# IEC 62443 Zones and Conduits: A Practical Partitioning Workflow

> A zone groups assets with shared security needs, a conduit carries the controlled communication between zones, and together they give the IEC 62443 workflow…

- Canonical URL: https://wiki.aspotomasyon.com/article/iec-62443-zones-conduits-workflow
- Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki)
- Category: Industrial Cybersecurity
- Published: 2026-10-11 · Updated: 2026-10-11
- Reading time: 8 min · Language: English

A zone groups assets with shared security needs, a conduit carries the controlled communication between zones, and together they give the IEC 62443 workflow its structure.

![IEC 62443 Zones and Conduits: A Practical Partitioning Workflow — Define the boundary → Build the inventory → Partition and assess → Set and approve.](https://wiki.aspotomasyon.com/assets/diagrams/iec-62443-zones-conduits-workflow.svg)

*IEC 62443 Zones and Conduits: A Practical Partitioning Workflow — Define the boundary → Build the inventory → Partition and assess → Set and approve.*

Partitioning is the step where an asset inventory becomes a security architecture. The ISA/IEC 62443 series treats the system under consideration as a set of zones and conduits, each with a target security level that comes from risk assessment. Teams that skip this step usually end up with one large network that is hard to defend and harder to document.

This article gives a practical partitioning workflow based on the concepts in the ISA Global Cybersecurity Alliance quick start guide to the series and on NIST SP 800-82 Rev. 3. It does not quote standard clauses, because the standard texts are sold separately. Read Parts 3-2 and 3-3 in their current editions before writing requirements. The workflow applies to new systems and to existing plants, with the inventory as the starting point.

## Core terms and what they mean

Six terms carry the workflow. Define them once in the project glossary so that the risk assessment, the network design, and the vendor specification use the same words.

- **Zone:** a grouping of logical or physical assets based on risk or other criteria. It sets the requirements for the group.
- **Conduit:** a logical grouping of communication channels with common security requirements, connecting two or more zones. Its controls sit at the boundary.
- **SL-T (target security level):** the desired level for a solution, set by risk assessment and recorded in the requirements document. It drives product selection.
- **SL-C (capability security level):** the level a system or component can meet natively, without added countermeasures.
- **SL-A (achieved security level):** the actual level a built solution reaches, measured rather than specified. It is checked at acceptance.
- **FR 1 to FR 7 (foundational requirements):** identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

## The partitioning workflow

The ISAGCA guide shows the risk assessment as a flow with a decision point, and the steps below follow that flow. Keep the output of each step as a document, because the requirements specification depends on all of them.

1. **Define the system under consideration.** Set the boundary, the sites, the people who operate and maintain it, and the external services it relies on.
2. **Build the inventory and data flows.** List assets, software, firmware, network paths, and vendor connections, using the [OT asset inventory](https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery) method.
3. **Run an initial risk assessment.** Use the consequences and threats that apply to the plant to judge whether the risk is already tolerable.
4. **Partition into zones and conduits.** Group assets using the criteria in the next section, and draw the conduits between groups.
5. **Decide whether a detailed assessment is needed.** If the initial risk is above tolerable risk, assess each zone and conduit in detail, following the [ICS risk assessment](https://wiki.aspotomasyon.com/article/ics-risk-assessment) method.
6. **Set SL-T and document requirements.** Record the target level and the countermeasures for each zone and conduit in a cybersecurity requirements specification (CRS). The CRS can be a section of another document.
7. **Obtain asset owner approval and keep it current.** Update the drawings whenever assets, vendors, or flows change.

## Grouping assets into zones

The ISAGCA guide lists the criteria that can justify a zone: risk, criticality of assets, operational function, physical or logical location, required access, and responsible organization. Lifecycle is a practical addition to that list, because a device that cannot be patched often needs a separate zone from a current one, even when the function is the same.

- **Function.** Assets that do one job in the process, such as one packaging cell, belong together.
- **Criticality.** Assets whose failure has the highest consequence get the strongest boundary.
- **Trust and access.** Assets that need the same access rules and have the same responsible organization share requirements.
- **Lifecycle.** Unsupported or hard-to-patch devices are separated and monitored more closely.
- **Location.** Physical sites and network locations decide where a boundary can be enforced.

## Conduit controls and what they cannot do

A conduit is where controls are placed. Firewalls, allow-lists, and unidirectional gateways enforce different kinds of rules. NIST SP 800-82 Rev. 3 recommends firewall rulesets that permit only connections between adjacent levels, tiers, or zones, and it suggests weighing outbound rules as strictly as inbound ones. A unidirectional gateway, also called a data diode, allows traffic in one direction only and can help protect the lower side from a compromise above it.

Boundary devices between zones do not stop lateral movement inside a zone, so each zone still needs its own host and account controls. The [industrial firewalls and IDS](https://wiki.aspotomasyon.com/article/industrial-firewalls-ids) article covers deployment detail.

