Cybrary ForgeCYBRARY / FORGE
Back to Iec 62443
IEC 62443 overview

Product lines against the standard

Which zones and controls each product line exercises

16 product lines ship a scenario. Each scenario names the zones it crosses, and each zone is argued from the foundational requirements in its protection profile. Every zone below links to the lab where it is practiced and the course module where it is taught. Our mapping, offered for planning — not an accreditation.

Zones, controls, lab and module

Safety instrumented system Z-SAFETY

target SL3 · Intentional, sophisticated means

Safety controller and its interlocks, on its own conduit and never routed.

FR2FR3FR7Purdue L0Purdue L1
  • — The key switch sits in RUN for the whole production run.
  • — No force is active on an interlock, and no force survives a keep-alive.
  • — A trip point reached is a trip taken — nothing suppresses it.
Walk the safety zone The safe response in a plant

No product-line scenario reaches this zone — it is covered by the plant-floor labs only.

Line control zone Z-CONTROL

target SL3 · Intentional, sophisticated means

PLC-201 and PLC-204, HMI-110, the serial gateway GW-260.

FR1FR2FR3FR6FR7Purdue L1Purdue L2
  • — Every address speaking control protocol is in the asset register.
  • — Write function codes come only from the panel that owns the process.
  • — One master per controller, and the commanded value matches the trend.
Walk the line control zone Security levels: how hard must this hold?

Crossed by: Forge Plant Floor.

Site operations zone Z-OPS

target SL2 · Intentional, simple means

HIST-320 process historian, batch records, the engineering workstation.

FR1FR4FR6Purdue L3
  • — The historian collects and never commands.
  • — Batch records and archives are read inside a reporting window, at a familiar volume.
  • — The engineering workstation is the licensed one, and program downloads come from it alone.
Walk the site operations zone Writing a zone's protection profile

Crossed by: Forge Plant Floor.

Industrial DMZ Z-DMZ

target SL2 · Intentional, simple means

Replicated historian, jump host, patch staging — the only way in from business IT.

FR1FR5FR6Purdue L3.5
  • — Every session from business IT terminates in the DMZ and is brokered onward.
  • — The replica serves the reads; nothing reaches the plant behind it.
  • — Remote access into the control room arrives by the sanctioned path or not at all.
Walk the industrial DMZ Conduits, and what is watched on each

Crossed by: Forge Exercises, Forge Crisis, Forge Plant Floor.

Enterprise zone Z-ENTERPRISE

target SL1 · Casual or coincidental

Corporate IT. Treated as untrusted by everything below it.

FR1FR5Purdue L4
  • — Business IT is treated as untrusted by everything below it.
  • — No office host holds an address on a plant network at the same time.
Walk the enterprise boundary Levels, zones and the plant floor range

Crossed by: Forge Labs, Forge Missions, Forge Exercises, Forge Workshop, Forge Arena, Forge Agent Workbench, Forge Agent Evaluation, Forge Crisis, Forge Ranges, Forge Anvil, Forge Proof Room, Forge AI SOC, Forge Programs, Forge Playbook Builder, Forge Secure Code, Forge Plant Floor.

Product lines, zone by zone

Forge Labs

deepest SL1

The shared drive that answered everyone

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 3 attacker steps · 2 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5
Open the lab library

Forge Missions

deepest SL1

One attachment to data out the door

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 5 attacker steps · 3 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 0 attacker steps · 0 detections

    FR1FR5
Open SOC command

Forge Exercises

deepest SL2

The whole breach, with the clocks running

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 2 attacker steps · 1 detection

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5

  • Operations DMZ → Z-DMZ

    Purdue level 3.5 · 1 attacker step · 1 detection

    FR1FR5FR6
Open team exercises

Forge Workshop

deepest SL1

Write the search that catches the persistence

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 4 attacker steps · 3 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 0 attacker steps · 0 detections

    FR1FR5
Open the workshop

Forge Arena

deepest SL1

Find the quiet beacon before the other team does

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 3 attacker steps · 3 detections

    FR1FR5
Open the arena

Forge Agent Workbench

deepest SL1

Read the trail the agent left

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 1 attacker step · 0 detections

    FR1FR5

  • Cloud tenant → Z-ENTERPRISE

    Purdue level 4 · 3 attacker steps · 3 detections

    FR1FR5
Open the agentic SOC

Forge Agent Evaluation

deepest SL1

The recommendation that reads well and is wrong

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 1 attacker step · 1 detection

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 2 attacker steps · 1 detection

    FR1FR5
Open the AI range

Forge Crisis

deepest SL2

The macro that ended in ransomware

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 3 attacker steps · 1 detection

