A zone is a group of assets that share the same security requirements. A conduit is the controlled path between two zones, and it carries only what you have named. For a site with 3 PLCs, an HMI, a historian, an engineering workstation, and a vendor remote link, 5 zones and 5 conduits is a reasonable starting design.

The standard behind this is IEC 62443-3-2, which covers risk assessment and the partitioning of a system into zones and conduits. IEC 62443-3-3 supplies the system requirements and security levels (SL) you check the result against. The vocabulary is covered in the free OT networks course , and the wider controls are in Security controls for OT networks that hold up in production .

The example site

One building, one process line. 3 PLCs run the process, one HMI shows it to operators, a historian records tags, and an engineering workstation holds the PLC project files. A vendor logs in occasionally to support one PLC.…