## The zone and conduit register

Keep one register that every reviewer can read. The table below is a template with example entries. The real content must come from your own inventory and assessment.

| ID | Zone or conduit | Assets or endpoints | Requirement basis | Owner |
| --- | --- | --- | --- | --- |
| Z-SUP | Zone: supervisory | HMI servers, historian, engineering workstation | Shared function and criticality; SL-T in the CRS | Operations manager |
| Z-CELL | Zone: packaging cell | PLCs, drives, local HMI | Shared function and location; lifecycle noted | Controls engineer |
| C-SUP-CELL | Conduit: supervisory to cell | Allow-listed historian and supervisory sessions | Firewall rules that permit only listed flows | Network engineer |
| C-VEND | Conduit: vendor access | Time-limited session through a jump host | Approval record; session logs kept | Site security owner |

## Common mistakes

- **One flat zone.** A single network in which every device reaches every other device has no conduits to control. Partition by the criteria above, even on a small line.
- **Undocumented conduits.** A cable, gateway, or switch uplink that is missing from the drawing is a conduit nobody reviews.
- **Vendor tunnels.** A remote tunnel that bypasses the firewall defeats the conduit. NIST says remote access should not circumvent or negate safety or security controls, and it should be justified, limited, and monitored. See [OT vendor remote access](https://wiki.aspotomasyon.com/article/ot-vendor-access-approval-workflow) .
- **Zones equal VLANs.** A zone is a grouping of assets by risk and function, which a network design may or may not reflect exactly. Draw the logical model first, then decide how to implement it.
- **Choosing SL-T by habit.** A target chosen without the risk assessment is a preference, not a requirement.

**Illustrative example**

Assume a bottling line with a supervisory server, a historian, two PLC cells, and a vendor gateway for remote support. The initial risk assessment rates the cells as high consequence, so they become a separate zone with a target level recorded in the CRS. The supervisory zone reaches the cells only through a conduit with an allow-list of named flows. The vendor gateway is a separate conduit that opens on approval and closes automatically. The register holds four entries, each with an owner. The counts, ratings, and levels are assumptions chosen for illustration.

## Apply this to your project

- System boundary and the external services it depends on recorded in the first document of the project file.
- Inventory confirmed to cover every zone, including vendor-owned and remotely reachable devices.
- Grouping criteria shown for each zone, and allowed flows shown for each conduit, on the same drawings.
- SL-T documented for every zone and conduit, with the risk assessment that supports the value.
- No conduit exists outside the register, including vendor, maintenance, and temporary paths.
- Each conduit control, such as a firewall rule or one-way gateway, tested against the documented flows.
- Asset owner approval recorded, with the date of the last drawing update.

[Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance.

## Frequently asked questions

### Is a zone the same as a VLAN?

No. A zone is a grouping of assets by risk, function, location, access, or responsible organization. A VLAN is a network mechanism. A zone can be implemented with a VLAN, a physical separation, or a host-based control, and one VLAN can hold more than one zone only where the requirements allow it. Draw the logical model first.

### Do I need to certify my system to use zones and conduits?

No. Zones and conduits are a design and risk method that can be applied without certification. Certification is a separate matter, handled by the ISA Security Compliance Institute for components, systems, and supplier development processes. Asset owners can use the method to specify requirements for integrators and vendors and ask for evidence in the handover documents.

### What is the difference between SL-T and SL-C?

SL-T is the level the solution must reach, set by the risk assessment and recorded in the requirements document. SL-C is the level a system or component can reach by itself, without extra countermeasures. Product selection matches SL-C to SL-T. Where a product falls short, the gap is closed with added countermeasures that are recorded.

### How many zones should a plant have?

There is no fixed number. The count follows from the grouping criteria, the consequences, and the access paths. A small line may need only a few zones, and a large site many more. Stop adding zones when each one has a clear requirement set and an owner. A zone that nobody can describe means the grouping needs more work.

### Where do vendor remote connections go in the model?

Treat each vendor connection as a conduit, because it links the vendor network to a zone. Register it with its endpoints, approval, allowed flows, and logging. Place it where its controls can be enforced, often a dedicated zone or DMZ with a jump host, and never let it bypass the firewall.

## Continue the engineering work

- [IEC 62443 Industrial Cybersecurity Standards](https://wiki.aspotomasyon.com/article/iec-62443-industrial-cybersecurity-standards)
- [OT Network Segmentation Using the Purdue Model](https://wiki.aspotomasyon.com/article/ot-network-segmentation-purdue-model)
- [ICS Security Risk Assessment Methodology (IEC 62443-3-2)](https://wiki.aspotomasyon.com/article/ics-risk-assessment)
- [OT Asset Inventory and Network Discovery](https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery)
- [Industrial Firewalls and Intrusion Detection Deployment](https://wiki.aspotomasyon.com/article/industrial-firewalls-ids)

Browse the [related technical library](https://wiki.aspotomasyon.com/category/industrial-cybersecurity) or follow an [ASP project guide](https://wiki.aspotomasyon.com/guides) to plan the implementation sequence.

![Conceptual access controls around an OT service. Actual zones, conduits, protections, and response actions require a site-specific assessment.](https://wiki.aspotomasyon.com/assets/diagrams/industrial-cybersecurity-context.svg)

*Conceptual access controls around an OT service. Actual zones, conduits, protections, and response actions require a site-specific assessment.*

## Primary references and further reading

Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results.

- [ISA — ISA/IEC 62443 Series of Standards](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards)
- [ISA Global Cybersecurity Alliance — Quick Start Guide: An Overview of ISA/IEC 62443 Standards](https://isagca.org/hubfs/2023%20ISA%20Website%20Redesigns/ISAGCA/PDFs/ISAGCA%20Quick%20Start%20Guide.pdf)
- [NIST — SP 800-82 Rev. 3 (final, September 2023), Guide to Operational Technology (OT) Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

---

Cite the canonical article: https://wiki.aspotomasyon.com/article/iec-62443-zones-conduits-workflow (IEC 62443 Zones and Conduits: A Practical Partitioning Workflow, ASP OTOMASYON, updated 2026-10-11).