Network Segmentation Services Shrink Your Scope, Contain Your Attacks

Network segmentation services design, build, and test the internal boundaries that keep an intruder in one part of your network from reaching the rest of it. Done well, segmentation cuts the number of systems that fall inside a PCI DSS, CMMC, or HIPAA assessment, stops ransomware from spreading from one infected laptop to every server you own, and produces the boundary evidence that assessors now ask to see tested rather than described. Petronella Technology Group, Inc. has designed and validated segmented networks for regulated businesses in Raleigh, the Triangle, and across the country since 2002.

Cybersecurity Since 2002/ BBB A+ Since 2003/ CyberAB RPO #1449/ Raleigh, NC

Request a Segmentation Review Test an Existing Boundary

Key Takeaways

Segmentation is the single biggest lever on assessment scope. The CMMC Level 2 scoping guidance treats an asset as out of scope only when it is physically or logically separated from CUI assets, and PCI DSS removes systems from the cardholder data environment only when segmentation controls isolate them. No separation, no scope reduction.
A boundary that has never been tested is a boundary you are guessing about. PCI DSS v4.0.1 requirement 11.4.5 requires penetration testing of segmentation controls at least every 12 months and after any change, and requirement 11.4.6 raises that to every six months for service providers. Assessors in every framework increasingly expect the same proof.
Flat networks turn one infected endpoint into a company-wide incident. Ransomware, credential theft, and lateral movement all depend on the ability to reach other systems. Segmentation is what takes that ability away.
VLANs alone are not segmentation. A VLAN separates broadcast domains. A boundary only exists when a firewall or policy enforcement point sits between zones and denies traffic by default, which is exactly what NIST SP 800-171 requirement 3.13.6 asks for.
Segmentation is an operating discipline, not a project. Rules drift, exceptions accumulate, and new systems land in the wrong zone. PCI DSS requirement 1.2.7 requires a review of network security control rulesets at least every six months for that reason.

Definition

What Network Segmentation Services Actually Deliver

Network segmentation divides one network into zones, places an enforcement point between the zones, and permits only the traffic each zone genuinely needs. A segmentation service covers the design of those zones, the firewall or policy work that enforces them, the migration of systems into the right zone without breaking the business, and the testing that proves the boundaries hold.

What a Segmentation Engagement Includes

Data flow discovery. Where does cardholder data, CUI, or protected health information actually move? Every zone design starts by mapping the flows the business depends on, because a boundary that blocks a needed flow gets an exception on day one.
Zone architecture. A written design that names each zone, the systems that belong in it, the trust level it carries, and the flows allowed in and out. This document becomes the network diagram your assessor asks for.
Enforcement build. Firewall zones and policies, VLAN and routing changes, switch access control lists, host-based policy for microsegmentation, and identity-based access where a zero trust model is in play.
Migration in waves. Systems move zone by zone, with monitoring in permissive mode first so that real traffic is observed before it is blocked.
Segmentation testing. A tester positioned in an out-of-scope zone attempts to reach the protected zone by every available path. The report is the evidence that the boundary works.
Documentation for the assessor. Updated network diagrams, data flow diagrams, the asset inventory by zone, and the System Security Plan language that describes the boundary.

What Segmentation Is Not

It is not a VLAN plan. Putting the shop floor on VLAN 30 and the office on VLAN 10 changes nothing if the core switch routes freely between them. Separation requires an enforcement point with a deny-by-default policy.
It is not folder permissions. Access control lists on a file share limit who opens a file. They do not stop a compromised workstation from scanning, exploiting, or encrypting the server that hosts it.
It is not a firewall purchase. A next-generation firewall with a single "inside" zone and an any-to-any rule is a very expensive router.
It is not a one-time project. Every new server, vendor connection, and remote access method is a potential path across a boundary. The design has to survive change.
It is not a substitute for the rest of the program. Segmentation limits how far an attacker gets. Endpoint detection, logging, patching, and multi-factor authentication still decide whether the attacker gets in at all.

Requirements

Where the Frameworks Require Network Segmentation

Few standards use the word "segmentation" in a mandatory sentence, but every one of them makes scope, boundary protection, or containment depend on it. The table below lists the specific requirements that a segmentation design has to satisfy for the frameworks Petronella Technology Group works with most.

