Overview
The Segmentation Bundle delivers the complete Illumio journey — from program strategy through application-level segmentation — in a single engagement with a single SKU. It combines strategic planning, platform deployment, workload classification, network traffic analysis, containment policy, and application ringfencing.
The bundle begins with a documented segmentation strategy and roadmap that aligns business objectives, environment realities, and compliance requirements into a recommended order of operations. It then establishes the Illumio platform, a scalable labeling framework, and a documented understanding of network communications. Containment controls are implemented next, covering shared infrastructure and administrative services and restricting high-risk protocols commonly used for lateral movement.
The engagement concludes with application ringfencing. For up to five applications, Illumio Professional Services analyzes observed communications, validates required dependencies with application owners through an attestation process, and develops segmentation policy in draft form. The customer provisions and enforces that policy through its own change-management process, following the documented methodology provided during the engagement.
The intended outcome is an operational Illumio deployment with a documented labeling strategy, a documented understanding of network communications, implemented containment controls, implemented draft ringfencing policy for up to five applications, and a repeatable segmentation methodology the customer can apply across the remaining application portfolio.
What's Included
Segmentation Strategy
Customer receives a documented segmentation strategy, environment and security posture review, governance model, and recommended order of operations for the program.
Key Limits: One High-Level Design and Roadmap Document
Platform Foundation Deployment
Customer administrators can access and operate the Illumio platform, platform events are integrated into customer monitoring, and a validated, repeatable workload onboarding method is established.
Key Limits: Up to 10 sample VEN installations per supported operating system type
Labeling
Customer has a documented label schema, governance model, and implemented foundational label structure, with the operational knowledge to maintain and expand it.
Key Limits: One customer-specific label schema design
Discovery
Customer understands inbound and outbound communication patterns, network complexity, and policy-readiness requirements, and receives the policy objects needed for future policy development.
Key Limits: Up to 60 policy objects (recommended planning assumption: ~30 IP Lists, ~30 Unmanaged Workloads)
Basic Policy – Core Services + Ransomware
Customer has an implemented and documented core-services policy framework and containment controls that restrict high-risk protocols while preserving required core-service communications.
Key Limits: Up to 10 core-service applications; up to 10 approved risky protocols
Application Ringfencing
Customer has implemented draft segmentation policy for approved applications, validated through application-owner attestation, and a repeatable methodology to continue ringfencing independently.
Key Limits: Up to 5 applications
Prerequisites
Illumio Package Prerequisites
Package Dependencies
- None — this bundle includes all prerequisite packages.
Delivery Sequence
- Segmentation Strategy & Roadmap → Platform Foundation Deployment → Labeling → Discovery → Basic Policy – Core Services + Ransomware → Ringfencing
Technical Readiness
- Illumio licensing available
- Available infrastructure, network, and security architecture information
- Available application inventory where known
- Supported operating systems identified
- Deployment tooling identified
- Connectivity requirements identified Identity provider available for SSO integration
- SIEM destination identified
- Workload and asset inventory available
- Available metadata sources, including CMDB, cloud tags, and existing naming standards
Customer Readiness
- Executive sponsor identified
- Project lead and technical point of contact assigned
- Deployment owners and operating-system owners identified
- Core-service owners identified
- Application owners and application support teams identified Network, security, and compliance stakeholders available
- Change-management process documented for future provisioning and enforcement Required administrative access approved
Covered Services
Segmentation Strategy & Roadmap
- Project Kickoff and Objective Alignment
- Strategic Data Collection
- Current Security and Network Posture Review
- Segmentation Strategy and Roadmap Development
- Operational Readiness and Governance Planning
- High-Level Design and Roadmap Documentation and Handoff
Customer Outcome
Customer receives a consolidated view of its environment, scale, operating platforms, compliance obligations, and current security posture, together with a prioritized roadmap, responsibility matrix, readiness requirements, and value milestones that guide the remainder of the program.
