Architecture
Architecture is the context cybersecurity assurance should refer to.
An assessment result that cannot name the zone it applies to is difficult to defend and impossible to maintain. OTReady models the plant first, as canonical objects with stable identity, and every later judgement targets one of them.
- Stable identity that survives renaming, re-import and reorganisation
- A Conduit is a security relationship; a Communication Channel is what runs inside it
- Purdue level classifies architecture; it is never a Security Level
- Where an object came from is recorded separately from whether it is approved
The canonical model
Five levels, each with its own identity.
Assets and interfaces exist inside this environment, but they are not required in order to describe a communication relationship. A plant can be modelled meaningfully before an asset inventory is complete.
Project
The container. Everything below belongs to exactly one project, and access is scoped at this level.
Site
A physical or logical operating location: a substation, a plant, a terminal. Large estates hold many, and the model does not assume a single one.
Zone / Subzone
A security scope with its own expectations, its Purdue context where that applies, and its own approval state. A Subzone is a zone inside a zone, not a different kind of object.
Conduit
The governed security relationship connecting two scopes. This is what risk work and Target Security Levels reason about.
Communication Channel
A specific logical or physical communication carried inside a Conduit, with its own protocol, direction, medium and recorded encryption state.
A Conduit is not a Communication Channel.
This is the distinction the rest of the model depends on, and the one most often collapsed by tools that treat a link as a link.
Because they are separate, OTReady never presents a channel's protocol or encryption as though it were a property of the Conduit. A Conduit carrying four channels, one of them plaintext, is not "encrypted", and collapsing the two would hide exactly the channel that matters.
Conduit
A governed security relationship between two architectural scopes. It is the subject of risk work and of a Target Security Level, and it is what an assessment reasons about.
Communication Channel
A specific communication carried within that Conduit. Protocol, direction, medium and encryption are channel facts. One Conduit can carry several channels; a channel always belongs to a parent Conduit.
Conduits
The security relationship, on its own terms.
A Conduit records which two scopes it connects and the relationship between them. It is the object risk scenarios are written against and the object a Target Security Level can be confirmed on.
Conduit detail shows the endpoints, the channels carried inside it, and the facts that genuinely belong to the relationship rather than to any one channel.
Communication Channels
Encryption is recorded in three states, not two.
A channel carries its protocol, its direction, its medium and whether encryption was recorded, and that last one has three answers: encrypted, not encrypted, and not recorded.
"Not recorded" never reads as safe. A model that only offered a checkbox would turn every gap in knowledge into a claim about the plant, which is the failure mode this product exists to avoid.
- Protocol, direction and medium as channel facts
- Source and destination context, with resolved endpoints where they are known
- Several channels can share one parent Conduit
Inside the environment
Assets, interfaces and locators.
An asset inventory is part of the same model, and identity there follows the same rule as everywhere else: what a thing IS does not change when its address does.
- Assets
- Canonical inventory objects with their own identity, held in Site and Zone context and able to carry OT Domain assignments.
- Interfaces
- An asset's network interfaces, each with its own identity beneath the asset it belongs to.
- Locators
- IP and MAC are locators on an interface, not identity. An address can change without the asset becoming a different asset.
- Independent of channels
- Assets are not required in order to describe a communication relationship, so architecture work is not blocked on a complete inventory.
- OT Domains
- Functional context assigned many-to-many across zones, conduits, channels and assets: a separate question from security scope.
- Purdue context
- Applied where it is meaningful, as an architecture classification. It is never read as a Security Level.
Where an object came from is not the same question as whether it is approved.
An object drawn by hand, imported from a spreadsheet or suggested by the guided builder all arrive the same way: as something a person still has to agree to. Origin is recorded once and does not change when the object is later edited; approval is a separate, explicit governance state. A model that treated import as agreement would let a spreadsheet decide what the plant is.
Import
A file is an observation about a plant, not a decision about it.
Most operators already hold their architecture in a spreadsheet, a CMDB export or an engineering list. OTReady brings it in through a review queue rather than writing it straight into the model.
- Source
- Normalised input
- Candidate
- Human review
- Approved architecture
Every row becomes a reviewable candidate, including the invalid ones: a row that disappears silently is a row nobody can audit. Acceptance is the only step that writes canonical architecture.
Scale
Estates are rarely one site.
The demo estate used throughout this site models a regional distribution operator with many substations, so the explorer is shown here doing what it does on a large estate rather than on a tidy example: counts that come from the matching set, filters that narrow it, and a list that says how much it is showing.
Not available today
- IEC 61850 SCD import wizardPlanned: MVP2
The asset model described above (Asset, Interface, Locator, in Site, Zone and OT Domain context) is real and available today. An SCL file is not a spreadsheet with a different extension: it carries claims about a plant in a vocabulary OTReady does not yet model, so it is named here as planned rather than implied as supported.
Related capabilities
OT Domains
Functional context, kept separate from security scope.
Risk & Targets
How zones and conduits acquire a confirmed Target Security Level.
Findings & Evidence
How a Finding is attributed back to the object it is about.
Model your plant once, and let everything else refer to it.
Bring a site, a spreadsheet or an export, and see what the canonical model makes of it.