--- title: "Has the Applicant applied network segmentation within its environment?" url: https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment category: "Network, logging and monitoring" canonical_key: q_net_003 evidence_state: partial updated: 2026-08-24 --- # Has the Applicant applied network segmentation within its environment? URL: https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant Segmentation is the control that decides whether one compromised laptop becomes an incident or an outage. ## What the carrier is actually asking The carrier is asking whether the network is divided into zones with filtering between them, so that reaching one part does not grant access to all of it. It expects separation of user devices from servers, of critical systems from general ones, and of anything untrusted from everything else. ## Why it is underwritten Ransomware operators move laterally to reach the systems whose encryption forces payment: file servers, databases, virtualisation hosts, and backups. Segmentation is what makes that journey slow and visible. Carriers see the difference in claim severity clearly enough to ask about it in several forms. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Cloud segmentation is measurable. On-premises segmentation needs evidence from the network itself, and the meaningful test is whether filtering exists between zones rather than whether VLANs exist. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Virtual network and subnet topology with network security group rules between subnets | Filtering between tiers, not merely separate address ranges | | Azure | Private endpoints and disabled public access on data services | Data tier reachable only from the application tier that needs it | | Azure | Peering topology and whether it is transitive | Peered networks that do not grant unintended reachability across the estate | | On-premises | VLANs and the access control lists between them | Filtering between VLANs. VLANs with unrestricted routing are addressing, not segmentation. Attested | | Any | Backup and management networks | Separated from production, since those are the two an attacker most wants to reach | **VLANs without filtering are not segmentation** Most estates that answer yes have VLANs and a router that permits everything between them. The question is about restriction, and the test is simple: can a workstation open an arbitrary port on a server in another zone. If yes, the segmentation is nominal. ## What a defensible yes requires - Zones exist and filtering between them is enforced rather than nominal. - User devices cannot reach server management interfaces directly. - Backup and management infrastructure is separated from production. - Cloud data services are reachable only from the tiers that need them. - The separation has been tested from a user device, not only reviewed in a diagram. ## How this answer goes wrong The network diagram shows tidy segments and the firewall rules between them permit any-to-any because an application needed it once. Testing from a workstation reveals that most of the server estate is directly reachable, which is what an attacker will discover in their first hour. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What level of segmentation do carriers expect? At minimum, separation of user devices from servers and isolation of critical systems including backups. Full micro-segmentation is a bonus rather than an expectation. ### Does cloud need segmentation too? Yes, and it is easier there. Subnets with network security groups and private endpoints deliver it without hardware. ### How do we prove it? Test from a user device toward a server zone and record the result. That test is more convincing than any diagram. ### What about identity-based segmentation? Conditional Access and device compliance are a legitimate modern answer for cloud-first estates. Describe it as such rather than answering no because there are no VLANs. ## Related questions - [Does the Applicant employ external/perimeter and internal firewalls?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-external-perimeter-internal-firewalls) - [Is workstation-to-workstation communication restricted (e.g. RDP between user workstations)?](https://insuranceposture.com/questions/network-and-logging/workstation-workstation-communication-restricted) - [Is inbound and outbound traffic to critical servers restricted using an allow-list approach?](https://insuranceposture.com/questions/network-and-logging/inbound-outbound-traffic-critical-servers-restricted-using-allow-list) - [Are wireless connections from untrusted devices allowed, and if so, are they on a separate network?](https://insuranceposture.com/questions/access-control/wireless-connections-from-untrusted-devices-allowed-they-separate-network) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.