CVD Portal
← CRA Glossary
Product Security Engineering

Network Segmentation

Network segmentation is the practice of dividing a network into isolated segments or zones to limit the blast radius of a security incident. For CRA-covered products operating in enterprise or industrial environments, built-in network isolation capabilities are a key security design requirement.

Network segmentation is the practice of dividing a network into isolated segments or zones to limit the blast radius of a security incident. For CRA-covered products operating in enterprise or industrial environments, built-in network isolation capabilities are a key security design requirement.

Product Security Engineering
Free CVD portal →

What Is Network Segmentation?

Network segmentation is the security practice of dividing a network infrastructure into separate, isolated zones using firewalls, VLANs, or physical separation. Each zone contains a defined set of resources, and traffic between zones is controlled and filtered. Segmentation limits the 'blast radius' of a security incident: if an attacker compromises a device in one zone, they cannot freely move to other zones without overcoming additional security controls. For CRA-covered products, network segmentation has two dimensions: the segmentation of the network in which the product is deployed (an operator responsibility), and the product's own network communication behaviour - whether it respects and operates safely within segmented environments, and whether it creates unnecessary network exposure that operators must compensate for.

CRA reference:Annex I

Network Segmentation in CRA Product Design

The CRA's Annex I requires products to minimise their attack surface and support deployment in secure network configurations. From a product design perspective, this means:

  • Minimal network exposure: Products should expose only the network services actually required for their function. Unnecessary open ports, discovery protocols, or management interfaces increase the attack surface that operators must segment around.
  • Configurable network isolation: Industrial and enterprise products should support VLAN tagging, firewall rule configuration, and interface binding that enable operators to isolate the product within their segmented architecture.
  • Protocol support: Products should support protocols designed for segmented environments (SNMPv3, secure management protocols) rather than only insecure protocols that require broad network access.
  • Documentation for segmentation: Manufacturers should publish deployment guidance specifying what network access the product requires, enabling operators to correctly configure network segmentation.
CRA reference:Annex I

Network Segmentation for OT and Industrial Products

For operational technology (OT) and industrial control system products - a significant portion of CRA Important Class products - network segmentation between IT and OT networks is a fundamental security architecture requirement. The Purdue Model and IEC 62443 both provide reference segmentation architectures for industrial environments. Key considerations for manufacturers of industrial CRA products:

  • OT-specific protocol support: Industrial protocols (Modbus, PROFINET, EtherNet/IP) typically lack authentication and should be confined to isolated OT network segments. Products using these protocols should support network isolation features.
  • Demilitarised zone (DMZ) patterns: Industrial products that need to communicate with enterprise IT systems should be designed to operate safely in DMZ configurations with controlled data flows.
  • Air-gap compatibility: Some high-security industrial deployments require complete network isolation. Products should support local management interfaces (serial, USB) that function without network connectivity.
CRA reference:Annex I

Segmentation as a Compensating Control in Vulnerability Management

Network segmentation also plays a role in vulnerability management - it can serve as a compensating control while a patch is being developed. When a vulnerability is disclosed in a product that cannot be immediately patched (for example, because an OTA update requires extensive testing), network segmentation can limit the exploitability of the vulnerability:

  • Block external access to the affected service at the network perimeter.
  • Isolate the product on a restricted VLAN with only necessary communication paths.
  • Apply ingress/egress filtering to limit lateral movement if the product is compromised.

Manufacturers should include network segmentation recommendations in security advisories for vulnerabilities where patch deployment will take longer than the standard SLA. These compensating controls reduce user risk during the remediation window and should be documented in the CVSS Environmental score adjustment.

CRA reference:Annex I

CVD Portal makes Network Segmentation compliance straightforward.

Public CVD submission portal, acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Receiving and tracking reports is free for all manufacturers placing products with digital elements on the EU market. Article 14 filing with the SRP-ready package is on Pro.

Start your free portal

Frequently asked

Is network segmentation a product requirement or a deployment requirement under the CRA?+

Both. The CRA requires manufacturers to design products that minimise their attack surface and support secure deployment configurations - this is a product design obligation. It also requires manufacturers to provide deployment guidance informing operators how to configure the product securely, including network isolation recommendations. Operators (under NIS2 and their own security obligations) are responsible for implementing network segmentation in their environments. Manufacturers cannot design products that rely on operators compensating for poor security design through segmentation.