Framework	Requirement	What Segmentation Has to Prove
PCI DSS v4.0.1	11.4.5 segmentation penetration testing at least every 12 months and after changes; 11.4.6 every six months for service providers; 1.2.7 ruleset review at least every six months	That no path exists from any out-of-scope network into the cardholder data environment, demonstrated by an actual attempt to cross, not by a configuration review
NIST SP 800-171 Rev 2 / CMMC Level 2	3.13.1 monitor, control, and protect communications at external and key internal boundaries; 3.13.5 subnetworks for publicly accessible components physically or logically separated from internal networks; 3.13.6 deny network traffic by default, allow by exception	That the CUI boundary is a defined, monitored, deny-by-default enforcement point, and that public-facing systems sit in their own subnetwork (Rev 3 folds 3.13.5 into 03.13.01 Boundary Protection)
CMMC Level 2 Scoping Guide	Out-of-Scope Assets must be physically or logically separated from CUI assets; logical isolation is achieved with network devices such as firewalls, routers, VPNs, and VLANs	That everything you left out of the assessment truly cannot reach CUI, because any asset that can is a CUI asset or a security protection asset and gets assessed
CIS Controls v8	Control 12.2, establish and maintain a secure network architecture, which names segmentation, least privilege, and availability as its design principles	That a documented architecture exists and is maintained, which most cyber insurance questionnaires now ask about directly
HIPAA Security Rule	Risk analysis and risk management standards, plus the technical access control standard at 45 CFR 164.312(a)(1)	That systems holding electronic protected health information are isolated from guest, clinical device, and general office traffic as a documented, reasonable and appropriate safeguard
NIST SP 800-82 (OT / ICS)	Guidance on segmenting and isolating control system networks from corporate networks, including a demilitarized zone between the two	That a compromise of an office workstation cannot reach programmable logic controllers, building automation, or lab instruments

The Problem

How Flat Networks Fail

A flat network is one where any device can reach any other device. Most small and mid-sized business networks are flat by accident: they were built for convenience when the company had fifteen people, and nobody ever added boundaries as it grew. Five predictable failures follow.

Ransomware spreads at machine speed

Modern ransomware does not encrypt one laptop and stop. It scans for reachable file servers, backup targets, hypervisors, and domain controllers and encrypts them in the same hour. On a flat network, "reachable" means everything. On a segmented network, the blast radius is the zone the first victim sat in. Craig Petronella documented this pattern in How Hackers Can Crush Your Business, and the same mechanics drive nearly every ransomware case the forensics team investigates.

Lateral movement goes unchallenged

Once an attacker holds one set of credentials, the next step is to move to a more valuable system. Flat networks let that movement happen over protocols that never cross a firewall and therefore never generate an alert. A boundary forces the traffic through an enforcement point where it is logged, inspected, and, if the policy is right, dropped.

Assessment scope swallows the whole company

If the accounting server can reach the CUI file server, the accounting server is in the CMMC assessment. If the marketing team's workstations can reach the point-of-sale network, they are in the cardholder data environment. Every extra system in scope is another set of controls to implement, evidence to collect, and objectives to be assessed against.

Guest, IoT, and OT traffic share the crown jewels

Conference room displays, security cameras, badge readers, HVAC controllers, and lab equipment usually cannot be patched and often ship with default credentials. On a flat network they sit next to the servers that hold your most sensitive data. They should sit behind a boundary that permits exactly the flows they need and nothing else.

Nobody can answer the assessor's first question

"Show me the boundary" is the opening question in a CMMC, PCI, or SOC 2 assessment. On a flat network the honest answer is the perimeter firewall, which means the entire internal network is the system under assessment. Segmentation gives that question a drawable, testable answer.

Incident response has nothing to contain with

When the incident retainer team arrives, the first containment move is to isolate the affected zone. On a flat network there is no zone to isolate, which leaves the choice between unplugging the whole company or letting the attacker keep moving while the investigation runs.

Approaches

Four Ways to Build a Network Boundary

Segmentation is a goal, not a product. Four families of technique reach it, and most real designs combine at least two. The right mix depends on how the network is built, what it protects, and how much operational change the business can absorb.

