Network Segmentation Assessment Guide

This guide explains how a network segmentation assessment helps identify whether appropriate trust boundaries are in place to reduce lateral movement and contain risk.

Book an assessment
Method
How it works
FAQ

What is a Network Segmentation Assessment?

A Network Segmentation Assessment reviews how an organisation separates users, devices, applications and workloads into distinct trust zones and controls traffic between them. It examines logical and physical segmentation, traffic flows, dependencies, exceptions and enforcement points.

Who it’s for

Organisations protecting sensitive systems, implementing Zero Trust, meeting compliance requirements, separating operational technology or guest networks, and reducing the impact of a compromised account, device or workload.

Common use cases

Corporate, guest & BYOD networks Separate access zones for employees, visitors, personal devices and unmanaged endpoints
Application & database tiers Segmentation between web, application, database and management components
IT & OT environments Boundaries between enterprise IT and manufacturing, industrial or operational technology
PCI & regulated zones Isolated network areas containing payment, healthcare or other compliance-sensitive systems
IoT & unmanaged devices Restricted segments for printers, cameras, sensors and other non-user endpoints
Multi-tenant private cloud Network isolation between business units, customers, environments or workloads sharing infrastructure

Why Organisations Perform Network Segmentation Reviews

Reduce unnecessary network trust and confirm segmentation supports security, control and operational requirements.

Reduce Lateral Movement

Limit how far a compromised user, device or workload can move through the network.

Isolate Critical Systems

Separate sensitive applications, infrastructure and regulated environments from broader network access.

Review Trust Boundaries

Confirm security zones match real business, application and device trust requirements.

Improve Policy Enforcement

Make segmentation rules more consistent, explicit and maintainable across enforcement points.

Support Zero Trust

Use segmentation to enforce least privilege and reduce implicit trust across the network.

Identify Segmentation Gaps

Find flat areas, unmanaged paths and exceptions that weaken the intended segmentation model.

Common Network Segmentation Challenges

Network segmentation assessments commonly identify internal access, zoning and visibility issues that can affect control between users, systems and workloads.

Flat Network Architecture

Large numbers of users, devices and workloads may share broad segments with few controls separating different systems.

Excessive Lateral Access

Systems may communicate with more internal resources than necessary, creating multiple routes through the environment.

Poorly Defined Trust Zones

Security zones may not reflect current applications, data sensitivity, user groups or business functions.

Inconsistent Segmentation Policies

Firewall rules, ACLs and segmentation controls may differ between sites or platforms, leading to access gaps.

Legacy VLAN Structures

VLANs based on historical location or operational needs may no longer provide meaningful security separation.

Limited East-West Visibility

Insufficient internal traffic monitoring can limit understanding of workload communication and unnecessary flows.

Network Segmentation Assessment

What We Assess

We assess six key areas covering segmentation architecture, traffic, identity, applications and data, enforcement controls and governance.

Our Assessment Scope

We review the core areas that show whether segmentation reflects current business risk and limits unnecessary lateral movement.

01

Network Architecture & Trust Zones

  • VLANs, VRFs and firewall zones
  • User and server network separation
  • Guest, IoT and management networks
02

Traffic Between Segments

  • Required application flows
  • East-west communication paths
  • Unnecessary, broad or legacy connectivity
03

Identity & Access Policy

  • User and device identity
  • Role-based access controls
  • NAC and policy decisions
04

Applications & Data

  • Business-critical applications
  • Databases and sensitive data
  • Regulated systems and management infrastructure
05

Enforcement Points

  • Switch and firewall policy
  • NAC enforcement controls
  • Microsegmentation or cloud controls
06

Operations & Governance

  • Rule ownership and exceptions
  • Change control processes
  • Monitoring and policy review
Assessment Outcome

The assessment shows where segmentation is too broad, outdated or inconsistently enforced, and defines the changes needed to strengthen trust boundaries.

Network Segmentation: Assessment Approaches

Choose the approach based on current segmentation design, policy maturity and visibility of dependencies.

01
Approach

Architecture Review

Best suited to

Organisations assessing separation across VLANs, zones, routing boundaries and enforcement points.

Advantages
  • Clarifies the segmentation structure
  • Supports a cleaner target architecture
Considerations

Documentation may differ from real routing and enforcement paths.

02
Approach

Traffic Flow Analysis

Best suited to

Environments with poorly documented dependencies and disruption risk from segmentation changes.

Advantages
  • Shows which systems communicate
  • Supports policy based on observed dependencies
Considerations

Short-lived traffic and encryption can limit visibility.

03
Approach

Policy Assessment

Best suited to

Networks with existing segmentation controls needing policy scope and consistency review.

Advantages
  • Identifies overly broad rules
  • Helps tighten controls safely
Considerations

Unclear ownership and dependencies can make cleanup disruptive.

