Pillar 5: Network & Environment
Segment, isolate, and control the network environment with granular access and policy restrictions, replacing the flat, perimeter-trusted network.
Key principles
- No implicit trust based on network location — internal traffic is treated with the same scrutiny as external.
- Macro-segmentation gives way to software-defined micro-perimeters over time.
- Encrypted traffic is still subject to visibility and policy enforcement.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Perimeter firewall, flat internal network |
| Advanced | Macro-segmentation by zone/environment, TLS inspection at chokepoints |
| Optimal | Software-defined micro-perimeters per session; encrypted-traffic analytics without decryption |
Related capabilities
See Network Segmentation and Encrypted Traffic Inspection in the capability matrix.
Framework tie-ins
NIST 800-53 (SC family), NIST 800-207 §3.4, PCI-DSS v4.0 (Req. 1).
Capabilities in this pillar
Disaster Recovery & Resilience Architecture
Manual failover; infrequent DR testing
Automated failover with regular DR testing
Continuously validated, automated multi-region resilience with real-time failover
Encrypted Traffic Inspection
Limited visibility into encrypted traffic
TLS inspection at key chokepoints
Full encrypted-traffic analytics without decryption (metadata/ML-based)
Network Segmentation
Perimeter firewall, flat internal network
Macro-segmentation by zone/environment with internal firewalls
Software-defined micro-perimeters enforced per session, no implicit trust zones
Third-Party Network Connectivity Controls
Static VPN or leased-line trust for partners
Segmented, policy-scoped partner connectivity (ZTNA for B2B)
Dynamic, risk-based partner network access with continuous session verification