Approach	How It Works	Best Fit	Watch Out For
Firewall zones with VLANs	Each VLAN terminates on a firewall interface or sub-interface. Inter-zone traffic is denied by default and permitted by explicit rule.	Most small and mid-sized environments; the standard foundation for a CUI enclave or a PCI cardholder data environment	Layer-3 switches that route between VLANs behind the firewall's back; "temporary" any-any rules that never get removed
Microsegmentation	Policy is enforced on each host or workload, so two servers in the same VLAN can be isolated from each other. Usually delivered through the hypervisor, the endpoint agent, or the cloud platform.	Virtualized data centers, cloud workloads, and environments where re-addressing systems is not practical	Policy sprawl; agents that cannot run on legacy or embedded systems; a management plane that becomes the highest-value target
Identity-based (zero trust) access	Access to an application is granted per user and per device after authentication and posture checks, following the NIST SP 800-207 model. The network location stops mattering.	Remote and hybrid workforces, SaaS-heavy environments, replacing a flat VPN	Applications that cannot sit behind a broker; assuming zero trust removes the need for network boundaries around unmanaged devices
Physical separation	Separate switches, cabling, and sometimes rooms, with no network path between environments. Data moves only by approved manual transfer.	Small CUI enclaves with a handful of users; OT cells; lab instruments that must never touch the internet	Removable media becomes the new path; a single "convenience" wireless bridge silently reconnects the two environments

For defense contractors, the enclave approach that Petronella Technology Group describes in its CMMC enclave design service is a segmentation design with a specific purpose: confining CUI to a zone small enough that the rest of the company stays out of scope. For organizations moving toward a broader zero trust architecture, network zones remain the foundation that identity-based access is layered on, not a stage that zero trust replaces.

Worked Example

A Zone Design for a Mixed-Obligation Business

The illustrative design below is the kind of zone model Petronella Technology Group produces for a mid-sized manufacturer that handles Controlled Unclassified Information on a few contracts, takes card payments at a customer counter, and runs a shop floor with networked equipment. Every zone has an owner, a trust level, and an explicit list of permitted flows.

Zone	What Lives There	Permitted Flows	Assessment Effect
CUI enclave	Engineering workstations that open contract drawings, the CUI file server, the enclave's own print and scan device	Outbound to the FedRAMP Moderate cloud tenant and the management zone only; no inbound from corporate; no direct internet	This zone plus the systems that protect it define the CMMC assessment scope
Cardholder data environment	Counter payment terminals and the payment application host	Outbound to the processor over an allow-listed destination; management access from the management zone with multi-factor authentication	Segmentation testing under 11.4.5 proves nothing else can reach it, which keeps the PCI scope to this zone
Corporate users	Office, sales, finance, and HR workstations	Internet through the web filter; corporate application servers on named ports; nothing into the enclave, the cardholder environment, or the shop floor	Out of scope for CMMC and PCI once testing confirms the boundaries
Servers and management	Domain controllers, backup targets, hypervisor management, firewall and switch management interfaces, the SIEM collector	Administrative access only from dedicated admin workstations with multi-factor authentication; logs inbound from every zone	Security protection assets: in scope for CMMC because they protect the enclave, but assessed against the controls they actually provide
Shop floor (OT)	CNC controllers, programmable logic controllers, the machine-monitoring server	Program files arrive through a one-direction transfer host in a small demilitarized zone; no internet; no inbound from corporate users	Specialized assets under CMMC scoping, documented and risk-managed rather than fully assessed; protected from ransomware that lands in the office
Guest and IoT	Visitor wireless, cameras, badge readers, conference room devices, HVAC	Internet only, with each device family limited to the cloud service it reports to; no path to any internal zone	Out of scope, and no longer a foothold for reaching anything that matters

Two details in that design carry most of the value. First, the management zone is the only zone allowed to initiate administrative sessions, which means a stolen user credential cannot be used to log into a firewall or a hypervisor from a normal workstation. Second, every zone sends logs to a collector in the management zone, so the managed SIEM sees every attempted crossing, including the ones the policy blocked. A denied connection from the corporate zone to the CUI file server is one of the most useful alerts a security operations team can receive.

Common Mistakes

Four Assumptions That Fail at Assessment

The same four beliefs show up in nearly every segmentation review Petronella Technology Group performs. Each one feels reasonable, and each one produces a finding.

The Assumption

"We have VLANs, so we are segmented."

