Skip to main content
Control Institute
Category: Technical Security Controls

Segregation of Networks

Also known as: Network Segregation, Network Isolation
Simply put

Segregation of networks is the practice of dividing a computer network into smaller, separated parts so that sensitive or critical systems are kept apart from less trusted areas, such as the public internet or general-purpose systems. This separation helps control who and what can reach important resources and limits how far an attacker could move if one part of the network is compromised. The specific way it is implemented typically depends on an organization's environment and risk decisions.

Formal definition

Segregation of networks refers to the logical or physical division of a network into distinct subnetworks or segments to isolate critical systems and sensitive data from other network zones and from untrusted networks such as the internet. In practice, it is used to enforce access boundaries, reduce lateral movement, and constrain the reachability of higher-value assets, typically implemented through mechanisms such as subnetting, network zoning, and boundary controls. It is closely related to but often distinguished from network segmentation, and the appropriate design, granularity, and enforcement mechanisms generally vary based on the environment, architecture, and organizational risk assessment.

Why it matters

Segregation of networks is a foundational defensive control because it directly limits how far an attacker can reach once they gain a foothold. When critical systems and sensitive data are isolated from less trusted zones, such as general-purpose user systems or the public internet, a compromise in one area does not automatically grant access to higher-value assets. By reducing lateral movement, network segregation constrains the blast radius of an incident and gives defenders more opportunities to detect and contain intrusions before they spread.

Beyond breach containment, segregation supports the enforcement of access boundaries. It allows organizations to define where traffic can and cannot flow, keeping sensitive resources reachable only from authorized zones. This makes it easier to reason about who and what can touch important systems, which in turn simplifies monitoring, access control, and the demonstration of control effectiveness during an audit or certification assessment.

The specific way segregation is implemented typically depends on an organization's environment, architecture, and risk decisions, so it is not a single fixed configuration. Rather, it is a design principle applied with varying granularity and enforcement mechanisms. Because of this, its value lies less in any one technique and more in the disciplined separation of assets according to their sensitivity and the trust level of the surrounding network.

Who it's relevant to

Security Engineers and Network Administrators
Those responsible for designing and maintaining network architecture use segregation to isolate critical systems, define trust zones, and enforce boundaries between sensitive resources and less trusted areas. They typically select the enforcement mechanisms, such as subnetting, zoning, and boundary controls, based on the environment and the organization's risk decisions.
Compliance Managers and GRC Professionals
Segregation of networks is frequently relied upon as evidence of an access-boundary and lateral-movement control. GRC teams map it to relevant criteria or reference controls and must be able to describe how the segregation design reflects the organization's risk assessment, since the appropriate approach varies by scope and environment.
Auditors and Assessors
When evaluating the suitability of design or operating effectiveness of controls, assessors examine how a network is divided and how boundaries are enforced. Because implementation varies by architecture and risk assessment, they focus on whether the segregation approach is appropriate for the defined scope rather than expecting a single universal configuration.
Small Organizations Without Dedicated Network Staff
Smaller teams that lack a dedicated network administrator often need to apply segregation as a best practice using available tooling. For them, the priority is separating critical elements from the internet and less sensitive systems in a way that matches their environment and resources, keeping the design proportionate to their risk.

Inside Segregation of Networks

Network Zoning
The practice of dividing a network into distinct zones or segments (such as trusted internal networks, demilitarized zones, and untrusted external networks) so that traffic between zones can be controlled and monitored based on trust level and sensitivity.
Access Control Between Segments
Mechanisms such as firewalls, access control lists, and routing rules that govern which traffic is permitted to flow between separated network segments, typically enforcing a default-deny posture and allowing only explicitly authorized communication.
Isolation of Sensitive Systems
The separation of systems that handle sensitive data or perform critical functions from general-purpose networks, reducing the exposure of those systems and limiting the pathways an attacker could use to reach them.
Traffic Filtering and Inspection
Controls that examine and filter traffic crossing segment boundaries, which may support monitoring, logging, and detection objectives depending on how the environment is configured.
Relationship to Framework Criteria
In a SOC 2 examination, network segregation may serve as a control supporting the Security (Common Criteria) category, and in an ISO/IEC 27001 ISMS it may correspond to a reference control selected through the Statement of Applicability and informed by risk assessment. The specific applicability depends on scope and the version of the standard in use.

Common questions

Answers to the questions practitioners most commonly ask about Segregation of Networks.

