NIS2
How to Use Zero Trust for NIS2 Network Segmentation
NIS2 network segmentation means splitting your network so devices only talk to the parts they need, in line with zero-trust thinking. Start by assuming the network is hostile, divide it by IP ranges, then go finer with micro-segmentation where exposure matters most, and test each step before rollout.
What do you need before you start with network segmentation?
Before you segment anything, you need a clear picture of your network, an idea of which functions, applications and user groups belong together, and a safe place to test changes. The NIS2 Navigator’s Handbook by Michiel Benda helps here, because it frames segmentation as part of the basic cyber hygiene NIS2 expects under article 21(2g).
Gather these items first:
- An overview of your current network, including existing IP ranges and what each one is used for.
- A list of your applications, functional user groups and critical resources, because micro-segments are built around them.
- If you run operational technology, a view of your OT environment and how it connects to IT.
- A separate test environment, or the capacity to monitor new segments closely.
- The handbook itself, in particular section 4.7.3.10 on network segmentation and micro-segmentation.
The handbook explains principles and challenges, but it does not give VLAN configurations, firewall rules or product names. Involve your network engineers for that part.
Result: an inventory you can segment from.
Why should you assume your network is insecure?
Because zero trust means no trust is built between two interacting assets, so every action must establish trust before it is permitted. Treat your own network as potentially hostile, and let that assumption justify every boundary you draw. The handbook names network segmentation as a suitable response to this principle.
Section 4.7.3.1 on zero-trust principles puts it plainly: you should “always expect that there are some elements that are insufficiently secure and potentially hostile.” This holds even when you are working inside your own network.
That changes how you design. You no longer segment to tick a box, because each boundary exists to limit what a compromised element can reach.
Result: a clear rationale for the segments you are about to create.
How do you segment a network by IP address ranges?
Separate your network into segments by IP address range, one per purpose. Many organizations already use different ranges for different purposes, so begin with what exists and make the boundaries enforceable. The result of this step is a segmented network where each device group can only reach the parts it needs.
The handbook notes that “many organizations have designed their network to have different IP ranges for different purposes.” Typical segments it lists are:
- a printer segment and a workstation segment
- a voice communications segment and a surveillance segment
- an Internet-of-Things segment
- a server segment, plus segments for each critical server
If you run an OT environment, the handbook recommends one or more OT segments that are fully separated from the IT environment, including an Industrial Demilitarized Zone (IDMZ).
Keep one caution in mind. Locations can be spoofed, so rules based on IP addresses are no longer reliable on their own. The handbook suggests adding further verification, for example through network access control (NAC) mechanisms.
Result: a first layer of separation that limits the spread of malware.
When do you need micro-segmentation instead?
Move to micro-segmentation when you want to limit exposure more tightly than IP-range segments allow. Segments become as small as possible, holding only what a specific function needs. The handbook says it potentially offers greater protection and also works in cloud and OT environments.
In the handbook’s words, the focus lies on “exposure limitations” and the segments are therefore “as small as possible, limiting the contents of each segment to what is immediately needed for a specific function or activity.” Examples are segments for each application, for each functional grouping of users, and for each critical resource.
| Aspect | Network segmentation | Micro-segmentation |
|---|---|---|
| Basis | IP address ranges | A specific function or activity |
| Typical segments | Printers, workstations, servers, IoT, voice, surveillance | Each application, user group or critical resource |
| Protection | Significant benefits | Potentially greater protection |
| Effort | Familiar in many organizations | More complex and more resource-intensive, especially at first |
In OT, micro-segmentation is possible, but the configurations are more complex and sensitive. Most OT environments were not designed for secure segmentation, so prioritize carefully.
Result: a shortlist of the applications, user groups and resources that deserve their own micro-segment.
What challenges should you plan for with micro-segmentation?
Plan for three challenges: infrastructure adaptation, process optimization and integration with existing tools. Micro-segmentation may need network updates and new technology, is more resource-intensive than traditional segmentation, and can cause compatibility issues. Your outcome for this step is a list of risks with an owner for each.
- Infrastructure adaptation: your network may need updates, and you may have to invest in new technology to support the segmented architecture.
- Process optimization: setting up and maintaining micro-segments is more complex than traditional segmentation, so you must re-evaluate and optimize your network and security processes.
- Integration with existing tools: expect compatibility issues and configuration changes before operation and management run smoothly.
During design, consider carefully how the components inside a micro-segment interact with those outside it. The handbook recommends thorough testing in a separate test environment. Where that is difficult, monitor the new segments extensively so you avoid disruption to business processes and can respond quickly to issues.
The handbook names these challenges but gives no cost indications and no migration timeline. You will need to estimate effort and budget for your own situation.
Result: a tested, monitored rollout instead of a surprise outage.
How does segmentation fit with the other zero-trust principles?
Segmentation answers one of five core zero-trust principles, so it works best alongside the other four: assume breach, do not trust location alone, verify identities strongly and just-in-time, and monitor across the environment. Together they turn separate network zones into a coherent zero-trust posture.
The handbook links each principle to supporting measures:
- Assume breach: network and information systems monitoring, plus practiced and mature incident handling.
- Location is not enough: network access control (NAC) for further verification before access is granted.
- Strong, just-in-time identity verification: privileged access management, multi-factor authentication and continuous authentication based on least-privilege access.
- Monitor and respond dynamically: detection and response systems (EDR, NDR, XDR), SIEM and SOAR, fed with data from networks, systems, end points and cloud environments.
Segmentation limits where an attacker can go. These other measures help you notice that an attacker is there and make sure only verified identities get in.
Result: segmentation embedded in a wider zero-trust approach rather than a stand-alone project.
How do you check where you stand?
Use the handbook’s GAP assessment as your checkpoint. Network segmentation has its own entry, F.12, in section 6 of the book, so you can compare your current segmentation with what NIS2 compliance expects. Repeat the check after each step, since your segments, tools and processes will change during rollout.
Combine the assessment with your inventory and your risk list from the earlier steps. The gaps you find show where to segment next, and where an existing segment still allows more access than its function needs.
Result: a documented view of your segmentation maturity and the next improvement to tackle.
Start broad, then go fine
Segment by IP range first, add micro-segmentation where exposure matters most, and always test or closely monitor new segments before you rely on them.
Ways to learn this standard
Frequently asked questions
It leaves out concrete technical examples, a migration plan with timelines and any cost indications. You will not find specific VLAN configurations, firewall rules or product names. What it does give is the principles, the two segmentation approaches, and the main challenges, so you must translate these into your own architecture with your network engineers.
Not necessarily, because the handbook presents it as the finer of two ways to segment rather than the only route. Network segmentation by IP address range is the other. Micro-segmentation potentially offers greater protection, but it is also more resource-intensive, so choose it where limiting exposure matters most and your organization can carry the effort.
Only a part of it. The handbook treats segmentation as one concrete way to apply the zero-trust principles that NIS2 expects as basic cyber hygiene under article 21(2g). Other measures from article 21(2) still apply, such as monitoring, incident handling and strong authentication, so segmentation is one building block of compliance, not the whole of it.
Start with section 4.7.3.10, which covers network segmentation and micro-segmentation, then read the zero-trust principles in section 4.7.3.1. Section 6 contains the GAP assessment, where network segmentation appears as F.12. The NIS2 Navigator’s Handbook by Michiel Benda is available through Van Haren, and the NIS2 standard page gives the wider context.