The core switch is almost always configured to route between VLANs with no policy at all. A VLAN without an enforcement point is an addressing convenience, not a boundary, and a segmentation test will walk straight across it.

"The CUI is in the cloud, so our network is out of scope."

The workstation that opens a CUI document from the cloud processes CUI. So does the printer it prints to and the network that carries the session. The cloud tenant moved part of the scope; it did not remove the endpoint side.

"We reviewed the firewall rules, so the segmentation is validated."

PCI DSS 11.4.5 requires penetration testing techniques, not a rule review, because misconfigured switches, forgotten secondary interfaces, and dual-homed servers create paths that never appear in the firewall policy.

"Our managed service provider handles the network, so they own this."

The provider may operate the firewall, but the design decision about what belongs in which zone, and the responsibility for the assessment outcome, stays with the organization. If the provider has administrative reach into the enclave, it is an external service provider and its role belongs in your shared responsibility matrix.

What Holds Up

Every inter-zone path terminates on a deny-by-default policy.

Inter-VLAN routing is disabled on the switches or pushed to the firewall, and the firewall's zone policy starts from deny-all. The test report shows the blocked attempts.

Endpoints that touch CUI live in the enclave, and the enclave has a drawn boundary.

The network diagram, the data flow diagram, and the asset inventory agree on which systems are inside. The cloud provider's responsibilities and yours are written down side by side.

Segmentation is tested from inside every out-of-scope zone.

A tester with a foothold in the corporate, guest, and OT zones attempts to reach the protected zones by every route, including through management interfaces and shared services. The findings are fixed and retested.

Ownership is written into the design and the provider agreement.

The zone model names who approves a new rule, who reviews the ruleset every six months, and who runs the annual test. Nothing about the boundary depends on a single person remembering.

Find Out Whether Your Boundaries Actually Hold

A segmentation review from Petronella Technology Group maps your current zones, identifies every path that crosses them, and tells you what an assessor or an attacker would find. Call 919-348-4912 or schedule a free consultation to start.

Schedule a Free Consultation See Penetration Testing Services

Validation

Segmentation Testing: Proving the Boundary Holds

Designing a boundary and proving it are different jobs. Segmentation testing puts a tester on the wrong side of the line and asks a single question: can this position reach the protected zone by any means? The method matters, because a test that only confirms the firewall policy misses the ways real boundaries leak.

What a Real Segmentation Test Covers

Every out-of-scope zone as a starting point. Corporate, guest, OT, vendor, and remote access zones each get a test position, because an assessor's scope decision rests on all of them.
All ports and protocols, not a sample. Full TCP and UDP sweeps toward every address in the protected zone, plus checks for routes that bypass the firewall through layer-3 switches or dual-homed hosts.
Indirect paths. Shared services such as DNS, directory, backup, and monitoring often have a foot in both zones. The test checks whether they can be used as a bridge.
Management interfaces. A firewall, switch, or hypervisor console reachable from an out-of-scope zone is the most common critical finding, because it turns the boundary into a setting an attacker can change.
Wireless and physical bridges. Rogue access points, unmanaged switches under desks, and forgotten cross-connects in the wiring closet all reconnect what the design separated.
Retest after remediation. Findings are fixed and the same test positions are re-run, and the final report states the boundary held. That closing statement is the evidence the assessor keeps.

How It Fits the Rest of the Program

Segmentation testing is a defined component of Petronella Technology Group's internal penetration testing, and it can be scheduled on the six-month cadence PCI DSS requires of service providers or the annual cadence most organizations follow.
Findings feed the managed firewall service, which owns the ruleset review, change control, and the six-month recertification that PCI DSS 1.2.7 expects.
Blocked crossings become detections in Managed XDR and the SIEM, so the security operations center sees an attacker probing a boundary before the attacker finds a gap.
Zone definitions and boundary descriptions are recorded in the System Security Plan, and the ComplianceArmor® platform keeps the network diagram, asset inventory, and test evidence attached to the controls they satisfy.
The tabletop exercise scenarios the incident response team runs include a zone-isolation drill, so the people who will have to contain an incident have practiced using the boundaries before one happens.

Comparison

Network Segmentation Services: Three Approaches Compared

Organizations get segmented networks in one of three ways: an internal team does it, a general IT provider does it as part of a network refresh, or a security and compliance firm designs it around the assessment outcome. The differences show up at the assessment and during the first incident.

