Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Cybersecurity Architecture
  4. >Cybersecurity Architecture - Objective 2
  5. >C2M2-ARCHITECTURE-2K
C2M2-ARCHITECTURE-2KActive

Device connections to the network are controlled to ensure that only authorized devices can connect (for example, network access control (NAC))

Statement

Device connections to the network are controlled to ensure that only authorized devices can connect (for example, network access control (NAC))

Location

Domain
Cybersecurity Architecture
Objective
Cybersecurity Architecture - Objective 2

Practice Details

Identifier
C2M2-ARCHITECTURE-2K
Domain
Cybersecurity Architecture
Objective
Objective 2
Maturity Level
MIL-3

Help Text

Network connections should be controlled by the organization at the device level. This may be achieved through a solution like network access control that does not allow devices that do not meet specific security requirements to connect to the network.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ARCHITECTURE-2a, ARCHITECTURE-2c, ARCHITECTURE-2e, ARCHITECTURE-2f, ARCHITECTURE-2g, ARCHITECTURE-2k.

AESCSF
AESCSF-ARCHITECTURE-2kequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Cybersecurity Architecture - Objective 2
Cybersecurity Architecture - Objective 212 controls
C2M2-ARCHITECTURE-2ANetwork protections are implemented, at least in an ad hoc mannerC2M2-ARCHITECTURE-2BThe organization’s IT systems are separated from OT systems through segmentation, either through physical means or logical means, at least in an ad hoc mannerC2M2-ARCHITECTURE-2CNetwork protections are defined and enforced for selected asset types according to asset risk and priority (for example, internal assets, perimeter assets, assets connected to the organization’s Wi-Fi, cloud assets, remote access, and externally owned devices)C2M2-ARCHITECTURE-2DAssets that are important to the delivery of the function are logically or physically segmented into distinct security zones based on asset cybersecurity requirementsC2M2-ARCHITECTURE-2ENetwork protections incorporate the principles of least privilege and least functionalityC2M2-ARCHITECTURE-2FNetwork protections include monitoring, analysis, and control of network traffic for selected security zones (for example, firewalls, allowlisting, intrusion detection and prevention systems (IDPS))C2M2-ARCHITECTURE-2GWeb traffic and email are monitored, analyzed, and controlled (for example, malicious link blocking, suspicious download blocking, email authentication techniques, IP address blocking)C2M2-ARCHITECTURE-2HAll assets are segmented into distinct security zones based on cybersecurity requirementsC2M2-ARCHITECTURE-2ISeparate networks are implemented, where warranted, that logically or physically segment assets into security zones with independent authenticationC2M2-ARCHITECTURE-2JOT systems are operationally independent from IT systems so that OT operations can be sustained during an outage of IT systemsC2M2-ARCHITECTURE-2KDevice connections to the network are controlled to ensure that only authorized devices can connect (for example, network access control (NAC))C2M2-ARCHITECTURE-2LThe cybersecurity architecture enables the isolation of compromised assets