NIST SP 800-215 Guide to a Secure Enterprise Network Landscape
Section 5: Enterprise-wide network security framework, zero trust network access – NIST SP 800-215 Guide to a Secure Enterprise Network Landscape

NIST SP 800-215 Guide to a Secure Enterprise Network Landscape 5.1.2: Implement microsegmentation with an approach that fits the environment, preferring identity-based policies

What does 5.1.2 require?

Microsegmentation is implemented through virtualised server approaches in the hypervisor (virtual firewalls or encapsulated overlays such as VXLAN with policy enforced outside the workload), host-based agents using native host firewalls across data centre, cloud, bare metal and hybrid environments, or identity-based policies that name which services may call which, enforced by mutual authentication and authorisation on every request. Identity-based policies are environment-agnostic, testable by exercising the application, expressible as policy as code in pipelines, and give fine-grained control of north-south and east-west traffic; segment-based approaches using VLANs and address rules are understood to carry a heavy mapping and change-management burden.

Maintained by Gerard Blokdyk

Other controls in Section 5: Enterprise-wide network security framework, zero trust network access – NIST SP 800-215 Guide to a Secure Enterprise Network Landscape

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-215 Guide to a Secure Enterprise Network Landscape controls