PRO-18 Protect

Network segmentation and segregation

Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted.

Enterprise IT actions

IT.PRO-18.1

Isolate systems within network zones based on business criticality and trust level, and restrict and monitor inbound and outbound access to explicitly approved pathways and services.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
ASD’s indicators

Not effective
- Systems are deployed on shared or flat network segments with no segregation between functions or trust levels.
- No access controls restrict network access from external or general user networks to in-scope systems.
- Segmentation is documented or administratively defined but not enforced by technical controls.
- Segmentation has not been validated through technical assessment.
Partially effective
- Network segmentation has been implemented but does not cover all in-scope systems, or segments are defined inconsistently.
- Access controls exist between segments, but deny-by-default is not enforced, or some pathways are permitted without documented approval.
- Technical enforcement is in place for some segments but relies on a single mechanism that does not provide meaningful isolation.
- Validation has been performed for some segments but not consistently across in-scope systems, or validation is out of date.
- Pathways are reviewed, but findings are not actioned, or the review cycle is not defined by the organisation.
Fully effective
- Systems within scope are deployed in network segments defined according to function, criticality and trust level, with segmentation applied consistently.
- Deny-by-default access controls are enforced between segments, with access from external and general user networks limited to documented and approved pathways.
- Segmentation is enforced through network-layer technical controls that provide meaningful isolation.
- Segmentation has been validated through technical assessment with results documented and gaps remediated.
- Approved pathways are reviewed on a regular cycle defined by the organisation, with unjustified pathways removed and changes reflected in the access control configuration.
Related frameworks

ISM
ISM-0520, ISM-1181, ISM-1385, ISM-1577
NIST CSF 2.0
PR.IR-01, PR.AA-05, PR.PS-01
NIST SP 800-171r3
03.13.01, 03.13.06, 03.01.03
AESCSF v2
ARCHITECTURE-2b, ARCHITECTURE-2d, ARCHITECTURE-2h
MITRE ATT&CK
T1190 Exploit Public-Facing Application, T1133 External Remote Services

Rate this action in the Navigator
IT.PRO-18.2

Limit lateral movement between, and within, network segments to explicitly approved pathways and services, based on business requirements and trust levels.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
ASD’s indicators

Not effective
- No controls limit lateral movement between or within network segments.
- Lateral movement is permitted by default across the environment, with restrictions applied only on an exception basis.
- Approved pathways are not documented.
- Lateral movement controls have not been validated through technical assessment.
- Pathways and services are not reviewed after initial approval.
Partially effective
- Controls limit lateral movement between segments but no controls operate within segments.
- Restrictions are applied to some pathways, but the default position remains permissive in parts of the environment.
- Approved pathways are documented but documentation is out of date or incomplete.
- Validation has been performed but does not cover all in-scope segments, or is out of date.
- Pathways are reviewed, but findings are not actioned, or the review cycle is not defined by the organisation.
Fully effective
- Controls limit lateral movement both between and within segments, with deny-by-default applied at each boundary.
- Pathways and services are explicitly approved based on documented business requirements and trust levels, with all other lateral movement denied.
- Approved pathways are documented, reflect the current configuration and identify the business requirement and trust relationship justifying each.
- Lateral movement controls have been validated through technical assessment with results documented and gaps remediated.
- Pathways and services are reviewed on a regular cycle defined by the organisation, with unjustified pathways removed and the configuration updated to reflect approved changes.
Related frameworks

ISM
ISM-0520, ISM-1181, ISM-1182
NIST CSF 2.0
PR.IR-01, PR.AA-05, DE.CM-01
NIST SP 800-171r3
03.13.06, 03.13.01, 03.01.03
AESCSF v2
ARCHITECTURE-2h, ARCHITECTURE-2i, ARCHITECTURE-2e
Essential Eight
Restrict administrative privileges
MITRE ATT&CK
T1021 Remote Services, T1570 Lateral Tool Transfer

Rate this action in the Navigator

Operational technology actions

Action 1

Limit communication between OT assets and any other network to explicitly approved pathways and services, based on business requirements, location and trust levels, and design new OT systems so that each service can exist within its own network segment or enclave.
- Phase 1Boundary services, Critical processes and services
- Phase 3Business systems
Rate this action in the Navigator
Action 2

Isolate OT sites and business function zones within protected network segments, with communication between them policy driven through a demilitarised zone rather than direct and unlimited.
- Phase 1Boundary services
Rate this action in the Navigator
Action 3

Segment safety systems from non-safety parts of the OT environment, enforced at a network boundary rather than by device configuration alone, and protect safety systems against change originating outside the site safety system boundary.
- Phase 1Critical processes and services
Rate this action in the Navigator
Action 4

Isolate non-production OT environments from production and from each other, where such environments exist.
- Phase 1Boundary services
Rate this action in the Navigator

Cloud actions

Action 1

Isolate workloads within network zones and limit lateral movement to explicitly approved pathways and service trust.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- ResponsibilityPaaS: Customer, SaaS: Provider
Rate this action in the Navigator

Open the Navigator

More Protect principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.