PRO-18 Network segmentation and segregation
2 actions under this Protect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted.
Quoted as published. Everything else on this page is written by Control Stack.
The two actions
- IT.PRO-18.1Isolate Systems in Criticality- and Trust-Based Network Zones with Approved, Monitored Pathways
Isolates systems in network zones by importance and trust, and watches traffic in and out, allowing only explicitly approved routes and services.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems - IT.PRO-18.2Restrict Lateral Movement Between and Within Segments to Approved Pathways and Services
Limits connections between and within network segments to explicitly approved routes and services matching business need and trust, stopping intruders roaming freely.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.