Question	Internal Team	General IT Provider	Petronella Technology Group
What drives the zone design?	The existing addressing scheme and what is easiest to move	The firewall vendor's reference design	The data flows that carry CUI, cardholder data, or protected health information, and the scope boundary the assessment will be drawn around
Who tests the boundary?	Usually nobody; a rule review substitutes for a test	Often a third party is brought in only when the assessor asks for a report	The penetration testing team, from every out-of-scope zone, with retest, on the cadence the framework requires
What does the assessor receive?	A network diagram that may or may not match the switches	A firewall configuration export	A zone model, data flow diagram, asset inventory by zone, test report, and SSP language that all agree with each other
What happens after go-live?	Exceptions accumulate until the boundary is nominal	Rules are added on request; nobody removes them	Change control with a named approver, a six-month ruleset review, and re-testing after material changes
What does the first incident look like?	Everything is down while the team decides what to unplug	The provider isolates what it can reach and hopes	The affected zone is isolated by a rehearsed procedure while the rest of the business keeps working and the forensics team investigates

One client review describes the working relationship this requires: "Petronella Cybersecurity provides outstanding service! Their team is extremely knowledgeable, responsive, and truly cares about protecting their clients. They take the time to explain complex issues in simple terms and deliver real solutions, not just promises." (GB Entraînement, TrustIndex verified review; Petronella Technology Group is rated 4.7 across 92 verified TrustIndex reviews.)

Process

How We Design, Build, and Validate Segmentation

The sequence Petronella Technology Group runs for a segmentation engagement. Each step produces a document or a test result, so the business can see progress and the assessor can see evidence.

Discover: inventory every system and map the flows of regulated data across the current network

Design: define zones, trust levels, permitted flows, and the assessment boundary, and get business sign-off

Build: configure firewall zones and policies, switch and routing changes, and host or identity-based enforcement where needed

Migrate: move systems zone by zone, observing real traffic in monitor mode before enforcing, so nothing the business needs breaks

Test: run segmentation testing from every out-of-scope zone, remediate findings, and retest until the boundary holds

Sustain: hand over diagrams, inventory, and SSP language, then run change control, ruleset reviews, and scheduled retests

Ownership

Keeping Network Segmentation Intact After Go-Live

Most segmented networks do not fail on the day they are built. They fail eighteen months later, one exception at a time. Three operating habits keep the boundary real.

Change control with a named approver

Every new rule that crosses a zone boundary gets a ticket, a business justification, a named approver, and an expiry date if it is temporary. The rule review then has something to review against. Petronella Technology Group runs this process inside its managed network security services, or hands the procedure to an internal team that prefers to own it.

A six-month ruleset review

PCI DSS 1.2.7 sets the cadence, and it is a sensible one for every framework. The review removes rules whose justification has lapsed, tightens any-service rules to the ports actually observed, and confirms that the zone membership of each system still matches the design.

Retest after material change

A new site, a new hypervisor cluster, a cloud migration, or a merger changes the paths across the boundary. Each one triggers a scoped segmentation retest rather than waiting for the annual cycle, which is also what PCI DSS 11.4.5 requires.

Watch the boundary, not just the perimeter

Denied inter-zone connections are among the highest-value alerts a security operations center receives, because legitimate systems rarely generate them. Sending zone firewall logs to the SIEM turns every blocked crossing into an early warning of an intruder who has already gotten past the front door.

Keep the asset inventory zone-aware

The IT asset inventory records which zone each system belongs to. When a system is retired, replaced, or moved, the inventory change is what triggers the firewall change, not the other way around.

Rehearse isolation before you need it

The incident response plan should name the exact firewall change that isolates each zone, who is authorized to make it, and how it is reversed. Rehearsing that step in a tabletop exercise turns a segmentation design into a containment capability.

FAQ

Network Segmentation Services Questions, Answered

What are network segmentation services?

Network segmentation services are the design, implementation, and validation of internal network boundaries. A provider maps the flows of sensitive data, defines zones with explicit trust levels, configures firewalls, switches, or host-based policy to enforce those zones with deny-by-default rules, migrates systems into the correct zone, and then tests the boundaries by attempting to cross them from the outside. The output is a smaller, defensible assessment scope and a network on which a compromise of one system does not become a compromise of all of them.

