A company can have a solid perimeter firewall and still be far from meeting the cybersecurity requirements set out in NIS2. The European directive requires affected entities to manage risk through technical, operational, and organizational measures that include business continuity, access control, vulnerability management, and communications security. Network segmentation fits into that model as a particularly useful measure to prevent an initial intrusion from spreading across the entire organization.
NIS2 and network segmentation: the key points in 30 seconds
- NIS2 requires affected entities to adopt risk management measures proportionate to their circumstances and exposure.
- The directive does not literally state that every company must implement a specific segmentation architecture.
- It does require protecting networks and systems and managing incidents, vulnerabilities, access, and business continuity.
- Separating users, servers, guests, administration, and critical systems limits an attacker’s lateral movement.
- Firewalls, VPNs, and segmentation should all be part of a broader security architecture.
The distinction matters. Presenting segmentation as a literal, universal NIS2 obligation would oversimplify the regulation. Directive (EU) 2022/2555 sets out objectives and categories of security measures, while their specific implementation depends on each entity’s risk, size, costs, exposure, and the importance of its systems.
But it’s also hard to justify a completely flat network when an organization manages critical systems, external vendors, employee devices, cloud services, and remote access.
NIS2 doesn’t say which firewall to buy, but it does say which risks to control
Article 21 of NIS2 is one of the main points for understanding what’s changing.
Affected essential and important entities must adopt appropriate and proportionate technical, operational, and organizational measures to manage the risks posed to the security of their network and information systems.
The regulation lists a number of areas that must be covered.
These include risk analysis and security policies, incident handling, business continuity, backup and disaster recovery, supply chain security, secure system acquisition and maintenance, vulnerability management, evaluating the effectiveness of the measures adopted, basic cybersecurity hygiene, and training.
It also covers policies on cryptography, access control, asset management, and, where appropriate, multi-factor authentication or continuous authentication solutions.
So NIS2 cannot be reduced to installing a firewall or buying a particular security product.
The organization has to demonstrate that it understands its risks and has put in place reasonable controls to reduce both the likelihood of an incident and its consequences.
This is where segmentation comes in.
If an employee’s computer is compromised through phishing, the incident will look very different depending on whether that machine can freely communicate with servers, backups, admin interfaces, and databases, or whether barriers exist between those zones.
The first scenario gives an attacker far more opportunities to move laterally.
A flat network can turn one compromised device into a much bigger problem
For years, many corporate networks followed a relatively simple structure: the internet stayed outside and corporate systems stayed inside.
The firewall protected the border.
That model is increasingly out of step with how organizations actually work. Employees use laptops outside the office, SaaS applications, cloud storage, VPN connections, and mobile devices. At the same time, vendors and outside technicians may need access to certain systems.
The line between “inside” and “outside” is much blurrier now.
Segmentation aims to divide infrastructure into zones and define what communications are allowed between them.
A company might, for example, separate employee endpoints from production servers. Guest Wi-Fi should stay isolated from corporate resources. Management systems can sit in their own zone, and backups can carry specific restrictions.
Industrial environments, IoT (Internet of Things) devices, or especially sensitive systems may need even more separation.
VLANs can be part of that architecture, but creating several VLANs is not, by itself, the same as having effective security segmentation. It requires controlling traffic crossing the segments, defining policies, reviewing exceptions, and periodically checking that the rules still match actual needs.
This last point tends to become one of the biggest problems.
A network can be properly segmented when designed and end up practically flat years later. Every new application, server, or vendor introduces exceptions. If those rules pile up without review, the boundaries eventually stop being effective.
Firewalls, VPNs, and Wi-Fi are also part of the problem
The firewall is still necessary. What’s changing is the expectation of what it can solve on its own.
A firewall sitting between the internet and the organization controls one specific boundary. It doesn’t necessarily stop an already-compromised computer from attacking another system in the same trust zone.
That’s why firewalls can also be used internally to control communications between different segments.
The capabilities needed will depend on each organization. In some scenarios, well-maintained network rules will be enough. In others, next-generation firewalls capable of factoring in application, user, and traffic-content information may be used.
Remote access needs a similar assessment.
A virtual private network (VPN) encrypts the communication between a remote device and corporate infrastructure, but a VPN doesn’t automatically make that device trustworthy. If the laptop is compromised, granting it unrestricted access to the whole network can hand an attacker an encrypted channel into internal systems.
Organizations can limit which resources are available depending on the user, device, or role.
Wi-Fi presents another common scenario. Employee and guest networks should stay separate when guests don’t need access to internal resources.
Authentication and encryption mechanisms also need to stay up to date. WPA3 brings improvements over earlier generations, though using a modern standard doesn’t replace a proper separation and control architecture either.
NIS2 also forces organizations to think about what happens after an incident.
Business continuity, disaster recovery, crisis management, and backups are explicitly among the areas covered by the directive.
This forces a shift from one question, “how do we keep them out?”, to another, equally necessary one: “what can happen if they get in?”
Segmentation helps precisely with that second part. It can reduce the number of systems reachable from a compromised device and make it harder for an attacker to reach admin infrastructure or backups.
It doesn’t eliminate risk, and it doesn’t replace identity controls, monitoring, vulnerability management, or isolated backups.
Security also depends on those measures actually being tested.
A recovery plan that has never been run can fail exactly when it’s needed. A backup that no one has restored doesn’t guarantee the data is actually recoverable. Segmentation that only exists on a diagram doesn’t prove that traffic is actually restricted either.
For companies affected by NIS2, that’s one of the relevant changes: cybersecurity can no longer be treated only as a perimeter barrier — it becomes part of ongoing enterprise risk management.
Frequently asked questions
Does NIS2 explicitly require network segmentation?
NIS2 requires appropriate and proportionate technical, operational, and organizational measures to manage security risks. It doesn’t mandate an identical segmentation architecture for every company, so the specific measures must be justified based on each organization’s risks.
Is having a firewall enough to comply with NIS2?
No. The directive covers risk and incident management, business continuity, supply chain, vulnerabilities, access control, training, cryptography, and other measures in addition to network protection.
What’s the point of segmenting a corporate network?
It separates systems with different trust levels and limits communication between them. If a device is compromised, properly applied segmentation can make it harder to move laterally toward servers, administrative systems, or backups.
Does a VPN guarantee secure remote access?
A VPN protects the communication itself, but it doesn’t guarantee that the connected device is secure or that it should have access to the entire infrastructure. It should be combined with proper authentication, access control, device updates, and restrictions on the resources available.
