Glossary

Network Segmentation

Division of networks into zones to limit impact of security incidents.

A

B

C

D

E

F

G

H

I

J

K

L

M

N

Network segmentation is the practice of dividing a computer network into smaller, isolated sub-networks or zones, each with its own security controls and access policies. This architectural approach limits lateral movement by attackers who gain access to one segment, preventing them from easily reaching other parts of the network that contain sensitive data or critical systems.

Effective network segmentation is a key requirement in frameworks such as PCI DSS, which mandates isolation of cardholder data environments, and ISO 27001, which requires network controls proportionate to the sensitivity of the information being processed. Implementing segmentation through VLANs, firewalls, and micro-segmentation technologies significantly reduces the blast radius of security incidents and simplifies compliance scoping.

O

P

Q

R

S

T

U

V

W

Z

Frequently asked questions

What is network segmentation?
Network segmentation divides a network into separate zones with controlled traffic between them, so that a compromise in one zone cannot move freely into the rest of the environment.
Why does segmentation matter for compliance?
It limits the blast radius of an incident and can shrink audit scope, because systems properly isolated from sensitive data may fall outside it. ISO 27001:2022 covers it in Annex A control 8.22 (segregation of networks), and segmentation is a standard way to meet NIS2’s network security measures.
How does segmentation relate to zero trust?
Zero trust takes the idea further. Classic segmentation trusts traffic within a zone; zero trust and micro-segmentation verify each request regardless of where it originates, rather than treating the internal network as safe.
← Back to all terms