Application Ringfencing

Application Ringfencing implements application-focused segmentation policy that restricts communications to only those dependencies required for an application to operate. The package represents the customer's entry into the Segmentation phase of the Illumio journey, following the visibility and containment outcomes established by earlier packages.

For each in-scope application, Illumio Professional Services analyzes observed inbound and outbound communications, validates required dependencies with application owners through an attestation process, and develops segmentation policy reflecting the approved communication requirements. By reducing unnecessary communication paths, customers improve security posture, limit lateral movement opportunities, and establish a repeatable methodology for securing additional applications.

The engagement is delivered as a repeatable motion performed for up to five applications, concluding with a segmentation reference guide and as-built policy record that document the methodology, governance model, and change-management path the customer can follow to continue ringfencing additional applications independently.

The intended outcome is implemented draft ringfencing policy for the approved applications and a documented, repeatable segmentation methodology the customer can apply across the remaining application portfolio.

Package Dependencies  

• Segmentation Strategy & Roadmap
• Platform Foundation Deployment
• Labeling Discovery
• Basic Policy – Core Services + Ransomware  

Technical and Data Readiness

• Operational Illumio platform
• Visibility data available for the in-scope applications
• Application labels established for the approved in-scope applications
• Required IP Lists and Unmanaged Workloads created
• Core-services policy framework established
• Defined application boundaries
• Appropriate application-owner participation  

Customer Readiness  

• Designated project sponsor
• Technical point of contact
• Application owners identified for in-scope applications
• Available application-support teams
• Approval authority for policy implementation
• Defined change-management process for future provisioning and enforcement

Application Analysis (up to 5 applications)

• Review observed inbound communications for each in-scope application.
• Review observed outbound communications for each in-scope application.
• Identify application dependencies and supporting infrastructure relationships.
• Validate application boundaries and workload membership.
• Identify communications requiring additional customer classification.
• Document segmentation considerations specific to each application.

Customer Outcome

Customer receives a documented view of each in-scope application's communication profile and the dependencies that will shape its segmentation policy.

Application Attestation (up to 5 applications)

• Prepare application communication findings for application-owner review.
• Conduct attestation with application owners to validate required communications.
• Validate business requirements and expected dependencies.
• Review and document proposed exceptions.
• Record approved communication requirements used to guide policy development.

Customer Outcome

Customer application owners formally validate required communications, providing an approved basis for segmentation policy and reducing the risk of operational impact.

Ringfencing Policy Development and Implementation (up to 5 applications)

• Develop ringfencing policy architecture for each approved application.
• Define permitted and restricted communications based on attested requirements.
• Create ringfencing policy in draft mode within the PCE.
• Organize policy hierarchy, rule structure, and associated policy objects.
• Document policy-design decisions and approved exceptions.
• Produce application-specific policy documentation for each in-scope application.

Customer Outcome

Customer receives implemented draft segmentation policy for up to five applications, aligned to attested communication requirements and ready for customer-led review and provisioning.

Segmentation Methodology and Operationalization Handoff

• Document the ringfencing methodology used during the engagement, including analysis, attestation, policy development, and policy implementation.
• Provide a segmentation reference guide describing application onboarding, dependency validation, and policy-development practices.
• Document the recommended draft-to-provision workflow, including validation steps and change-management considerations.
• Document enforcement-planning considerations and exception-management guidance.
• Provide an as-built policy record covering implemented applications, policy hierarchy, rule organization, associated objects, and approved exceptions.
• Document future application-onboarding guidance, operational ownership recommendations, and policy-maintenance practices.
• Review the methodology, reference guide, and as-built record with customer stakeholders.

Customer Outcome

Customer receives a documented, repeatable segmentation methodology, change-management guidance, and an as-built policy record enabling continued ringfencing of additional applications after Professional Services disengagement.

The delivery schedule will be established at project initiation based on:

• Purchased package quantity
• Number of in-scope applications
• Application complexity
• Dependency volume
• Stakeholder availability
• Customer review cycles
• Policy-validation requirements.

Delays in application-owner validation, change approvals, or dependency confirmation may impact schedule.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services