The most common ICS/SCADA architecture typically includes two firewalls. This dual firewall configuration often involves one firewall placed between the enterprise network and the ICS/SCADA network, and another between the ICS/SCADA network and the plant floor devices. This arrangement, known as a "demilitarized zone" (DMZ) between the two firewalls, adds an additional layer of security to help isolate and protect sensitive operational technology (OT) environments from threats originating from IT networks.
Reference:
National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".