Essentials for cloud
PRO-18 Network segmentation and segregation
Isolate the workloads you run in network zones, so an attacker who gets into one cannot easily move to the others. Allow movement between them only along paths and service trust you have explicitly approved.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted.
The action
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 1
Isolate workloads within network zones and limit lateral movement to explicitly approved pathways and service trust.
In plain English: Isolate workloads in network zones. Limit lateral movement (moving from one system to another) to explicitly approved paths and trust between services.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Who does it
- PaaSCustomer
- SaaSProvider-inherited
- MITRE ATT&CK
- Remote Services
- Exploitation of Remote Services
- Lateral Tool Transfer
- Network Service Discovery
- Use Alternate Authentication Material
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.