Does network segmentation reduce PCI DSS scope?

Yes, when it is done and proven properly. PCI DSS allows systems that are isolated from the cardholder data environment to be excluded from scope, but requirement 11.4.5 requires the segmentation controls to be validated by penetration testing at least every 12 months and after any change. Service providers must test every six months under 11.4.6. Without that test evidence, a Qualified Security Assessor treats the segmentation as unverified and the scope expands to everything the cardholder environment can reach.

Is a VLAN enough to segment a network for CMMC?

Not by itself. The CMMC Level 2 scoping guidance says out-of-scope assets must be physically or logically separated from CUI assets, and logical separation is achieved with firewalls, routers, VPNs, and VLANs working together as enforcement. A VLAN with unrestricted inter-VLAN routing on the core switch provides no separation. The requirement in NIST SP 800-171 3.13.6 to deny network traffic by default and permit it by exception is what makes a VLAN boundary real.

How is network segmentation different from a CMMC enclave?

A CMMC enclave is a specific application of segmentation: a zone built to contain every system that processes, stores, or transmits CUI, along with the systems that protect it, so the rest of the company can stay out of the assessment. Network segmentation services cover the enclave case and every other boundary a business needs, including the cardholder data environment, operational technology, guest and IoT networks, and management zones. Petronella Technology Group offers enclave design as its own service for defense contractors and segmentation services for the broader network.

What is segmentation testing and who should perform it?

Segmentation testing is a penetration test whose only objective is to reach a protected zone from an out-of-scope position. The tester attempts every port and protocol against every protected address, looks for routes that bypass the firewall, and checks whether shared services or management interfaces can be used as a bridge. PCI DSS requires the tester to be organizationally independent of the people who manage the controls, which in practice means a third party or an internal security team that does not administer the network.

Does zero trust replace network segmentation?

No. A zero trust architecture under NIST SP 800-207 grants access per user, device, and application after authentication and posture checks, and it greatly reduces reliance on network location. It does not remove the need for boundaries around systems that cannot participate in identity-based access, such as printers, cameras, industrial controllers, and legacy servers. In practice, network zones remain the foundation and zero trust access is layered on top for the users and applications that can use it.

Will segmentation break applications that work today?

It can, if flows are blocked before they are understood, which is why the migration is done in waves with monitoring in permissive mode first. Real traffic is observed for each zone, the permitted flows are written from that observation, and enforcement is switched on only after the business confirms nothing needed is missing. Most breakage in segmentation projects comes from undocumented dependencies such as a legacy application that talks to a database on an unexpected port, and the discovery phase exists to find them before they become an outage.

How long does a network segmentation project take?

It depends on the number of systems, the number of zones, the amount of undocumented dependency in the environment, and how much change the business can absorb at once. A small CUI enclave with a handful of users can be designed, built, and tested quickly; a company-wide re-segmentation of a flat network with OT and multiple sites takes longer because migration happens in waves. Petronella Technology Group scopes the timeline after the discovery phase, when the actual flows and dependencies are known, rather than promising a schedule before the network has been mapped.

Related Services

Build the Rest of the Boundary

CMMC Enclave Design

→

CMMC Scoping Guide

→

PCI DSS Compliance

→

NIST 800-207 Zero Trust

→

Incident Response Retainer

→

ComplianceArmor® Platform

→

Draw the Boundary Before an Attacker or an Assessor Does

Petronella Technology Group has secured regulated businesses in Raleigh, Durham, and across North Carolina since 2002, holds a BBB A+ rating since 2003, and is a CyberAB Registered Provider Organization (RPO #1449). Craig Petronella, MIT-certified cybersecurity professional, NC Licensed Digital Forensics Examiner, and author of How Hackers Can Crush Your Business, leads a team that has seen what flat networks cost in the forensics lab and designs segmentation so that clients never find out for themselves. Call 919-348-4912 or schedule a free consultation.

Schedule a Free Consultation Download the 2026 SMB Cybersecurity Survival Guide

Last Updated: August 29, 2026. Reviewed by Craig Petronella, MIT-certified cybersecurity professional, CMMC Registered Practitioner, NC Licensed Digital Forensics Examiner (License# 604180-DFE).