When a system is compromised, your incident response shouldn't start with "figure out what to isolate." You need a pre-built segmentation runbook that your team can execute under pressure.
The ATF's recent ransomware incident shows why isolation architecture matters. The breach affected a standalone computer system with investigative data but didn't spread to the ATF enterprise network or the eForms system. That containment wasn't accidental; it happened because someone made deliberate segmentation decisions beforehand.
Here's a runbook template you can adapt for your environment. It covers the segmentation decisions you need to make now, the validation steps to prove your isolation works, and the incident response procedures that utilize your architecture when a breach occurs.
Purpose of This Runbook
This template helps you document and validate network segmentation controls to contain ransomware lateral movement. It's designed for environments subject to ISO/IEC 27001 Annex A 8.22 (Segregation of Networks) or SOC 2 CC6.6 (logical and physical access restrictions).
You'll use this runbook to:
- Define segmentation boundaries for sensitive data repositories
- Document firewall rules and access control lists that enforce isolation
- Create validation procedures your team can run quarterly
- Provide incident responders with pre-approved containment actions
This isn't a general network architecture guide. It assumes you've already identified which systems handle sensitive data and need isolation.
Prerequisites
Before customizing this template, ensure you have:
Asset inventory clarity: A current list of systems processing regulated data, investigation records, customer PII, or intellectual property. You can't segment what you haven't classified.
Change control authority: The ability to implement firewall rules, VLAN configurations, or cloud security group changes. If you need a 30-day approval process for network changes, incorporate that timeline into your incident response procedures.
Monitoring baseline: Network flow logs or SIEM data showing normal east-west traffic patterns. You'll need this to validate that your segmentation rules don't disrupt legitimate workflows.
Testing window: At least four hours to implement, validate, and roll back changes if needed. Avoid deploying segmentation controls during peak transaction periods.
The Runbook Template
NETWORK SEGMENTATION RUNBOOK
Classification: Internal Use Only
Last Updated: [DATE]
Owner: [INFORMATION SECURITY OFFICER]
---
SECTION 1: SEGMENTATION ZONES
Zone ID: [UNIQUE IDENTIFIER]
Description: [e.g., "Standalone investigative database cluster"]
Data Classification: [Confidential | Restricted | Public]
Regulatory Scope: [SOC 2 Type II | ISO/IEC 27001 Annex A 8.22 | Both]
Physical Isolation: [Yes/No]
- If Yes: Location: [Building/Rack/VLAN]
- Air-gapped: [Yes/No]
Logical Isolation: [VLAN | VPC | Security Group | Firewall Zone]
- VLAN ID: [NUMBER]
- Subnet: [CIDR BLOCK]
- Security Group: [CLOUD PROVIDER IDENTIFIER]
Permitted Inbound Traffic:
- Source: [IP/CIDR/Security Group]
- Destination Port: [NUMBER]
- Protocol: [TCP/UDP/ICMP]
- Business Justification: [e.g., "Authorized analyst workstations only"]
Permitted Outbound Traffic:
- Destination: [IP/CIDR/Security Group]
- Destination Port: [NUMBER]
- Protocol: [TCP/UDP/ICMP]
- Business Justification: [e.g., "Patch management server"]
Prohibited Traffic (Explicit Deny):
- Any connection to production enterprise network
- Any connection to internet-facing systems
- Any lateral movement to adjacent zones
---
SECTION 2: ACCESS CONTROL MATRIX
Role: [JOB TITLE]
Access Level: [Read-Only | Read-Write | Administrative]
Authentication Method: [MFA Required | Certificate-Based | Both]
Access Hours: [24/7 | Business Hours Only | Scheduled Maintenance Windows]
Approval Required: [Manager | CISO | Both]
Review Frequency: [Quarterly per ISO/IEC 27001 Clause 9.2]
---
SECTION 3: INCIDENT RESPONSE PROCEDURES
TRIGGER: Suspected ransomware activity in segmented zone
IMMEDIATE ACTIONS (Execute within 15 minutes):
1. Disable all user accounts with access to affected zone
2. Block all inbound/outbound traffic at perimeter firewall
3. Snapshot affected systems for forensic preservation
4. Notify [INCIDENT RESPONSE MANAGER] and [LEGAL COUNSEL]
5. Document current state: running processes, network connections, logged-in users
DO NOT:
- Shut down systems before forensic snapshot
- Restore from backup until ransomware variant identified
