Skip to content

Microsegmentation

What is Microsegmentation?

A network security technique that enables fine-grained security policies to be assigned to individual workloads or applications, limiting lateral movement within a data centre or cloud environment.

Information Security

Terms that appear alongside microsegmentation

Each of these is named in at least one of the same controls as microsegmentation. The number is how many controls name both.

Frameworks that govern microsegmentation

CSA CCM v4View framework →ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on microsegmentation

Requirements naming microsegmentation across 6 standards, quoted from the control text.

MITRE D3FEND1 control

Apply D3FEND ISOLATE tactic to create logical or physical barriers in a system to reduce attack opportunities and impact. D3-EI Execution Isolation (D3-HBPI Hardware-based Process Isolation + D3-SCF System Call Filtering + D3-IBCA IO Channel Authentication + D...

MITRE-D3FEND-Isolate-Tactic-Execution-Network-Isolation-Sandboxing-Microsegmentation-DNS-Filtering · MITRE D3FEND Isolate Tactic + Execution + Network Isolation + Sandboxing + Microsegmentation + DNS Filtering →
ISMAP (Japan)2 controls

ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...

ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →
ITU-T X.805 - Security Architecture for End-to-End Communications2 controls

Security Layer 1 Infrastructure per X.805 Clause 7.1: The Infrastructure Security Layer consists of network facilities (transmission facilities and network elements) protected by the security measures.

X805-Layer1-Infrastructure-Security-Transmission-Facilities-Network-Elements-Lines-Routers-Switches · ITU-T X.805 Security Layer 1 - Infrastructure Security + Transmission Facilities + Network Elements + Routers + Switches + Lines + Physical + Datacenter + Optical + Radio Access + Wireless + Wireline + Edge →
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)1 control

Protect is the second of five functional elements per MSC-FAL.1/Circ.3/Rev.2. Activities include: (1) Access Control - identity and access management for IT + OT systems + role-based access + least privilege + privileged access management (PAM) for OT engineer...

IMO-MSC-FAL-Protect-AccessControl-NetworkSegmentation-MalwareDefence-Patch-Awareness-DataSecurity · IMO MSC-FAL Protect Function - Access Control + Network Segmentation + Malware Defence + Patch Management + Awareness Training + Data Security + Crew BYOD + Removable Media →
Japan FSA Cybersecurity Guidelines for Financial Institutions1 control

Identity and Access Management (IAM) is a critical control area per FSA Cybersecurity Guidelines + intersects with FISC Security Guidelines + Japan Banking Customer Authentication Standards + APPI access control.

JP-FSA-CYB-Identity-Access-Management-Privileged-Access-MFA-Zero-Trust-Just-In-Time-Banking-Customer-Authentication · Japan FSA Cybersecurity Identity and Access Management + Privileged Access + MFA + Zero Trust + Just-In-Time + Banking Customer Authentication + Risk-Based Authentication + Out-of-Band + Biometric + FIDO2 + Internet Banking Security →
Kuwait National Cybersecurity Framework1 control

Kuwait NCF Protect function (Infrastructure). Network Security and Segmentation: defense in depth + perimeter (firewall + WAF + DDoS mitigation) + internal segmentation (microsegmentation + VLAN + zero-trust network access ZTNA) + east-west traffic inspection...

KNCF-Protect-Network-Configuration-Vulnerability-Physical-Secure-SDLC-Hardening-Patching-Drift · Kuwait NCF Protect + Network + Configuration + Vulnerability + Physical + Secure SDLC →

Questions people ask about microsegmentation

What is Microsegmentation?
A network security technique that enables fine-grained security policies to be assigned to individual workloads or applications, limiting lateral movement within a data centre or cloud environment.
Why is Microsegmentation important for compliance?
Microsegmentation is a key concept in Information Security. Understanding microsegmentation helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Microsegmentation?
Microsegmentation appears in the requirement text of MITRE D3FEND, ISMAP (Japan), ITU-T X.805 - Security Architecture for End-to-End Communications, IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2), Japan FSA Cybersecurity Guidelines for Financial Institutions. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Microsegmentation?
Explore our compliance framework pages to see how microsegmentation applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Microsegmentation applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.