Compliance-Aligned Segmentation Strategy

The Basic Compliance-Aligned Segmentation Strategy add-on extends the Segmentation Strategy & Roadmap engagement so the resulting strategy also accounts for the customer's regulatory and compliance obligations.

Segmentation Strategy & Roadmap produces the customer's high-level segmentation strategy, environment diagram, target outcomes, and recommended order of operations. This add-on adds a compliance view to that same work. Illumio Professional Services identifies the segmentation-relevant intent of the customer's applicable compliance requirements, maps that intent to the segmentation strategy, and documents a recommended path for using segmentation to support those requirements.

The add-on covers DORA, PCI DSS, SWIFT, HIPPA,cyber-insurance requirements, and government security policy requirements.

The compliance strategy is delivered inside the same High-Level Design and Roadmap Document produced by Segmentation Strategy & Roadmap, so the customer gets one strategy document instead of a separate compliance deliverable.

The engagement is advisory. It maps segmentation strategy to compliance control intent. It is not an audit, certification, or attestation.

Package Dependencies

• Segmentation Strategy & Roadmap, which must be purchased and delivered with this add-on  
• This add-on may also be attached to the Containment Bundle or Segmentation Bundle, because both include Segmentation Strategy & Roadmap.  

Technical Readiness

• Environment, network, and security architecture information available through the Segmentation Strategy & Roadmap engagement
• Available inventory of systems, applications, and environments subject to compliance requirements
• Documentation of existing compliance-related security controls, where available  

Customer Readiness

• Applicable compliance frameworks or requirements identified by the customer
• Customer-provided regulatory standard, framework documentation, or requirement source
• Compliance stakeholders identified and available In-scope regulated systems and environments identified

Compliance Requirements Review

• Confirm the compliance frameworks and requirements in scope.
• Review customer-provided compliance standards, requirement sources, and existing compliance documentation.
• Identify the regulated systems, applications, data, and environments the requirements apply to.
• Review existing controls that support segmentation-related compliance objectives.
• Review how the customer interprets the applicable requirements.

Customer Outcome

The customer's segmentation-relevant compliance requirements, affected assets, and existing controls are documented in one view that can be used for strategic planning.

Control-Intent Mapping

• Identify the segmentation-relevant control intent within the applicable requirements.
• Map that control intent to segmentation boundaries, workload groups, and communication controls.
• Identify regulated environments that need specific segmentation treatment.
• Identify segmentation gaps that may affect how the customer's compliance objectives are supported.
• Record assumptions, dependencies, and areas that need customer compliance review.

Customer Outcome

The customer understands how segmentation can support the intent of its applicable compliance requirements, and which regulated environments need specific treatment.

Current Security and Network Posture Review

• Review existing firewall and security controls in place today.
• Review Windows Firewall and iptables usage.
• Review cloud-native security controls.
• Review internal east-west firewall controls.
• Review VLAN and network-based separation approaches.
• Review network design information.
• Review network mapping considerations such as NAT, MIP, load balancer, and accelerator configurations.
• Identify special circumstances such as legacy operating systems or constrained platforms.

Customer Outcome

Customer receives a documented view of current network and security posture, including architectural factors that will influence segmentation design and deployment sequencing.

Segmentation Strategy and Roadmap Development

• Develop the recommended order of operations for visibility, containment, and segmentation.
• Develop high-level segmentation architecture recommendations.
• Develop application-tiering recommendations based on available high-value application information.
• Define value milestones expected throughout the project.
• Define the recommended package sequence and ongoing high-level plan.
• Identify recommendations to avoid engagement slowdowns.
• Identify potential future roadblocks and recommended mitigations.

Customer Outcome

Customer receives a prioritized segmentation roadmap that sequences Illumio adoption according to business objectives, environment complexity, and security priorities.

Compliance-Aligned Strategy Development and Documentation

• Add compliance-specific boundaries and considerations to the segmentation strategy.
• Add compliance priorities to the recommended order of operations and roadmap.
• Identify value milestones that support compliance objectives.
• Document compliance-aligned segmentation recommendations.
• Include the compliance strategy, control-intent mapping, and recommendations in the High-Level Design and Roadmap Document delivered through Segmentation Strategy & Roadmap.
• Review the compliance-aligned strategy with customer stakeholders.

Customer Outcome

The customer receives one segmentation strategy and roadmap that includes its compliance requirements and sets out a documented path for using segmentation to support those obligations.

This add-on is delivered as part of the Segmentation Strategy & Roadmap engagement and follows that schedule. The additional effort depends on:

• Purchased add-on size
• Number of applicable frameworks and requirements
• Number of regulated systems and environments
• Availability of compliance documentation
• Compliance stakeholder availability
• Customer review cycles.

If compliance requirement sources or stakeholder input arrive late, the overall Segmentation Strategy & Roadmap schedule may slip.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services