Is network segregation a mandatory control that every SOC 2 or ISO 27001 organization must implement?
Not universally. Under ISO 27001, network segregation is one of the Annex A reference controls, and Annex A controls are selected through the Statement of Applicability based on the results of a risk assessment rather than being blanket-mandatory. An organization may justify excluding or tailoring it. Under SOC 2, there is no line-item requirement for network segregation; instead, auditors assess whether the controls an organization has selected reasonably address the applicable Trust Services Criteria. Whether segregation is expected typically depends on scope, the environment, and the identified risks, so it is best described as commonly implemented rather than mandatory.
Does implementing network segregation for ISO 27001 automatically satisfy the equivalent SOC 2 requirement?
No. Mapping between the two frameworks is possible but only partial, and satisfying one does not automatically satisfy the other. ISO 27001 evaluates network segregation as a selected Annex A reference control within a management system assessed against clauses 4 through 10, whereas SOC 2 evaluates it as part of an attestation examination against the applicable Trust Services Criteria under the AICPA SSAE 18 standard. The evidence, scope boundaries, and evaluation approach differ, so a control implemented for one framework should be reassessed against the other's criteria rather than assumed to carry over.
How does network segregation typically appear in the scope of a SOC 2 examination?
In most engagements, network segregation is treated as one of several technical controls that support the applicable Trust Services Criteria, most often the Security (Common Criteria) category. In a Type I report the auditor evaluates whether the segregation controls are suitably designed at a point in time, while in a Type II report the auditor also tests operating effectiveness over the defined review period. The specific way segregation is described and tested depends on how the service organization has defined its system boundaries and scope.
How should network segregation be documented in an ISO 27001 Statement of Applicability?
Where an organization determines through its risk assessment that network segregation is applicable, the Statement of Applicability typically records the control as included, along with a justification for its inclusion and a reference to how it is implemented. If the organization decides the control is not applicable, the Statement of Applicability should document that decision and the rationale. Note that Annex A was restructured in the 2022 revision, so the exact control reference for network segregation depends on which edition of the standard the organization is certifying against.
What kinds of evidence do auditors or certification bodies typically look for regarding network segregation?
Depending on scope and the assessor, evidence commonly includes network diagrams showing segmented zones, firewall or access control list configurations, VLAN or subnet definitions, and records demonstrating that traffic between segments is controlled. For a SOC 2 Type II examination, evidence would typically span the review period to demonstrate operating effectiveness, whereas a Type I examination or an ISO 27001 assessment may focus more on design and implementation at the time of review. The precise evidence expected varies by the auditor, certification body, and defined scope.
What are the limitations of relying on network segregation as a control?
Network segregation addresses only the boundaries and traffic controls within its defined scope and does not by itself guarantee freedom from breaches. A SOC 2 report attests only to the controls and the period covered, and an ISO 27001 certificate covers only the defined scope of the ISMS, so segregation implemented outside those boundaries is not represented. Segregation typically works alongside other controls such as monitoring, access management, and change management, and its effectiveness depends on correct configuration and ongoing maintenance rather than the control existing in principle.

Common misconceptions

Implementing network segregation is explicitly mandatory for both SOC 2 and ISO 27001.
Neither framework prescribes segregation of networks as a universal mandatory control in the same way. In SOC 2, controls are selected to meet the applicable Trust Services Criteria, and in ISO 27001 Annex A controls are reference controls chosen via the Statement of Applicability based on risk. Whether and how segregation applies depends on scope, risk assessment, and the auditor or certification body's evaluation.
Segregating networks guarantees that sensitive systems cannot be breached.
Segregation reduces exposure and can limit the pathways available to an attacker, but it does not guarantee freedom from breaches. A SOC 2 report attests only to the controls and period covered, and an ISO 27001 certificate covers only the defined scope of the ISMS; neither warrants that segmented systems are immune to compromise.
Satisfying network segregation requirements for one framework automatically satisfies the other.
Mapping between SOC 2 and ISO 27001 is possible but partial. A segregation control that supports the SOC 2 Common Criteria does not automatically satisfy the corresponding ISO 27001 requirement or reference control, because the two frameworks assess and document controls differently and are evaluated by different bodies.

Best practices

Base segregation decisions on a documented risk assessment, identifying which systems and data are sensitive enough to warrant isolation rather than applying a single approach uniformly.
Enforce a default-deny posture between network segments, permitting only explicitly authorized traffic and reviewing firewall and access control list rules periodically.
Document how network segregation maps to the applicable Trust Services Criteria for a SOC 2 examination and, where relevant, to the reference controls recorded in the ISO 27001 Statement of Applicability, specifying the standard version in use.
Isolate systems handling sensitive data from general-purpose networks and limit the communication pathways into those zones to reduce exposure.
Configure monitoring, logging, and inspection of traffic crossing segment boundaries so that control operation can be evidenced over the review period, which is particularly relevant for a SOC 2 Type II engagement assessing operating effectiveness over time.
Maintain evidence of design and, where applicable, ongoing operation of segmentation controls so auditors or certification bodies can evaluate suitability of design and, in most engagements, operating effectiveness within the defined scope.