ZCR3 — Zones & conduits
ZCR 3 segments the SUC into security zones connected by conduits, following the segmentation rules of IEC 62443-3-2. Each zone is assigned an SL-T (Security Level Target).
Tabs
Zones & Conduits · Graphical view · IEC 62443 rules.
Zones and conduits
Create a security zone
Button ＋ Add a zone. A zone groups components with similar security requirements and a homogeneous trust level.
Each zone card includes:
- Color — color picker for visual identification
- Name — zone label (e.g. Control Zone, Supervision Zone, DMZ Zone)
- Zone type
- Target level (SL-T) — SL0 to SL4 buttons
- Description
- Equipment & Networks — checkable chips (ZCR1 inventory)
- Functions (business values) — checkable chips
| SL | Protection against |
|---|---|
| SL0 | No specific requirement |
| SL1 | Unintentional attacker (human error) |
| SL2 | Intentional attacker with limited resources |
| SL3 | Sophisticated attacker with significant resources |
| SL4 | Attacker with state-level resources |
The suggested SL-T
Each zone displays its aggregated maximum initial risk (computed from the ZCR 2 rows of the assets it contains) and a suggested SL-T, applied with one click via the Apply button. This is a proposal, never an automatic decision — it remains editable.
The suggestion method is configurable. The Vp × G method is only available in decomposed rating mode.
Why Vc is not part of either method
This is deliberate: the SL-T determines the countermeasures, which in turn set Vc. Feeding Vc into the SL-T calculation would be circular.
SL-C is no longer entered here
The zone SL-C (equipment capability) has been moved out of ZCR 3: it is entered or derived in the SL-C Components appendix. A zone's SL-C is the per-FR minimum of its equipment.
Create a conduit
A conduit is a communication channel between two zones; it inherits an SL-T at least equal to the higher of the two connected zones. Button ＋ Add a conduit (disabled until at least 2 zones exist).
| Column | Description |
|---|---|
| Name | |
| Source zone / Destination zone | Selection among existing zones |
| Direction | Unidirectional → or bidirectional ⇌ |
| Type | Conduit type |
| Protocols | Free text (e.g. TLS, OPC-UA…) |
| Target level (SL-T) | SL0 to SL4 buttons |
Graphical view
Diagram of zones as positionable cards (drag-and-drop), with automatic layout in a 3-column grid if no manual position has been saved. Each card shows the name, type, target SL and associated assets. Conduits are represented as arrows (unidirectional or bidirectional) labeled with their name and type.
Reset layout button — visible if at least one zone has been repositioned manually, restores the automatic layout.
IEC 62443 rules
Six reference rules (ZCR 3.1 to 3.6) shown as cards with Requirement and Rationale/Supplemental guidance:
- IT/OT separation
- Separation of safety systems (SIS)
- Handling of temporary devices
- Handling of wireless devices
- Connections via external networks
The zone types (BPCS, SIS, Wireless, Temp, External, IT, DMZ…) exist to carry these separations: apply them before any grouping by affinity, then refine with the heat map.
Consistency with the SUC Diagram
The zones created here also appear in the SUC Diagram (ZCR1) and serve as the basis for ZCR4, ZCR5 and section 6.3/6.4 of the CRS Document (ZCR6).