself. The conduit covers all channels between the zones involved, plus the requirements, boundary and permitted data flows. A VPN provides encryption and integrity, but without filtering and authentication at the zone boundary the conduit stays open to anything that comes through the tunnel.
Is a VLAN enough to secure a conduit?
A VLAN on its own is not enough to secure a conduit. VLANs separate network segments logically, but they do not control traffic between zones as IEC 62443-3-3 requires under SR 5.2 (zone boundary protection). That needs access rules on a firewall or layer-3 switch, preferably with default deny.
When should you use a data diode for a conduit?
A data diode suits a conduit where data only has to flow from a more secure zone to a less secure one. Typical examples are historian replication or monitoring from a safety-critical plant. Because return traffic is physically impossible, the conduit cannot be used to attack the source zone.
How often should you review conduits?
IEC 62443 sets no fixed interval, but conduits should be reassessed with every change to the installation. On top of that, a periodic review of firewall rules and data flows is sensible, for example once a year. This removes forgotten temporary rules and keeps the conduit documentation in line with reality.
📌 In summary
A conduit bundles all communication channels between zones that share the same security requirements. Under IEC 62443, every conduit gets its own risk assessment, a target security level and a recorded description of its boundary, permitted data flows and accountable organisation. Technically, a conduit is implemented with firewalls, protocol filtering, encryption, data diodes or jump servers. A VLAN alone is not enough.
A conduit is the controlled and documented path between zones: only named, necessary traffic may cross the zone boundary, so that an incident in one zone cannot spread unchecked through the OT network.