Illumio Datasheet Library

Active Incident Segmentation Support helps organizations stop lateral movement during an active breach. It protects servers that have been confirmed healthy so compromised systems can't reinfect them.

During a breach, a critical task is keeping compromised systems from reaching systems that have been investigated and cleared. Traditional network controls are usually too slow or too coarse to change in the middle of an incident. Illumio segmentation can put workload-level boundaries in place quickly, without redesigning the network.

Illumio Professional Services is not an incident response firm. PS works alongside the IR firm the customer has contracted. The IR firm leads the investigation, forensics, and remediation, and Illumio PS provides segmentation controls to support that work.

PS helps the customer set up an environmental separation rule based on workload state. As the customer and its IR firm sort servers into impacted, cleared, or unknown, PS helps deploy VENs and apply enforcement so that cleared servers refuse traffic from compromised or unverified systems. Protection is enforced on the healthy side of the boundary, so it doesn't depend on getting an agent onto a system that may already be compromised.

PS also gives the customer a blueprint for repeating the method. The customer can then keep classifying, clearing, and protecting workloads as recovery continues, and use the same approach to protect the environment going forward.

This method is temporary by design. It is built for speed during an incident, not for long-term operation. Once the incident is resolved, it can transition into a full Illumio deployment.

This package is usually used by organizations that are new to Illumio or haven't created policy yet.

The Additional PCE Migration Window add-on adds one more migration window to an On-Premise PCE > SaaS Migration engagement.

The core migration package includes four migration windows, which is enough for most customers to move their VEN-managed workloads to the SaaS PCE. Some environments need more. Common reasons are a large workload estate, tight change-freeze calendars, business units that have to migrate separately, or workloads that couldn't move in their original window and need to be rescheduled.

Each add-on covers one migration window. In it, Illumio Professional Services migrates the agreed group of VEN-managed workloads to the SaaS PCE, monitors connectivity and policy synchronization as they move, resolves issues as they come up, and validates the result. The work follows the same method, tooling, and validation approach as the core migration package.

Customers can buy as many add-ons as they need. Each one represents one-quarter of the effort of the core migration package at the matching size.

Application Ringfencing implements application-focused segmentation policy that restricts communications to only those dependencies required for an application to operate. The package represents the customer's entry into the Segmentation phase of the Illumio journey, following the visibility and containment outcomes established by earlier packages.

For each in-scope application, Illumio Professional Services analyzes observed inbound and outbound communications, validates required dependencies with application owners through an attestation process, and develops segmentation policy reflecting the approved communication requirements. By reducing unnecessary communication paths, customers improve security posture, limit lateral movement opportunities, and establish a repeatable methodology for securing additional applications.

The engagement is delivered as a repeatable motion performed for up to five applications, concluding with a segmentation reference guide and as-built policy record that document the methodology, governance model, and change-management path the customer can follow to continue ringfencing additional applications independently.

The intended outcome is implemented draft ringfencing policy for the approved applications and a documented, repeatable segmentation methodology the customer can apply across the remaining application portfolio.

The Basic Policy – Core Services + Ransomware package establishes the customer's first operational segmentation policies by defining shared infrastructure communications and implementing controls that reduce ransomware propagation risk.

The engagement begins by identifying business-critical shared services and administrative platforms used throughout the environment. These services are organized into a documented Core Services policy framework designed to support future segmentation efforts. Core services are broadly defined as global or administrative services consumed across the environment, such as Active Directory, DNS, DHCP, endpoint management platforms, vulnerability scanners, monitoring systems, and similar support infrastructure.

Once the core-services foundation is established, Illumio Professional Services implements ransomware-containment controls focused on restricting high-risk protocols commonly leveraged for lateral movement. Because containment rules can interact with core-service communications, the engagement includes an iterative review that revisits core-services policy as risky protocols are restricted.

The resulting policy framework serves as the customer's baseline segmentation architecture and creates the policy foundation required for Ringfencing, Environmental Separation, and future policy development.

The Basic Compliance-Aligned Segmentation Strategy add-on extends the Segmentation Strategy & Roadmap engagement so the resulting strategy also accounts for the customer's regulatory and compliance obligations.

Segmentation Strategy & Roadmap produces the customer's high-level segmentation strategy, environment diagram, target outcomes, and recommended order of operations. This add-on adds a compliance view to that same work. Illumio Professional Services identifies the segmentation-relevant intent of the customer's applicable compliance requirements, maps that intent to the segmentation strategy, and documents a recommended path for using segmentation to support those requirements.

