Containment Bundle

The Containment Bundle delivers a complete path from program strategy through operational containment controls in a single engagement with a single SKU. It combines strategic planning, platform deployment, workload classification, network traffic analysis, and the customer's first operational segmentation policies.

The bundle begins with a documented segmentation strategy and roadmap that aligns business objectives, environment realities, and compliance requirements into a recommended order of operations. It then establishes the Illumio platform, a scalable labeling framework, and a documented understanding of network communications. The engagement concludes by implementing a core-services policy framework covering shared infrastructure and administrative services, followed by containment controls that restrict high-risk protocols commonly used for lateral movement.

Because containment rules can interact with core-service communications, the final stage is delivered iteratively — core-services policy is revisited as risky protocols are restricted, ensuring required administrative and infrastructure traffic is preserved.

The intended outcome is an operational Illumio deployment with a documented labeling strategy, a documented understanding of network communications, an implemented core-services policy framework, and implemented ransomware containment controls that reduce lateral-movement risk.

Segmentation Strategy

Customer receives a documented segmentation strategy, environment and security posture review, governance model, and recommended order of operations for the program. Key Limits: One High-Level Design and Roadmap Document

Platform Foundation Deployment

Customer administrators can access and operate the Illumio platform, platform events are integrated into customer monitoring, and a validated, repeatable workload onboarding method is established.

Key Limits: Up to 10 sample VEN installations per supported operating system type

Labeling

Customer has a documented label schema, governance model, and implemented foundational label structure, with the operational knowledge to maintain and expand it. Key Limits: One customer-specific label schema design

Discovery

Customer understands inbound and outbound communication patterns, network complexity, and policy-readiness requirements, and receives the policy objects needed for future policy development.

Key Limits: Up to 60 policy objects (recommended planning assumption: ~30 IP Lists, ~30 Unmanaged Workloads)

Basic Policy – Core Services + Ransomware

Customer has an implemented and documented core-services policy framework and containment controls that restrict high-risk protocols while preserving required core-service communications.

Key Limits: Up to 10 core-service applications; up to 10 approved risky protocols

Illumio Package Prerequisites  

Package Dependencies

• None — this bundle includes all prerequisite packages.  

Delivery Sequence

• Segmentation Strategy & Roadmap → Platform Foundation Deployment → Labeling → Discovery → Basic Policy – Core Services + Ransomware  

Technical Readiness

• Illumio licensing available
• Available infrastructure, network, and security architecture information
• Workload and asset inventory available
• Available application inventory where known
• Supported operating systems identified
• Deployment tooling identified
• Identity provider available for SSO integration
• SIEM destination identified
• Available metadata sources, including CMDB, cloud tags, and existing naming standards  

Customer Readiness

• Executive sponsor identified
• Project lead and technical point of contact assigned
• Deployment owners and operating-system owners identified
• Core-service owners identified
• Application owners identified Network, security, and compliance stakeholders available
• Change-management process documented Required administrative access approved

Segmentation Strategy & Roadmap

• Project Kickoff and Objective Alignment
• Strategic Data Collection
• Current Security and Network Posture Review
• Segmentation Strategy and Roadmap Development
• Operational Readiness and Governance Planning
• High-Level Design and Roadmap Documentation and Handoff

Customer Outcome

Customer receives a consolidated view of its environment, scale, operating platforms, compliance obligations, and current security posture, together with a prioritized roadmap, responsibility matrix, readiness requirements, and value milestones that guide the remainder of the program.

Platform Foundation Deployment

• Platform Operational Configuration
• Deployment Planning
• VEN Installation and Validation
• Compatibility Assessment
• Operational Readiness and Handoff

Customer Outcome

Customer administrators can securely access the platform through approved identity services, platform events are available within the customer's monitoring environment, workload onboarding methodology has been validated through sample installations, compatibility findings have been documented, and the customer has the documented methodology required to continue onboarding workloads independently.

Labeling

• Labeling Strategy Development
• Label Schema Design and Governance
• Metadata Analysis and Classification
• Label Operationalization
• End-of-Engagement Summary and Handoff

Customer Outcome

Customer receives a documented label schema and governance model aligned to operational, reporting, and future segmentation requirements, has foundational labels implemented, and possesses the processes, standards, and operational knowledge required to continue label administration and refinement.

Discovery

• Discovery Planning
• Network Traffic Analysis
• Policy Readiness Analysis
• Policy Object Creation and Operationalization
• Discovery Findings and Handoff

Customer Outcome

Customer gains a documented understanding of inbound and outbound communication patterns, external dependencies, and network complexity; receives the policy objects required to support policy development along with the standards and templates used to create them; and receives a documented path into containment policy work.

Basic Policy – Core Services + Ransomware Core Services

• Analysis and Design
• Core Services Policy Implementation and Handoff
• Ransomware Containment Design and Implementation
• Ransomware Containment Documentation and Handoff

Customer Outcome

Customer receives a validated architectural model for shared-services policy, an implemented and documented core-services policy framework, implemented containment controls that reduce lateral-movement risk while preserving required core-service communications, and a documented record of blocked protocols, approved exceptions, and the operational guidance required to maintain and expand both frameworks.

Bundle Customer Outcome

At the conclusion of the Containment Bundle, the customer has a documented segmentation strategy and roadmap, an operational Illumio platform integrated with its identity and monitoring systems, a validated and repeatable workload onboarding method, a documented and implemented labeling framework, a documented analysis of network communications and complexity, an implemented core-services policy framework, and implemented ransomware containment controls — together with the operational knowledge required to maintain and expand those frameworks and progress into application segmentation.

The Containment Bundle is delivered as a sequenced program rather than a set of independent engagements. The delivery schedule will be established at project initiation based on:

• Purchased bundle size
• Infrastructure complexity, number of environments, and application portfolio complexity
• Compliance requirements
• Number of operating systems and deployment complexity
• Identity-provider and logging integration complexity
• Metadata quality and number of applications
• Traffic volume and number of observed dependencies
• Number of core-service applications and risky protocols selected
• Stakeholder availability and customer review and approval cycles.

Packages are delivered in sequence, with Discovery activities potentially beginning before final label refinement is complete, and core-services policy revisited iteratively as containment controls are implemented. Delays in stakeholder participation, access provisioning, integration configuration, metadata availability, dependency validation, exception decisions, or change approvals may affect the overall program schedule.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services