Has the Applicant applied network segmentation within its environment?
Segmentation is the control that decides whether one compromised laptop becomes an incident or an outage.
What the carrier is actually asking
The carrier is asking whether the network is divided into zones with filtering between them, so that reaching one part does not grant access to all of it. It expects separation of user devices from servers, of critical systems from general ones, and of anything untrusted from everything else.
Why it is underwritten
Ransomware operators move laterally to reach the systems whose encryption forces payment: file servers, databases, virtualisation hosts, and backups. Segmentation is what makes that journey slow and visible. Carriers see the difference in claim severity clearly enough to ask about it in several forms.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Cloud segmentation is measurable. On-premises segmentation needs evidence from the network itself, and the meaningful test is whether filtering exists between zones rather than whether VLANs exist.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Virtual network and subnet topology with network security group rules between subnets | Filtering between tiers, not merely separate address ranges |
| Azure | Private endpoints and disabled public access on data services | Data tier reachable only from the application tier that needs it |
| Azure | Peering topology and whether it is transitive | Peered networks that do not grant unintended reachability across the estate |
| On-premises | VLANs and the access control lists between them | Filtering between VLANs. VLANs with unrestricted routing are addressing, not segmentation. Attested |
| Any | Backup and management networks | Separated from production, since those are the two an attacker most wants to reach |
Most estates that answer yes have VLANs and a router that permits everything between them. The question is about restriction, and the test is simple: can a workstation open an arbitrary port on a server in another zone. If yes, the segmentation is nominal.
What a defensible yes requires
- Zones exist and filtering between them is enforced rather than nominal.
- User devices cannot reach server management interfaces directly.
- Backup and management infrastructure is separated from production.
- Cloud data services are reachable only from the tiers that need them.
- The separation has been tested from a user device, not only reviewed in a diagram.
How this answer goes wrong
The network diagram shows tidy segments and the firewall rules between them permit any-to-any because an application needed it once. Testing from a workstation reveals that most of the server estate is directly reachable, which is what an attacker will discover in their first hour.
Frequently asked
What level of segmentation do carriers expect?
At minimum, separation of user devices from servers and isolation of critical systems including backups. Full micro-segmentation is a bonus rather than an expectation.
Does cloud need segmentation too?
Yes, and it is easier there. Subnets with network security groups and private endpoints deliver it without hardware.
How do we prove it?
Test from a user device toward a server zone and record the result. That test is more convincing than any diagram.
What about identity-based segmentation?
Conditional Access and device compliance are a legitimate modern answer for cloud-first estates. Describe it as such rather than answering no because there are no VLANs.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture