The aim is to limit the spread of a breach from one zone to others. For every conduit the permitted protocols, directions and inspection points (firewall, data diode and so on) are explicitly defined. The security level targets (SL-T) of zones are derived from risk assessment.
What is Zones and Conduits?
In IEC 62443, assets with similar security requirements are grouped into “zones”, and the controlled communication paths between zones are called “conduits”.
