What is a zone in IEC 62443?
A zone (security zone) in IEC 62443 is a grouping of logical or physical assets, such as PLCs, SCADA servers and HMIs, that share common security requirements and sit together behind one clearly defined boundary. Zones are the building blocks of the zones and conduits model: you divide an industrial network into smaller, manageable parts, give each part a target security level and route all traffic between those parts through controlled conduits. An incident in one zone then stays confined to that zone. A security zone is not the same thing as an Ex-zone, the ATEX classification of areas with an explosion hazard.
🧠 What exactly is a zone according to IEC 62443?
The definition goes back to ANSI/ISA-99.00.01 from 2007, the American predecessor of IEC 62443-1-1: a grouping of logical or physical assets that share common security requirements. The standard adds two important notes. A zone has a clear border with other zones, and security policy is enforced both at that border and inside the zone. Zones may also be nested: a zone can contain subzones with stricter requirements than the zone around them.
IEC 62443-3-2 (edition 1.0, June 2020) turns that definition into a design process. Every asset in the system under consideration is assigned to a zone or, like a firewall or network cable, to a conduit (ZCR 6.3), and every zone receives its own target security level (SL-T) from the risk assessment.
| Term | Meaning | Example |
|---|---|---|
| Zone | Group of assets with common security requirements | All PLCs and Remote IO of one production line |
| Subzone | Nested zone with stricter requirements inside a larger zone | A SIS within the process area |
| Zone boundary | Logical and, where relevant, physical demarcation of the zone | Firewall interface, cabinet door, locked server room |
| Access point | Place where communication or a person crosses the boundary | Firewall port, USB port, remote access gateway |
| Conduit | Bundled communication channels between zones | Process traffic between supervisory and control |
| SL-T | Target security level 1 to 4 per zone | SL-T 2 for the supervisory zone |
Communication within a zone does not need a conduit. Everything that crosses the zone boundary does. A zone is therefore first and foremost a design concept with a set of requirements, and only then a network segment.
🧱 Which criteria do you use to group assets into zones?
Under ZCR 3.1 of IEC 62443-3-2 you group assets based on risk and on criteria such as asset criticality, operational function, physical or logical location, required access (following least privilege) and the responsible organisation. Two similar devices can therefore end up in different zones if compromising one has far more serious consequences than compromising the other.
On top of that, the standard prescribes five fixed separations:
| Requirement | Separation | Why |
|---|---|---|
| ZCR 3.2 | Business assets separate from IACS assets | Office IT such as ERP and email has a different threat profile from OT |
| ZCR 3.3 | Safety-related assets separate | If that is not possible, the whole zone counts as safety-related |
| ZCR 3.4 | Temporarily connected devices separate | Service laptops and portable engineering stations come from outside |
| ZCR 3.5 | Wireless devices separate from wired ones | Wifi and WirelessHART can also be reached from outside the building |
| ZCR 3.6 | Devices connected via external networks separate | Supplier access and internet links enlarge the attack surface |
These rules prevent the most common mistake: one flat OT zone in which an infected service laptop sits right next to a safety PLC.
🔧 Which characteristics do you record for each zone?
ZCR 6 of IEC 62443-3-2 calls for a cybersecurity requirements specification (CRS), containing zone and conduit drawings (ZCR 6.3) and the characteristics of every zone and conduit (ZCR 6.4). A usable zone record contains at least:
| Characteristic | Content | Example |
|---|---|---|
| Name and identifier | Unique code and description | Z-03 Supervisory line 2 |
| Accountable organisation | Owner and administrator of the zone | Process automation department |
| Logical and physical boundary | Subnets, systems, rooms and cabinets | 10.20.3.0/24, control room |
| Safety designation | Whether the zone contains safety functions | No (SIS in its own zone) |
| Access points | All logical and physical entry points | Firewall interface, USB, service port |
| Data flows and conduits | Which traffic may use which access point | OPC UA to the historian |
| Assets | List with classification and criticality | Two SCADA servers, four HMIs |
| SL-T and requirements | Target level and applicable security requirements | SL-T 2, requirements from IEC 62443-3-3 |
| Policies and assumptions | Applicable policies and external dependencies | Domain controller in zone Z-02 |
Without this information you cannot test whether the countermeasures are sufficient. The zone record is also the starting point for firewall rule management: every rule should trace back to a documented data flow.
🏭 Which zones appear in a typical installation?
