Network segregation
Network segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another. In Cyber Essentials it is how you create a sub-set to leave part of the network out of scope, and the only accepted methods are a firewall or a VLAN (A2.2.2).
- Term
- Network segregation
- Also known as
- Network segmentation, Network separation
- Category
- Networks and firewalls
- Requirement area
- B. Definitions; D. Scope
- Reviewed against
- Requirements v3.3
What does the term network segregation mean in Cyber Essentials?
Network segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
A sub-set is part of the organisation whose network is segregated from the rest of the organisation by a firewall or VLAN
How does network segregation apply to Cyber Essentials?
In plain terms
Segregation is like fitting internal doors that lock between departments. If a burglar gets into reception, they cannot walk straight into the finance office. On a network, it means a problem on one part, such as an old machine that cannot be updated, cannot spread easily to the rest.
What Cyber Essentials asks
The scheme uses segregation to define a sub-set, in the definition quoted above. A sub-set can be used "to define what is in scope or what is out of scope", and where part of the infrastructure is excluded "you will need to justify the reason for a partial scope to your assessor".
The questions that apply:
- A2.1: whole or partial organisation.
- A2.2.1 and A2.2.2: describe the excluded networks and how they are separated. The A2.2.2 guidance says "other methods such as security groups, microsegmentation or software-based methods are not compliant".
- A2.5.1: list the routers, physical firewalls or virtual firewalls used to create sub-sets. Software firewalls built into operating systems, such as Windows Firewall, "cannot be used to define the boundary of the scope".
- A6.7: unsupported software you must keep goes onto "its own sub-set with no internet access".
Common mistakes
- Using user permissions or security groups and calling it segregation.
- Segregating unsupported software but leaving it internet access. The requirements say the sub-set must prevent "all traffic to/from the internet".
- Forgetting that end user devices and cloud services cannot be excluded.
See what is in scope and A2.2.2. Related: VLAN, DMZ, sub-set.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
- DMZ (demilitarised zone)A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
- Outbound connectionAn outbound connection is a connection that one of your own devices starts towards something on the internet, such as a laptop opening a website.
- Port (network port)A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.
- Port forwardingPort forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
Frequently asked questions
Network segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, network segregation comes up at A2.1, A2.2.1, A2.2.2, A2.5.1, A6.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Network segregation relates to B. Definitions; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.