The add-on covers DORA, PCI DSS, SWIFT, HIPPA,cyber-insurance requirements, and government security policy requirements.

The compliance strategy is delivered inside the same High-Level Design and Roadmap Document produced by Segmentation Strategy & Roadmap, so the customer gets one strategy document instead of a separate compliance deliverable.

The engagement is advisory. It maps segmentation strategy to compliance control intent. It is not an audit, certification, or attestation.

The Containment Bundle delivers a complete path from program strategy through operational containment controls in a single engagement with a single SKU. It combines strategic planning, platform deployment, workload classification, network traffic analysis, and the customer's first operational segmentation policies.

The bundle begins with a documented segmentation strategy and roadmap that aligns business objectives, environment realities, and compliance requirements into a recommended order of operations. It then establishes the Illumio platform, a scalable labeling framework, and a documented understanding of network communications. The engagement concludes by implementing a core-services policy framework covering shared infrastructure and administrative services, followed by containment controls that restrict high-risk protocols commonly used for lateral movement.

Because containment rules can interact with core-service communications, the final stage is delivered iteratively — core-services policy is revisited as risky protocols are restricted, ensuring required administrative and infrastructure traffic is preserved.

The intended outcome is an operational Illumio deployment with a documented labeling strategy, a documented understanding of network communications, an implemented core-services policy framework, and implemented ransomware containment controls that reduce lateral-movement risk.

The Discovery package analyzes observed network communications to determine what policy objects, network representations, and environmental context must exist within Illumio before policy can be safely and effectively developed.

The engagement focuses on reviewing inbound and outbound communications observed within the Illumio platform, identifying communication patterns that are relevant to future segmentation efforts, and documenting infrastructure elements that are not yet represented within the PCE. Discovery provides customers with a structured understanding of application communications, external dependencies, network complexity, cloud connectivity, branch-office communications, partner communications, internet exposure, and other traffic patterns that influence future policy design.

As part of the engagement, Illumio Professional Services teaches the customer the methodologies used to analyze traffic, identify trends, validate communication patterns, and determine required policy objects. The service includes creation of policy objects required to support future policy engineering activities and provides standards, governance recommendations, and operational guidance for ongoing object creation after the engagement concludes.

Discovery is intended to establish policy readiness. It does not attempt to analyze every communication path or completely model the customer environment. Instead, it provides a bounded analysis, creates priority policy objects, and delivers a documented path forward into Basic Policy, Ringfencing, Environmental Separation, and future segmentation services.

The Environmental Separation add-on restricts traffic between environments. Typical examples are blocking communication between development and production, or isolating test, lab, and DMZ environments from critical production systems.

Non-production environments usually have weaker security controls, looser access, and less monitoring than production, which makes them a common entry point for attackers moving laterally. Separating environments is one of the fastest ways to reduce that risk. It gives large enterprises a meaningful east-west control without having to segment every application first.

Separation rules are simple to write, but applying them without analysis is risky. Traffic between environments is often legitimate: a shared service, a workload that was labeled incorrectly, or infrastructure sitting in the wrong data center or VLAN. Blocking it outright can disrupt production. For that reason, this add-on requires the core-services policy framework from Basic Policy – Core Services + Ransomware to be in place first, and it starts with a review of the traffic that actually crosses each boundary.

Illumio Professional Services analyzes that cross-boundary traffic, finds any legitimate or required communication, and builds a mitigation plan. The plan either allows the traffic, permanently or temporarily, or corrects the underlying issue. PS then develops the separation policy and prepares it for customer review and provisioning.

The outcome is restricted cross-environment traffic between two unique labeled environments that protects High-trust environments from lower-trust environments. Environmental Separation works alongside ransomware containment and application ringfencing as a complementary control. Used together, these three layers form a complete segmentation strategy: port-level containment, environment-level separation, and application-level ringfencing.

The Exposure Report package provides a recurring, quantitative analysis of a customer's policy coverage across high-risk ports and protocols, measuring the degree of exposure remaining within the environment and how that exposure changes over time.

Illumio Professional Services collects data through read-only API queries against the platform, performs a read-only review of the Policy Compute Engine, and supplements that data with structured discussions with customer stakeholders. The collected data is analyzed to determine which high-risk communication paths remain open, where policy coverage is incomplete, and which areas of the environment carry the greatest residual exposure.

The package is sold as a set of four reports, intended to be delivered on a quarterly cadence. Because historical data is retained across reports, each successive report shows the delta from the prior period — providing customers with an objective, trended measure of security posture improvement rather than a single point-in-time snapshot.