The number and layout of zones follow from your own risk assessment, but in process plants and factories these zones come up again and again:
| Zone | Typical assets | Point of attention |
|---|---|---|
| Enterprise / IT | ERP, email, office workstations | Usually outside the system under consideration (SuC) |
| IDMZ | Replica historian, patch server, jump server | No direct traffic from IT to control |
| Site operations | MES, historian, OT domain controller | Links OT with ERP via the IDMZ |
| Supervisory | SCADA servers, HMIs | High availability, never directly reachable from the internet |
| Basic control | PLCs, Remote IO, variable frequency drives | Only the industrial protocols that are needed |
| Safety | SIS, safety PLCs | Own zone under ZCR 3.3 |
| Temporary / external | Service laptops, supplier access | Own zone under ZCR 3.4 and 3.6 |
| Wireless | Wi-Fi tablets, WirelessHART gateways | Own zone under ZCR 3.5 |
🔄 How does a zone differ from a VLAN, a Purdue level and an Ex-zone?
| Term | What it is | Relationship to a security zone |
|---|---|---|
| Zone (IEC 62443) | Group of assets with common security requirements | The design concept itself |
| VLAN | Logical separation of a switched network | A means to implement a zone, insufficient without a filtered boundary |
| Subnet / segment | Address range or part of the network | A zone can span several subnets |
| Purdue level | Functional layer, from level 0 to 4 | Zones often coincide with levels, but they do not have to |
| Ex-zone | ATEX area with explosion hazard (zone 0, 1, 2 or 20, 21, 22) | Different domain: physical explosion safety, not cybersecurity |
A zone can, for example, cover an entire production line vertically, from PLC to line HMI, while the SIS on the same Purdue level gets its own zone. If you want finer separation within a zone, microsegmentation is a complementary technique.
🛠️ How do you set up a zone in practice?
- Inventory - start with an up-to-date asset inventory and network drawing; without an overview of assets and connections, zoning is guesswork.
- Group - assign assets according to the criteria and separations of ZCR 3 and record the characteristics of each zone.
- Set the SL-T - carry out a risk assessment per zone under ZCR 5 and set the target level; formally this is a vector of seven values, one per foundational requirement.
- Enforce the boundary - implement it with an industrial firewall, VLANs with filtering or a data diode, in line with SR 5.1 and SR 5.2 of IEC 62443-3-3.
- Manage the access points - close unused ports, arrange access control and route external administration through the IDMZ.
- Monitor and maintain - use monitoring and passive network monitoring at the zone boundary and review the zone model with every extension.
In the Netherlands zoning is not literally required by law, but it is the established way to demonstrate that you take appropriate measures. NIS2 and the Dutch Cybersecurity Act, which entered into force on 15 August 2026, require risk-based measures under the duty of care. In the water sector, too, IEC 62443 is a widely used reference framework for segmenting treatment plants and pumping stations.
❓ Frequently asked questions
How many zones does an OT network need?
The number of zones follows from the risk assessment under IEC 62443-3-2, not from a fixed figure. ZCR 3.2 to 3.6 do, however, require separate zones for business IT, safety systems, temporarily connected devices, wireless devices and external connections, where these are present. A small installation can therefore manage with a handful of zones, while a large site often has many more.
Can an asset belong to more than one zone?
No, under ZCR 6.3 every asset is assigned to one zone or one conduit. A device with two network cards in different zones, such as a dual-homed engineering station, bridges the zone boundary and creates an uncontrolled connection. Such an asset belongs in its own zone or behind a firewall.
Is a zone the same as a VLAN?
No, a zone is a group of assets with common security requirements, whereas a VLAN is a technical way of separating network traffic. A VLAN helps you implement a zone, but only filtering at the zone boundary creates a controlled crossing through a conduit.
What is a subzone?
A subzone is a nested zone inside a larger zone, with stricter security requirements than the surrounding zone. A typical example is a safety system within a process area. The subzone has its own boundary and its own SL-T, and communicates with the rest through a conduit.
Who is responsible for a zone?
Under IEC 62443-3-2 every zone has an accountable organisation, usually the department that operates the installation. The asset owner approves the overall zone and conduit model in ZCR 7. System integrators and suppliers contribute, but they do not carry final responsibility.
Does a security zone have anything to do with an ATEX zone?
No, a security zone from IEC 62443 is about cybersecurity, whereas an ATEX zone or Ex-zone indicates how often an explosive atmosphere may be present. Both classifications exist side by side in the same installation. Equipment in an Ex-zone can therefore also belong to a security zone for basic control.
📌 In summary
A zone is a delimited group of assets with common security requirements, a clear boundary and its own target security level, within which you match countermeasures to the risk of that group. Together with conduits, zones form the basis for a secure, structured OT architecture as described in IEC 62443. They only deliver real protection when they are backed by a risk assessment, recorded in a zone record, and technically enforced and monitored.