Supervisory Network

What is a Supervisory Network?

A Supervisory Network is the network segment within an industrial OT architecture that hosts the systems for supervision, operation and data collection, such as SCADA servers, operator stations (HMI), the historian and engineering stations, and that connects these systems to the controllers in the underlying Control Network. It covers level 2 (area supervisory control) and level 3 (site operations) of the Purdue Model. This is where operators watch the process, alarms are handled, and process data is stored and passed on to MES and the IT environment.

The Supervisory Network sits between real-time control (PLCs and IO at levels 1 and 0) and the business network at levels 4 and 5. That makes it the place where most OT convergence comes together, and the main target for attackers who want to affect the physical process.

🧠 How does a Supervisory Network work?

A Supervisory Network revolves around four flows:

1. Data collection and visualisation

• SCADA servers request real-time process data from PLCs and DCS controllers via the Control Network, usually with polling intervals from 0.5 to a few seconds
• Operator stations display that data in process graphics and trends via SCADA or HMI

2. Commands to the controllers

• The operator changes setpoints or issues start/stop commands; the SCADA server sends them to the PLC via OPC UA (TCP 4840), Modbus (TCP 502) or S7 (TCP 102). The PLC executes the command and drives the field equipment
• Alarms are handled according to alarm management principles, and recipes and batch information are managed here as well

3. History and reporting

• The historian or a time series database stores measured values for trending, quality records and OEE reporting

4. Connection upwards

• MES usually sits at level 3 itself; ERP, office users and cloud services only gain access via a DMZ or IDMZ at level 3.5
• The boundaries are guarded with firewalls, industrial switches and VLANs

🧱 Which systems belong in the Supervisory Network?

Many modern plants run these systems as virtual machines on a redundant cluster (see Virtualization). In larger environments, engineering stations are often placed in a separate Engineering Network, because they have write access to PLC logic and therefore represent a higher risk.

🔄 What is the difference between a Supervisory Network and a Control Network?

Both networks need segmentation as well as access control. The real difference lies in the platform: the Supervisory Network consists of ordinary servers and workstations, which makes it vulnerable to the same malware as an office network.

🔐 How do you secure a Supervisory Network?

• Segmentation by zones and conduits - place the Supervisory Network in its own zone and let traffic to the Control Network and the IDMZ pass only through defined conduits. IEC 62443-3-2 describes how to define those zones and conduits; IEC 62443-3-3 sets the technical requirements under FR 5 (Restricted data flow), with SR 5.1 (network segmentation) and SR 5.2 (zone boundary protection)
• No direct traffic from level 4 to level 2 - NIST SP 800-82 Rev. 3 (September 2023) advises routing all traffic between the business network and OT through a DMZ, with industrial firewalls on both sides
• A separate OT domain - use a dedicated Active Directory domain for OT, with no trust relationship to the office domain. Entra ID belongs at most with remote access through the IDMZ, not as a direct sign-in source at level 2
• Least privilege - separate operator, engineer and administrator accounts; do not give operators administrative rights on Windows
• Remote access via a jump server - VPN sessions terminate in the IDMZ, with MFA, session recording and time-limited access
• Secure protocols - OPC UA with SignAndEncrypt, HTTPS for web clients and S7 Comm Plus with TLS (only from TIA Portal V17 and recent firmware onwards), backed by certificate management
• Application whitelisting and hardening - on servers that rarely change, whitelisting is more effective than antivirus alone
• Logging, auditing and SIEM - forward Windows, firewall and SCADA logs to a central platform, complemented by passive network monitoring

The Supervisory Network is a prime attack target: whoever takes over an operator station can operate the process without hacking the PLC.

⚠️ Which attacks have hit the Supervisory Network?

• Stuxnet (discovered in 2010) - infected Windows engineering stations running Step 7 and abused a hard-coded password of the WinCC database to infect other SCADA servers. The PLC logic was then manipulated from the engineering station
• Ukraine, 23 December 2015 - attackers who had obtained legitimate credentials beforehand used VPN connections with remote administration tools or the utilities’ own SCADA clients at three distribution companies to open breakers remotely, cutting power to around 225,000 customers. They then wiped systems with KillDisk and switched off the UPS units of servers
• Colonial Pipeline (May 2021) - the ransomware only hit IT, yet the pipeline was shut down as a precaution. It shows that an IT incident can halt production even when the Supervisory Network itself is not infected, as long as it is unclear whether the separation between IT and OT really holds

🔧 How do you set up a Supervisory Network?

1. Inventory - map all servers, clients and data flows between levels 1, 2, 3 and 4
2. Classify - assign every system a Purdue level and a zone, and set a target security level per zone
3. Separate - put at least a dedicated VLAN with a firewall between the Control Network and the Supervisory Network, and build an IDMZ towards IT. This follows the principles of Segmentation and network segmentation
4. Build in redundancy - SCADA servers in a redundant pair, duplicated switches and a ring (see Redundancy), so that a single failure does not mean losing sight of the process
5. Synchronise time - use an internal NTP source so that alarms, historian data and logs share the same timestamp
6. Maintain - test patches in a test environment first, keep offline backups of servers and project files, and rehearse recovery

In the Netherlands, the Supervisory Network of essential and important entities falls under the duty of care of the Dutch Cyberbeveiligingswet, which entered into force on 15 August 2026. The act requires appropriate measures to secure network and information systems; a documented separation between IT, supervisory and control is one of the most concrete ways to demonstrate them.

❓ Frequently asked questions

At which Purdue level is the Supervisory Network?

The Supervisory Network covers level 2 and level 3 of the Purdue Model. Level 2 holds SCADA, HMI and engineering stations that supervise a process area, while level 3 holds the historian, MES and site-wide services such as domain controllers and time servers.

Is the Supervisory Network the same as the OT network?

No, the Supervisory Network is part of the OT network. The OT network also includes the Control Network at levels 0 and 1, whereas the Supervisory Network only covers the supervision and operations layer at levels 2 and 3. The IDMZ at level 3.5 forms the buffer between the OT network and the business network.

May a SCADA server communicate directly with the office network?

A SCADA server in the Supervisory Network should not communicate directly with the office network. Traffic between IT and OT passes through an IDMZ, for example via a historian replica or a jump server, so that no direct connection exists between level 4 and level 2.

Does the engineering station belong in the Supervisory Network?

In smaller plants the engineering station sits in the Supervisory Network at level 2. Larger organisations often place engineering stations in a separate Engineering Network, because they can change PLC logic and therefore need stricter protection than operator stations.

Why is the Supervisory Network so vulnerable?

The Supervisory Network consists largely of Windows servers and workstations, which are susceptible to the same malware and ransomware as office systems. In addition, an attacker who takes over an operator station can operate the process without attacking the PLC itself, as happened in Ukraine in 2015.

Which standards apply to the Supervisory Network?

For the Supervisory Network, IEC 62443 is the most important standard, with part 3-2 for dividing the system into zones and conduits and part 3-3 for the technical requirements per security level. NIST SP 800-82 adds practical guidance on OT network architecture.

📌 In summary

The Supervisory Network is the supervision layer at levels 2 and 3 of the Purdue Model, where SCADA, HMI, historian and MES collect, display and store process data, and where operators run the process.

Because the network consists of standard servers and workstations and sits between IT and the controllers, it is a favoured target. Sound segmentation with zones and conduits, a separate OT domain, access via a jump server and continuous monitoring are crucial to the safety, security and reliability of the OT infrastructure in industrial automation.