04
Approach

Zero Trust Segmentation Assessment

Best suited to

Organisations moving toward Zero Trust with context-driven segmentation beyond network location.

Advantages
  • Assesses support for granular access boundaries
  • Identifies capabilities for phased segmentation
Considerations

Granular controls increase management complexity and need mature operations.

How Our Network Segmentation Assessment Guide Works

The assessment follows a structured six-stage process, from scope and network mapping through gap assessment and a phased segmentation plan.

Stage 01 Discovery & Scope

Together, we define the applications, users, devices and network areas in scope, including critical assets and operational requirements. This sets the assessment around the systems and services where stronger separation matters most.

Assessment Checklist

Before the assessment begins, we will ask you to provide the network information, documentation and data needed for the review.

Network Topology

Provide current logical and physical network diagrams showing sites, switching, routing, security zones, major subnets and key environment paths.

Segmentation Design

Supply documentation of the current segmentation model, including security zones, trust boundaries, segmentation controls and any intentionally flat areas.

VLAN & VRF Information

Provide current VLAN, subnet, VRF and routing information so logical separation and permitted connectivity can be mapped accurately.

Firewall & ACL Policies

Supply firewall rules, ACLs and other segmentation policy controls, including documented rule ownership, exceptions and temporary access.

Application Traffic Requirements

Document critical application and service communication requirements, including source, destination, protocol, port, direction and business purpose where known.

Traffic Flow Data

Provide available flow, firewall, packet or telemetry data showing actual communication patterns across the environment in scope.

Our Network Segmentation Assessment Best Practices

These principles guide how we assess segmentation boundaries, access paths and policy visibility against current risk, design and business requirements.

Start with Business Risk

We establish application criticality, data sensitivity, user role and threat impact before assessing whether existing segmentation reflects real business risk.

Review Trust Zone Definitions

We review trusted, restricted, user, server, management, IoT and other zones to determine whether ownership, purpose and permitted communication are clearly defined.

Assess Inter-Segment Access

We assess traffic allowed between segments and identify broad or unnecessary access that gives users, devices or workloads more reachability than required.

Review East-West Controls

We review lateral traffic and enforcement between workloads and zones, not only internet-facing paths, to identify where internal movement is insufficiently controlled.

Examine Monitoring & Exceptions

We examine policy changes, exceptions, blocked traffic and available visibility to determine whether segmentation drift or unexpected communication can be detected.

Check Segmentation Currency

We compare segmentation policy with current applications, network design and business requirements so recommendations account for outdated trust boundaries.

Assessment Deliverables

Following the assessment, you receive documented analysis, gap findings and prioritised next steps for strengthening network segmentation and isolation controls.

Assessment Output

Segmentation Assessment

A detailed review of existing zones, VLANs, VRFs, firewalls, access policies, trust boundaries and other segmentation controls across the in-scope environment.

Assessment Output

Traffic & Policy Analysis

An analysis of permitted traffic flows, dependencies and policy behaviour between users, applications, devices and network zones, highlighting overly broad connectivity.

Assessment Output

Segmentation Gap Analysis

A structured comparison between the current segmentation model and the boundaries required by business risk, workload sensitivity and security objectives.

Assessment Output

Remediation Roadmap

A phased plan for introducing or strengthening segmentation, covering policy clean-up, new trust boundaries, traffic-control changes and implementation priorities.

Why Choose Steel City Consulting for Network Segmentation Assessments

We work with IT teams assessing complex network environments where segmentation, security, resilience and operational requirements need to be clearly understood before defining practical next steps.

  • Independent multi-vendor expertise Assess requirements across complex, multi-vendor infrastructure environments.
  • Decades of IT expertise Practical consultancy across architecture, deployment, optimisation and modernisation.
  • Assessment through implementation Move from findings into remediation, design and infrastructure deployment.

Network Segmentation Assessment

Discuss Your Network Segmentation Assessment

Tell us about your current environment, the issues you want to assess and any planned changes or projects. We’ll discuss the scope of the assessment and what you need it to establish.

From Assessment Findings to Action

Where the assessment identifies gaps or improvement opportunities, Steel City Consulting can support the next stage, from remediation and infrastructure design through to implementation and ongoing optimisation.

Remediation & Optimisation

Address performance, capacity, resilience, configuration and lifecycle issues.

Architecture & Design

Turn findings into a practical target architecture and prioritised plan.

Technology & Implementation

Select, size and implement infrastructure required to address identified needs.

Ongoing Optimisation & Lifecycle

Validate improvements and support future capacity, lifecycle and modernisation needs.

Planning a network segmentation assessment?

Speak to our consultants about your current environment, segmentation requirements and what you need the assessment to establish.