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5

  • Operations DMZ → Z-DMZ

    Purdue level 3.5 · 1 attacker step · 1 detection

    FR1FR5FR6
Open crisis exercises

Forge Ranges

deepest SL1

A full shift to model your own scenario on

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 2 attacker steps · 1 detection

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5
Open my ranges

Forge Anvil

deepest SL1

An authorized test the blue team still has to catch

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 2 attacker steps · 2 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5
Explore Forge Anvil

Forge Proof Room

deepest SL1

The campaign a buyer is walked through

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 1 attacker step · 0 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5

  • Cloud tenant → Z-ENTERPRISE

    Purdue level 4 · 2 attacker steps · 2 detections

    FR1FR5
Open the proof room

Forge AI SOC

deepest SL1

The assistant talked into helping

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 1 attacker step · 1 detection

    FR1FR5

  • Cloud tenant → Z-ENTERPRISE

    Purdue level 4 · 2 attacker steps · 2 detections

    FR1FR5
Open the AI SOC

Forge Programs

deepest SL1

The morning shift, rung one

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 2 attacker steps · 2 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5
Open programs

Forge Playbook Builder

deepest SL1

Containment under a running clock

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 2 attacker steps · 2 detections

    FR1FR5

  • Identity → Z-ENTERPRISE

    Purdue level 4 · 1 attacker step · 1 detection

    FR1FR5
Open the playbook builder

Forge Secure Code

deepest SL1

The update that shipped an implant

  • Build and release → Z-ENTERPRISE

    Purdue level 4 · 4 attacker steps · 3 detections

    FR1FR5

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 1 attacker step · 0 detections

    FR1FR5
Open the review bench

Forge Plant Floor

deepest SL3

A vendor login into the production cell

  • Enterprise → Z-ENTERPRISE

    Purdue level 4/5 · 1 attacker step · 0 detections

    FR1FR5

  • Operations DMZ → Z-DMZ

    Purdue level 3.5 · 1 attacker step · 1 detection

    FR1FR5FR6

  • Site operations → Z-OPS

    Purdue level 3 · 1 attacker step · 0 detections

    FR1FR4FR6

  • Supervisory control → Z-CONTROL

    Purdue level 2 · 1 attacker step · 1 detection

    FR1FR2FR3FR6FR7

  • Basic control → Z-CONTROL

    Purdue level 1 · 1 attacker step · 1 detection

    FR1FR2FR3FR6FR7
Open the plant shift

The seven foundational requirements, and what covers them

FR1 Identification and authentication control

Every human, device and software process on the control network is identified.

Zones: Z-CONTROL, Z-OPS, Z-DMZ, Z-ENTERPRISE · Lines: Forge AI SOC, Forge Agent Evaluation, Forge Agent Workbench, Forge Anvil, Forge Arena, Forge Crisis, Forge Exercises, Forge Labs, Forge Missions, Forge Plant Floor, Forge Playbook Builder, Forge Programs, Forge Proof Room, Forge Ranges, Forge Secure Code, Forge Workshop

FR2 Use control

Identified users and devices may only do what their role permits, and it is logged.

Zones: Z-SAFETY, Z-CONTROL · Lines: Forge Plant Floor

FR3 System integrity

Control logic, firmware and process data are not altered without being noticed.

Zones: Z-SAFETY, Z-CONTROL · Lines: Forge Plant Floor

FR4 Data confidentiality

Recipes, batch records and process data stay inside the zone that owns them.

Zones: Z-OPS · Lines: Forge Plant Floor

FR5 Restricted data flow

Zones are segmented and traffic crosses only through declared conduits.

Zones: Z-DMZ, Z-ENTERPRISE · Lines: Forge AI SOC, Forge Agent Evaluation, Forge Agent Workbench, Forge Anvil, Forge Arena, Forge Crisis, Forge Exercises, Forge Labs, Forge Missions, Forge Plant Floor, Forge Playbook Builder, Forge Programs, Forge Proof Room, Forge Ranges, Forge Secure Code, Forge Workshop

FR6 Timely response to events

The plant notices a security event and responds without losing the process.

Zones: Z-CONTROL, Z-OPS, Z-DMZ · Lines: Forge Crisis, Forge Exercises, Forge Plant Floor

FR7 Resource availability

Control keeps running — availability outranks a clean IT containment.

Zones: Z-SAFETY, Z-CONTROL · Lines: Forge Plant Floor

Zone identifiers, security levels and requirements are the standard's; the placement of each product line is ours. Zones reached only by the plant-floor labs: Z-SAFETY. Simulation only.