Each report is generated by Illumio Professional Services and presented to customer stakeholders, accompanied by recommendations identifying the policy work that would most effectively reduce remaining exposure. The Exposure Report also contributes to the measurement of client maturity within the Illumio segmentation maturity model.

The Flowlink and NEN Deployment add-on sets up Illumio Flowlink, the Illumio Network Enforcement Node (NEN), or both, so that network traffic from systems without a VEN is ingested into the Policy Compute Engine for analysis.

Visibility across all communications is critical for segmentation, and the preferred way to get it is a VEN on each workload. In some cases a VEN can't be installed, or the customer chooses not to install one. Examples include mainframes, storage filers, legacy Windows systems, appliances, systems where an agent would void vendor support, and latency-sensitive high-transaction servers. Flowlink and the NEN fill that gap by bringing network-sourced flow data into the PCE.

Flowlink collects flow records from network devices and uploads them to the PCE. Current releases can also stream flows to Azure Event Hub for higher-throughput ingestion. The NEN is installed as part of the Illumio deployment and paired with the PCE. For switch devices, it can receive traffic flow information from managed network devices and supply that data to the PCE.

These are separate products. They are combined in one service add-on because both do the same job at this stage of the program: getting traffic into the PCE. The add-on is normally delivered during Platform Foundation Deployment, and delivery can continue into the Labeling or Discovery phases. When it is complete, network-sourced traffic is flowing into the PCE and is available for analysis in Discovery before any policy is configured.

The Health Check package provides a structured assessment of a customer's existing Illumio deployment, policy posture, and operational practices, measured against Illumio best practices and the Illumio segmentation maturity model.

Illumio Professional Services collects deployment and configuration data through read-only API queries and review of the Policy Compute Engine, supplemented by structured discussions with customer stakeholders. The collected information is analyzed to identify gaps, misconfigurations, deviations from best practice, and areas of the deployment that may limit the customer's ability to progress through its segmentation journey.

The engagement produces a comprehensive assessment document covering deployment coverage, policy construction, logging and access configuration, and observed traffic patterns, together with prioritized recommendations for remediation. Where gaps align to Illumio service offerings, the assessment identifies the Professional Services packages that can address them.

The Health Check is typically performed at the conclusion of the initial deployment and annually thereafter, providing customers with a recurring, comparable measure of progress and deployment health.

The Labeling package establishes the customer’s metadata and workload-classification strategy that will be used to organize assets, support visibility, enable reporting, and prepare the environment for future segmentation policy. Effective labels provide the business and technical context required to understand application communications and build scalable segmentation policy over time.

Illumio Professional Services works with customer stakeholders to design a customer-specific labeling model, identify available metadata sources, define naming and governance standards, and establish a repeatable approach for assigning and maintaining labels. The engagement focuses on creating a sustainable label architecture rather than attempting to permanently classify every workload in the environment.

The resulting label schema becomes the foundation for Discovery, Basic Policy, Ringfencing, Environmental Separation, and future segmentation activities. As network visibility improves and policy development progresses, label definitions and assignments may continue to evolve and mature beyond the initial engagement.

The intended outcome is a documented label strategy, an implemented foundational label structure, and customer enablement to continue label administration independently after Professional Services disengagement.

The Migration Readiness Assessment helps customers moving from another segmentation platform to Illumio reuse the work already done in that platform instead of starting over.

Customers leaving another segmentation product usually have useful information in it: workload inventories, classification schemes, grouping constructs, IP-based objects, and sometimes policy. Rebuilding that from scratch slows the Illumio deployment and wastes investment the customer has already made. Much of it can be extracted and converted into a format the Illumio platform can use.

Illumio Professional Services reviews the customer's existing segmentation deployment and extracts its configuration using Illumio-developed tooling and a standard methodology. PS then converts the usable data into Illumio-ready formats. The most valuable output is usually asset data. It produces the list of workloads for VEN deployment and gives a head start on label design. Where the previous platform has working policy, PS reviews it to a limited degree and translates the usable parts into Illumio constructs.

This engagement runs alongside Platform Foundation Deployment and Labeling and feeds both. When it is complete, the customer has converted asset, classification, and object data ready for use in Illumio, and a documented plan for moving off the previous platform.

The On-Premise PCE Build add-on installs the on-premise Policy Compute Engine (PCE) and brings it online, following the design produced in the On-Premise PCE Design and Architecture add-on.