Speak to a specialist today

Related Technology Guides

Segmentation findings connect network security, Zero Trust, NAC and policy enforcement; these guides cover the main architecture and implementation considerations around those controls.

Campus Networking Architecture & Design Guide

Understand how switching, wireless, segmentation, resilience and management are combined into a secure enterprise campus design.

Read the guide

Network Observability Architecture & Design Guide

Understand how network telemetry, performance and security events are collected to provide ongoing operational visibility.

Read the guide

Zero Trust Security Implementation Guide

Review how Zero Trust controls are phased into real environments across identity, access, segmentation, devices and applications.

Read the guide

Network Access Control (NAC) Implementation Guide

Explore how identity, device profiling, authentication and policy enforcement are implemented across wired and wireless access networks.

Read the guide

Related Solutions

Segmentation findings can be implemented through campus networking, secure access, switching and firewall controls.

Campus Networking Solutions

Turn assessment findings into a campus network design covering switching, wireless, segmentation, resilience and management across user and device access environments.

Build Your Campus Network ›

Zero Trust & Secure Access

Strengthen identity-aware access, least privilege, device trust and policy enforcement where the assessment identifies excessive trust or inconsistent access controls.

Strengthen Secure Access ›

Network Switches

Refresh, expand or reconfigure switching infrastructure to address capacity, resilience, segmentation, performance or lifecycle findings from the assessment.

Explore Network Switches ›

Firewalls

Modernise or reconfigure firewall platforms and policies to address segmentation, access-control, exposure and lifecycle issues identified during the security assessment.

Explore Firewalls ›

Network Segmentation Assessment Guide FAQ

When should we assess network segmentation?

A segmentation assessment is useful when the network has grown, systems have changed or you need to limit access between users, devices and services.

It can help after acquisitions, cloud adoption or new IoT and operational technology connections. We examine actual communication needs and existing controls, helping design changes that reduce risk without blocking legitimate business traffic.

Does our network segmentation limit how far an attacker can move after a breach?

We assess whether segmentation rules restrict access between compromised systems and other network areas, limiting how far attackers can move.

The review examines zones, policies and enforcement points against real communication paths. It identifies where broad access or exceptions could allow a compromise to spread and where controls may need testing or refinement.

Are our network zones too broad for the way the business now operates?

We compare existing zones with current users, devices, applications and risk requirements to identify where boundaries may be too broad.

Business changes can leave zones grouping systems with different access needs. We look for places where tighter separation could reduce exposure while preserving the connections required for daily operations and essential services.

Which systems need to communicate across network segments, and why?

We map required communication between systems and services, then distinguish necessary traffic from access that lacks a clear business purpose.

The analysis considers application dependencies, users and operational processes before recommending restrictions. This reduces the risk of blocking valid traffic and gives teams a documented basis for segmentation rules and policy reviews.

Can our switches, firewalls and network access control (NAC) tools enforce the segmentation we need?

We assess whether current switches, firewalls and network access control tools can apply the required policies across the relevant connections.

The answer depends on product capabilities, configuration, topology and how devices are identified. We identify technology or design gaps that could affect enforcement, helping your team plan compatible changes rather than assume the current estate can support them.

How should we segment IoT, operational technology and regulated systems?

We consider the risk, availability and communication needs of IoT, operational technology and regulated systems when recommending network boundaries in business environments.

These systems may have different security requirements, support constraints and tolerance for change. We map their dependencies and access paths so controls can be planned around operational safety and compliance obligations.

How do we improve segmentation without breaking business applications?

We document application dependencies, validate proposed rules and plan changes in stages to reduce the risk of disrupting legitimate business traffic.

The assessment identifies required connections and exceptions before controls are changed. Your team can test policies with affected service owners, schedule implementation and monitor results, making adjustments where actual traffic differs from documentation.

Will the assessment disrupt live services, and what happens during it?

Most segmentation reviews use existing configurations, traffic flows and network documentation, so access policies can remain unchanged during assessment and analysis.

We agree the information and access required with your team. Any validation or policy testing that could affect connectivity is planned with service owners and carried out only after timing and safeguards are agreed.

What will we be able to decide once the assessment is complete?

You will have a recommended segmentation approach, identified policy gaps and a prioritised plan for phased implementation, testing and validation.

The findings show which boundaries should be tightened, what dependencies must remain and which technology changes may be required. This supports a phased design and implementation plan that balances reduced access with service continuity.

Can Steel City Consulting help us act on the findings?

Yes, we can help design segmentation policies, assess supporting technology, implement agreed changes and review the controls as your network evolves.

We can work with your team to turn the assessment into a staged project, coordinating policy design with application owners and network operations. Discuss your segmentation requirements with our team to plan a safe next step.

Can’t find what you’re looking for? We have more products available - just reach out to us directly! Found a better price elsewhere? Let us know - we’re happy to discuss price matching.