Level 3.5 is where most segmentation projects quietly fail.

The industrial DMZ, Level 3.5 in the Purdue model, exists to be the one deliberate crossing point between the office network (Level 4/5) and the plant floor (Level 0–3). It only works if it’s the only crossing point.

In practice, most plants have more conduits crossing that boundary than anyone on site can name from memory: a historian replicating data upward, a vendor’s remote-access box, a reporting agent someone installed years ago and forgot about. Segmentation work fails less often on the firewall rules and more often on simply not knowing every path across the line.

Which is why asset discovery comes before architecture, not after it. You can’t defend a boundary you haven’t fully mapped.

Sources · Rockwell/Cisco Converged Plantwide Ethernet (CPwE) design guide, enet-td009; ISA/IEC 62443-3-2.