- Re-enable network connectivity without explicit approval from [CISO]
VALIDATION CHECKS (Before declaring containment):
- Verify no active connections from affected zone to enterprise network
- Confirm firewall logs show blocked connection attempts
- Check backup systems for signs of encryption or tampering
- Review authentication logs for compromised credentials
EXTERNAL COORDINATION:
- If federal agency or critical infrastructure: Notify [DEPARTMENT/AGENCY] per [REGULATION]
- If customer data affected: Prepare breach notification per SOC 2 CC7.4
- If major incident per ISO/IEC 27001 Clause 5.3: Escalate to executive leadership
---
SECTION 4: VALIDATION SCHEDULE
Quarterly Validation (Due: [DATES]):
□ Attempt connection from enterprise network to segmented zone (should fail)
□ Attempt connection from segmented zone to internet (should fail unless explicitly allowed)
□ Review access control list for unauthorized changes
□ Verify all users with zone access still require it
□ Test incident response disable procedures in non-production environment
Annual Penetration Testing:
□ Engage third party to attempt lateral movement from compromised endpoint
□ Document findings and remediation timeline
□ Update segmentation rules based on test results
Customization Instructions
Replace bracketed placeholders with your actual infrastructure details. If you're using AWS, your "Security Group" entry might be sg-0123abcd. If you're using on-premises VLANs, reference switch ports and trunk configurations.
Adjust the access control matrix to match your role-based access control structure. Specify roles like database administrator, network administrator, or system administrator. Each role needs different segmentation zone access.
Modify the incident response timeline based on your staffing model. A 24/7 SOC can execute containment actions within 15 minutes. A small team with on-call rotation might need 60 minutes. Document what's realistic, not what sounds impressive to auditors.
Add your regulatory obligations to the external coordination section. If you're subject to HIPAA breach notification rules, you've got a 60-day clock. If you're handling payment card data, PCI DSS requires immediate notification to your acquiring bank.
Document your rollback procedure. If your segmentation rules break a critical business process, you need a tested procedure to restore connectivity while maintaining an audit trail. Include the approval authority required to override security controls during a production outage.
Validation Steps
Your runbook is only useful if it works under pressure. Here's how to validate it:
Test the explicit deny rules by attempting prohibited connections from a controlled test system. If your runbook says "no lateral movement to adjacent zones," try to SSH from the segmented zone to a neighboring VLAN. The connection should timeout or be rejected. If it succeeds, your firewall rules don't match your documentation.
Run a tabletop exercise where you simulate ransomware detection and walk through the incident response procedures. Time how long each step takes. If your runbook says "disable all user accounts within 15 minutes" but it takes 45 minutes to locate the account list and execute the disable script, update your timeline.
Verify your forensic snapshot process actually preserves volatile data. Some snapshot tools don't capture memory contents or running processes. Test your procedure on a non-production system and confirm you can extract the artifacts your incident response team needs.
Check that your monitoring detects violations. If someone adds an unauthorized firewall rule that permits traffic between your segmented zone and the enterprise network, your SIEM should alert within your defined detection window. If it doesn't, you've got a control gap.
Review the runbook with your external auditor during your next ISO/IEC 27001 surveillance audit or SOC 2 readiness assessment. Ask specifically whether your documented procedures satisfy Annex A 8.22 or CC6.6. Don't wait for the audit to discover your segmentation controls aren't documented to the auditor's expectations.
When Qilin claimed 125 ransomware incidents in July alone, they weren't all targeting federal agencies with dedicated security teams. They were targeting organizations that hadn't made the segmentation decisions before the incident occurred. Your runbook is the artifact that proves you made those decisions deliberately and that you've tested whether they actually work.
