Network Segmentation
Network segmentation is the practice of dividing a network into isolated segments or zones to limit the blast radius of a security incident. For CRA-covered products operating in enterprise or industrial environments, built-in network isolation capabilities are a key security design requirement.
Network segmentation is the practice of dividing a network into isolated segments or zones to limit the blast radius of a security incident. For CRA-covered products operating in enterprise or industrial environments, built-in network isolation capabilities are a key security design requirement.
Product Security EngineeringWhat Is Network Segmentation?
Network segmentation is the security practice of dividing a network infrastructure into separate, isolated zones using firewalls, VLANs, or physical separation. Each zone contains a defined set of resources, and traffic between zones is controlled and filtered. Segmentation limits the 'blast radius' of a security incident: if an attacker compromises a device in one zone, they cannot freely move to other zones without overcoming additional security controls. For CRA-covered products, network segmentation has two dimensions: the segmentation of the network in which the product is deployed (an operator responsibility), and the product's own network communication behaviour — whether it respects and operates safely within segmented environments, and whether it creates unnecessary network exposure that operators must compensate for.
Network Segmentation in CRA Product Design
The CRA's Annex I requires products to minimise their attack surface and support deployment in secure network configurations. From a product design perspective, this means:
- Minimal network exposure: Products should expose only the network services actually required for their function. Unnecessary open ports, discovery protocols, or management interfaces increase the attack surface that operators must segment around.
- Configurable network isolation: Industrial and enterprise products should support VLAN tagging, firewall rule configuration, and interface binding that enable operators to isolate the product within their segmented architecture.
- Protocol support: Products should support protocols designed for segmented environments (SNMPv3, secure management protocols) rather than only insecure protocols that require broad network access.
- Documentation for segmentation: Manufacturers should publish deployment guidance specifying what network access the product requires, enabling operators to correctly configure network segmentation.
Network Segmentation for OT and Industrial Products
For operational technology (OT) and industrial control system products — a significant portion of CRA Important Class products — network segmentation between IT and OT networks is a fundamental security architecture requirement. The Purdue Model and IEC 62443 both provide reference segmentation architectures for industrial environments. Key considerations for manufacturers of industrial CRA products:
- OT-specific protocol support: Industrial protocols (Modbus, PROFINET, EtherNet/IP) typically lack authentication and should be confined to isolated OT network segments. Products using these protocols should support network isolation features.
- Demilitarised zone (DMZ) patterns: Industrial products that need to communicate with enterprise IT systems should be designed to operate safely in DMZ configurations with controlled data flows.
- Air-gap compatibility: Some high-security industrial deployments require complete network isolation. Products should support local management interfaces (serial, USB) that function without network connectivity.
Segmentation as a Compensating Control in Vulnerability Management
Network segmentation also plays a role in vulnerability management — it can serve as a compensating control while a patch is being developed. When a vulnerability is disclosed in a product that cannot be immediately patched (for example, because an OTA update requires extensive testing), network segmentation can limit the exploitability of the vulnerability:
- Block external access to the affected service at the network perimeter.
- Isolate the product on a restricted VLAN with only necessary communication paths.
- Apply ingress/egress filtering to limit lateral movement if the product is compromised.
Manufacturers should include network segmentation recommendations in security advisories for vulnerabilities where patch deployment will take longer than the standard SLA. These compensating controls reduce user risk during the remediation window and should be documented in the CVSS Environmental score adjustment.
CVD Portal makes Network Segmentation compliance straightforward.
Public CVD submission portal, acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Free forever for EU manufacturers.
Start your free portalFrequently asked
Is network segmentation a product requirement or a deployment requirement under the CRA?+
Both. The CRA requires manufacturers to design products that minimise their attack surface and support secure deployment configurations — this is a product design obligation. It also requires manufacturers to provide deployment guidance informing operators how to configure the product securely, including network isolation recommendations. Operators (under NIS2 and their own security obligations) are responsible for implementing network segmentation in their environments. Manufacturers cannot design products that rely on operators compensating for poor security design through segmentation.
How should a manufacturer document network segmentation requirements for CRA compliance?+
Network segmentation requirements and recommendations should be documented in: the Annex II user information (concise summary of network connectivity requirements); the product's deployment guide (detailed port/protocol matrix and recommended network architecture); and the Annex VII technical documentation (network architecture diagrams showing the product's communication paths and recommended isolation). Security advisories for network-exploitable vulnerabilities should include specific segmentation guidance as interim mitigations.
Does network segmentation help with CVSS Environmental scoring?+
Yes. CVSS Environmental metrics allow manufacturers and operators to adjust the effective vulnerability score based on deployment context. A vulnerability that is network-exploitable (Attack Vector: Network in base score) may have its Environmental score reduced if the product is deployed behind a firewall that blocks external access to the vulnerable service. Manufacturers publishing CVSS-BE (Base + Environmental) scores in their advisories can reflect the mitigating effect of recommended segmentation, providing users with a more accurate contextual risk assessment.
Related terms
Browse the full CRA Compliance Checklist
See how Network Segmentation fits into your complete CRA compliance programme.