The design phase identifies the required server configuration. The PCE build package carries out that design. Illumio Professional Services prepares the customer-provisioned servers for PCE installation, installs the PCE software, completes the required configuration, and brings the cluster up.

A PCE installation depends on correct capacity sizing, storage partitions, load balancing, DNS, TLS certificates, email, and a set of operating system dependencies and settings. Errors in any of these can stop the PCE from starting or cause it to run unreliably. PS works through each prerequisite, installs the PCE, and verifies that the cluster is working.

The engagement is complete once the PCE databases are online and administrators can log in to the PCE web console. At that point the platform is ready for Platform Foundation Deployment activities such as SSO, logging integration, and VEN onboarding.

The On-Premise PCE Design and Architecture add-on gives customers a right-sized design for an on-premise Policy Compute Engine before any infrastructure is built.

An on-premise PCE runs on one or more nodes. The deployment type depends on scale and resilience requirements. A 2x2 multi-node cluster runs two core nodes and two data nodes for redundancy. A 4x2 cluster runs four core nodes and two data nodes for larger deployments. A supercluster joins two or more replicating clusters into one administrative domain. If the wrong type or size is chosen, the PCE can be under-provisioned, lack resilience, or be expensive to rebuild later.

Illumio Professional Services works with the customer to determine the right PCE type and scale for the current deployment and planned growth. PS then specifies the resources each server needs, defines where the nodes should be placed, and gives the customer setup instructions so the environment is prepared correctly. If the customer plans to split the PCE across data centers, PS helps define the latency and connectivity requirements between sites.

This add-on covers preparation and design only. The PCE itself is built in the separate On-Premise PCE Build add-on.

At the end of the engagement, the customer knows what needs to be built, how large it must be, where it should be built, and what infrastructure must be ready before installation starts.

The On-Premise PCE > SaaS Migration package moves a customer's existing Illumio deployment from an on-premise Policy Compute Engine to the Illumio SaaS platform while keeping its segmentation configuration and VEN-managed workloads intact.

Moving to SaaS removes the work of running, upgrading, and maintaining PCE infrastructure. The move itself still needs care. Labels, IP Lists, rulesets, security policies, and integrations all have to arrive correctly, and every VEN-managed workload has to reconnect and synchronize with the new PCE. If configuration is missed or a workload doesn't reconnect, protection can lapse during the cutover.

Illumio Professional Services handles the migration in three phases:

Preparation. PS reviews the existing PCE configuration, workloads and VENs, labels, IP Lists, rulesets, security policies, and integrations such as SIEM and SAML. PS checks that PCE and VEN versions meet migration requirements, identifies unsupported configurations and potential issues, and runs a dry run to find and resolve errors before the real cutover. Cutover. PS uses the Illumio PCE Migration Tool to move the required objects to the SaaS PCE, then migrates the VEN-managed workloads and monitors connectivity and policy synchronization as they move. Validation. PS confirms that workloads are connected and synchronized with the SaaS PCE and that labels, IP Lists, rulesets, and security policies migrated correctly, then reviews the environment with the customer.

When the engagement is complete, the customer is running on the Illumio SaaS platform with its configuration, policy, and workloads migrated and validated.

Platform Foundation Deployment establishes the foundational Illumio platform capabilities required to begin a successful Zero Trust Segmentation journey.

The service enables customers to deploy, configure, validate, and operationalize the Illumio platform while onboarding workloads into visibility. The engagement focuses on creating a production-ready environment that provides the visibility, administrative controls, deployment methodology, and operational foundation required for future labeling, discovery, containment, and segmentation activities.

Illumio Professional Services works with customer stakeholders to configure the platform, validate readiness, onboard workloads, review deployment methods, document operational procedures, and establish a repeatable deployment model. The service provides customers with a functioning Illumio environment and the documentation required to continue expanding their deployment after the engagement.

The intended outcome is a customer-owned Illumio deployment operating in Visibility Mode and prepared for future policy-development services.

The Illumio Policy Consultant package provides a dedicated Illumio Professional Services consultant assigned to the customer for a twelve-month engagement, focused specifically on policy development.

Customers who have completed foundational deployment, labeling, discovery, and initial policy work frequently find that the limiting factor in extending segmentation across the remaining application portfolio is sustained policy authoring capacity. The Illumio Policy Consultant addresses that constraint directly, providing a consistent resource dedicated to analyzing application communications, authoring policy, and preparing that policy for customer review and provisioning.

The consultant works within the policy framework, labeling schema, and segmentation methodology the customer has already established, extending policy coverage at a sustained pace.