How should a manufacturer document network segmentation requirements for CRA compliance?+

Network segmentation requirements and recommendations should be documented in: the Annex II user information (concise summary of network connectivity requirements); the product's deployment guide (detailed port/protocol matrix and recommended network architecture); and the Annex VII technical documentation (network architecture diagrams showing the product's communication paths and recommended isolation). Security advisories for network-exploitable vulnerabilities should include specific segmentation guidance as interim mitigations.

Does network segmentation help with CVSS Environmental scoring?+

Yes. CVSS Environmental metrics allow manufacturers and operators to adjust the effective vulnerability score based on deployment context. A vulnerability that is network-exploitable (Attack Vector: Network in base score) may have its Environmental score reduced if the product is deployed behind a firewall that blocks external access to the vulnerable service. Manufacturers publishing CVSS-BE (Base + Environmental) scores in their advisories can reflect the mitigating effect of recommended segmentation, providing users with a more accurate contextual risk assessment.

Related terms

Principle of Least PrivilegeThe Principle of Least Privilege states that every component, process, or user should operate with the minimum permissions necessary to perform its function. It is a fundamental secure design principle required by the CRA's Annex I essential requirements and limits the damage an attacker can cause if any component is compromised.Defence in DepthDefence in depth is a security strategy that employs multiple overlapping layers of security controls so that if one layer fails, others continue to protect the system. It is a core principle behind the CRA's essential requirements, which take a holistic view of product security rather than relying on any single mechanism.Secure by DefaultSecure by default means that a product ships with security settings pre-configured to the most protective state - disabled features, closed ports, strong authentication - without requiring users to take action to enable security. It is an explicit essential requirement under Annex I of the EU Cyber Resilience Act.Secure by DesignSecure by design means that security is built into a product's architecture and development process from the earliest design stage, rather than added as an afterthought after development is complete. The EU Cyber Resilience Act's essential requirements in Annex I mandate a secure-by-design approach for all products with digital elements.Attack SurfaceThe attack surface of a product is the totality of different points - interfaces, APIs, protocols, hardware ports, and user inputs - through which an attacker could attempt to enter or extract data from a system. Reducing attack surface is a core principle of the CRA's essential cybersecurity requirements.Cybersecurity Risk AssessmentA cybersecurity risk assessment is a systematic process of identifying, analysing, and evaluating security threats and vulnerabilities that could affect a product or system, then determining appropriate mitigations. The EU Cyber Resilience Act requires manufacturers to conduct and document a cybersecurity risk assessment as a precondition for market placement.

CRA articles using this term

Article 13Obligations of ManufacturersAnnex IEssential Cybersecurity Requirements for Products with Digital Elements

Sector checklists covering Network Segmentation

Enterprise Networking EquipmentEnterprise networking equipment - switches, firewalls, load balancers, and network management systems - spans multiple Annex III classifications. Hardware firewalls are Class II Important products; network management software and monitoring tools are Class I Important products. Both require third-party conformity assessment.Industrial Controllers & PLCsIndustrial controllers, PLCs, and SCADA components are classified as Important Class II under Annex III of the CRA, requiring third-party conformity assessment. These products have long operational lifetimes (10–20+ years), network connectivity, and significant safety implications. CRA compliance must be planned well in advance of the September 2026 deadline.Building Automation & Smart BuildingsBuilding automation systems (BAS/BMS) control HVAC, lighting, access, fire safety, and energy management across commercial and industrial buildings. Most BAS components are Default class under the CRA, but those deployed in hospitals, data centres, and other critical facilities may be treated as critical infrastructure components. The BACnet and Modbus protocols widely used in BAS were not designed with security in mind - CRA compliance requires significant attention to protocol security and access control.Smart Grid & Energy InfrastructureSmart grid systems - including advanced metering infrastructure (AMI), distribution automation systems, grid management software, and grid-connected energy storage controllers - are among the most critical products under the CRA. CRA Annex III Class II applies, requiring mandatory Notified Body assessment. The energy sector is NIS2-classified as essential infrastructure, creating overlapping obligations between CRA product requirements and NIS2 operator obligations.

Browse the full CRA Compliance Checklist

See how Network Segmentation fits into your complete CRA compliance programme.

View checklists →