Platform Foundation Deployment
- Platform Operational Configuration
- Deployment Planning
- VEN Installation and Validation
- Compatibility Assessment
- Operational Readiness and Handoff
Customer Outcome
Customer administrators can securely access the platform through approved identity services, platform events are available within the customer's monitoring environment, workload onboarding methodology has been validated through sample installations, compatibility findings have been documented, and the customer has the documented methodology required to continue onboarding workloads independently.
Labeling
- Labeling Strategy Development
- Label Schema Design and Governance
- Metadata Analysis and Classification
- Label Operationalization
- End-of-Engagement Summary and Handoff
Customer Outcome
Customer receives a documented label schema and governance model aligned to operational, reporting, and future segmentation requirements, has foundational labels implemented, and possesses the processes, standards, and operational knowledge required to continue label administration and refinement.
Discovery
- Discovery Planning
- Network Traffic Analysis
- Policy Readiness Analysis
- Policy Object Creation and Operationalization
- Discovery Findings and Handoff
Customer Outcome
Customer gains a documented understanding of inbound and outbound communication patterns, external dependencies, and network complexity; receives the policy objects required to support policy development along with the standards and templates used to create them; and receives a documented path into containment policy work.
Basic Policy – Core Services + Ransomware Core Services
- Analysis and Design
- Core Services Policy Implementation and Handoff
- Ransomware Containment Design and Implementation
- Ransomware Containment Documentation and Handoff
Customer Outcome
Customer receives a validated architectural model for shared-services policy, an implemented and documented core-services policy framework, implemented containment controls that reduce lateral-movement risk while preserving required core-service communications, and a documented record of blocked protocols, approved exceptions, and the operational guidance required to maintain and expand both frameworks.
Application Ringfencing
- Application Analysis (up to 5 applications)
- Application Attestation (up to 5 applications)
- Ringfencing Policy Development and Implementation (up to 5 applications)
- Segmentation Methodology and Operationalization Handoff
Customer Outcome
Customer receives a documented communication profile for each in-scope application, formal application-owner attestation of required communications, implemented draft segmentation policy aligned to those attested requirements, and a documented, repeatable methodology — including the draft-to-provision workflow, change-management guidance, and as-built policy record — enabling continued ringfencing of additional applications.
Bundle Customer Outcome
At the conclusion of the Segmentation Bundle, the customer has a documented segmentation strategy and roadmap, an operational Illumio platform integrated with its identity and monitoring systems, a validated and repeatable workload onboarding method, a documented and implemented labeling framework, a documented analysis of network communications and complexity, an implemented core-services policy framework, implemented ransomware containment controls, and implemented draft ringfencing policy for up to five applications — together with the operational knowledge and documented methodology required to maintain these frameworks and extend segmentation across the remaining application portfolio.
Expected Timeline
The Segmentation Bundle is delivered as a sequenced program rather than a set of independent engagements. The delivery schedule will be established at project initiation based on:
- Purchased bundle size
- Infrastructure complexity, number of environments, and application portfolio complexity
- Compliance requirements
- Number of operating systems and deployment complexity
- Identity-provider and logging integration complexity
- Metadata quality and number of applications
- Traffic volume and number of observed dependencies
- Number of core-service applications and risky protocols selected
- In-scope application complexity and dependency volume
- Stakeholder and application-owner availability
- Customer review, attestation, and approval cycles.
Packages are delivered in sequence, with Discovery activities potentially beginning before final label refinement is complete, and core-services policy revisited iteratively as containment controls are implemented. Ringfencing is delivered as a repeatable motion performed for each in-scope application. Delays in stakeholder participation, access provisioning, integration configuration, metadata availability, dependency validation, application-owner attestation, exception decisions, or change approvals may affect the overall program schedule.
Get Started
Talk to our Sales team to learn more about Services.
Explore our Professional Services at illumio.com/services/professional-services