Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Cybersecurity Architecture
  4. >Cybersecurity Architecture - Objective 2
  5. >C2M2-ARCHITECTURE-2H
C2M2-ARCHITECTURE-2HActive

All assets are segmented into distinct security zones based on cybersecurity requirements

Statement

All assets are segmented into distinct security zones based on cybersecurity requirements

Location

Domain
Cybersecurity Architecture
Objective
Cybersecurity Architecture - Objective 2

Practice Details

Identifier
C2M2-ARCHITECTURE-2H
Domain
Cybersecurity Architecture
Objective
Objective 2
Maturity Level
MIL-3

Help Text

This practice expands on ARCHITECTURE-2d to include all assets. The practice goes on to note that the segmentation should be based on defined cybersecurity requirements. Criteria for creation of different security zones may be based on several factors. These are some examples of factors: · specific safety, reliability, and security requirements · importance of the asset to the function · the tasks performed by the asset · whether the asset is managed by a third party · who has access to the asset · whether remote access to the asset is enabled · the degree of trust associated with the asset · applying cybersecurity controls to groups of assets · limiting the impacts of potential cyber intrusions · the characteristics of the network (e.g., guest wireless network) Additionally, these criteria should be clearly documented in the cybersecurity architecture or in a similar document. This helps those not privy to the original decision-making process understand why each criterion is needed. For example, OT assets that have unique characteristics (e.g., those that depend on insecure legacy software or have high availability requirements) may require a specific cybersecurity architecture design to achieve the operational goals of the organization. Additionally, organizations should consider standards and guidelines when planning for segmentation. It is important to note, there are several ways to implement this practice including application of a zero trust model.

Related Practices · Input From: Implementing ARCHITECTURE-1f and ASSET-1f provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ARCHITECTURE-2b, ARCHITECTURE-2d, ARCHITECTURE-2h, ARCHITECTURE-2i, ARCHITECTURE-2j, ARCHITECTURE-2l.

AESCSF
AESCSF-ARCHITECTURE-2hequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Cybersecurity Architecture - Objective 2
Cybersecurity Architecture - Objective 212 controls
C2M2-ARCHITECTURE-2ANetwork protections are implemented, at least in an ad hoc mannerC2M2-ARCHITECTURE-2BThe organization’s IT systems are separated from OT systems through segmentation, either through physical means or logical means, at least in an ad hoc mannerC2M2-ARCHITECTURE-2CNetwork protections are defined and enforced for selected asset types according to asset risk and priority (for example, internal assets, perimeter assets, assets connected to the organization’s Wi-Fi, cloud assets, remote access, and externally owned devices)C2M2-ARCHITECTURE-2DAssets that are important to the delivery of the function are logically or physically segmented into distinct security zones based on asset cybersecurity requirementsC2M2-ARCHITECTURE-2ENetwork protections incorporate the principles of least privilege and least functionalityC2M2-ARCHITECTURE-2FNetwork protections include monitoring, analysis, and control of network traffic for selected security zones (for example, firewalls, allowlisting, intrusion detection and prevention systems (IDPS))C2M2-ARCHITECTURE-2GWeb traffic and email are monitored, analyzed, and controlled (for example, malicious link blocking, suspicious download blocking, email authentication techniques, IP address blocking)C2M2-ARCHITECTURE-2HAll assets are segmented into distinct security zones based on cybersecurity requirementsC2M2-ARCHITECTURE-2ISeparate networks are implemented, where warranted, that logically or physically segment assets into security zones with independent authenticationC2M2-ARCHITECTURE-2JOT systems are operationally independent from IT systems so that OT operations can be sustained during an outage of IT systemsC2M2-ARCHITECTURE-2KDevice connections to the network are controlled to ensure that only authorized devices can connect (for example, network access control (NAC))C2M2-ARCHITECTURE-2LThe cybersecurity architecture enables the isolation of compromised assets