The engagement is available at full-time, half-time, or quarter-time allocation, allowing customers to match policy authoring capacity to the pace of their segmentation program.

The RBAC add-on sets up role-based access control in the Illumio platform so each user has the access their job requires and nothing more.

Illumio RBAC is built on users and permissions. Each permission combines a role, an optional scope, and the user or group it is granted to. Roles define what a user can do, such as creating labels or provisioning policy changes. Scopes limit those actions to workloads that carry specific Application, Environment, and Location labels. Because scopes are made of labels, RBAC design depends on the customer's label schema. For that reason this add-on is delivered alongside the Labeling engagement.

Illumio Professional Services works with the customer to define its access goals, including separation of duties and whether application owners need access. It then maps those goals to Illumio roles, scopes, and identity-provider groups and configures RBAC in the PCE.

At the end of the engagement, the customer has a working RBAC configuration for its current needs, a document describing the design, and a template and instructions for adding roles, scopes, and groups on its own.

The Resident Architect package provides a dedicated senior Illumio Professional Services resource assigned to the customer for a twelve-month engagement. The Resident Architect works alongside the customer's security and infrastructure teams to accelerate adoption, reduce operational risk, and provide continuous expertise across every phase of the Illumio deployment.

This engagement is designed for enterprise customers with complex environments, aggressive segmentation timelines, or high-value applications subject to complex regulatory requirements, the pace and quality of a segmentation program is often limited less by the platform than by the availability of deep Illumio expertise embedded within the customer's own team.

The Resident Architect provides that expertise directly, and is backed by access to Illumio subject matter experts across the broader portfolio — including containers, cloud, hybrid architectures, and compliance-driven segmentation. The engagement also supports complex transition scenarios, including takeout from other segmentation platforms and cutover from traditional firewall solutions deployed for east-west traffic control.

The engagement is available at full-time, half-time, or quarter-time allocation, allowing customers to match the level of embedded support to the scale and pace of their program.

The Segmentation Bundle delivers the complete Illumio journey — from program strategy through application-level segmentation — in a single engagement with a single SKU. It combines strategic planning, platform deployment, workload classification, network traffic analysis, containment policy, and application ringfencing.

The bundle begins with a documented segmentation strategy and roadmap that aligns business objectives, environment realities, and compliance requirements into a recommended order of operations. It then establishes the Illumio platform, a scalable labeling framework, and a documented understanding of network communications. Containment controls are implemented next, covering shared infrastructure and administrative services and restricting high-risk protocols commonly used for lateral movement.

The engagement concludes with application ringfencing. For up to five applications, Illumio Professional Services analyzes observed communications, validates required dependencies with application owners through an attestation process, and develops segmentation policy in draft form. The customer provisions and enforces that policy through its own change-management process, following the documented methodology provided during the engagement.

The intended outcome is an operational Illumio deployment with a documented labeling strategy, a documented understanding of network communications, implemented containment controls, implemented draft ringfencing policy for up to five applications, and a repeatable segmentation methodology the customer can apply across the remaining application portfolio.

The Segmentation Strategy & Roadmap package establishes a customer-specific Zero Trust Segmentation strategy before technical deployment and policy activities begin.

The engagement aligns business objectives, security requirements, infrastructure realities, compliance obligations, and operational ownership into a documented segmentation roadmap that guides subsequent Illumio implementation activities. Illumio Professional Services collects information directly from customer stakeholders and from pre-sales intake materials, then develops a high-level view of the customer's environment, desired outcomes, deployment priorities, and recommended order of operations.

The engagement documents the customer's current network and security posture, identifies strategic considerations such as legacy operating systems or compliance requirements, establishes responsibility and governance models, and defines the value milestones expected throughout the customer's segmentation journey.

The engagement produces a single customer-specific High-Level Design and Roadmap Document that serves as the foundational reference throughout the customer's visibility, containment, and segmentation program.

The Visibility Bundle delivers the foundational Illumio capabilities required to analyze and understand communications across the customer environment. It combines platform deployment, workload classification, and network traffic analysis into a single engagement with a single SKU.

The bundle establishes operational access to the Illumio platform, integrates platform events into the customer's monitoring ecosystem, validates workload onboarding methodology, creates a scalable labeling framework, and analyzes inbound and outbound communications to determine what must exist within the platform before segmentation policy can be developed.

The intended outcome is an operational Illumio deployment, a documented labeling strategy, a documented understanding of network communications, and the policy objects and operational knowledge required to progress into containment and segmentation activities.