Category: Network Security

Microsegmentation

Also known as: Micro-segmentation

Simply put

Microsegmentation is a security approach that divides a network into small, isolated sections, each with its own security policies and access controls. Instead of protecting only the outer edge of a network, it applies protections between individual zones or workloads so that access to each section is controlled separately. This helps limit how far an attacker or threat can move if one part of the network is compromised.

Formal definition

Microsegmentation is a network security method that isolates secure zones within a data center or cloud environment by dividing the network into discrete segments and enforcing granular, segment-specific security policies. Each segment maintains its own security perimeter, with access controlled based on the characteristics and requirements of that segment rather than a single network-edge boundary. It is often positioned as an approach that offers finer-grained control than traditional network segmentation and is commonly associated with zero trust architectures. In a payment security context, the scope and boundaries of any segmentation control should be validated against the applicable requirements of the current published PCI DSS, since the effect of segmentation on cardholder data environment scope depends on implementation and validation rather than the label alone.

Why it matters

In traditional network designs that emphasize perimeter defenses, an attacker who breaches the outer edge can often move laterally with relatively little resistance, reaching systems well beyond the initial point of compromise. Microsegmentation is intended to reduce this risk by isolating secure zones within a data center or cloud environment and enforcing security policies between individual segments or workloads, not just at the network edge. By controlling access to each section separately, it may limit how far a threat can spread if one part of the network is compromised.

In a payment security context, microsegmentation is often discussed alongside efforts to control the scope of the cardholder data environment. However, whether a given segmentation control actually reduces PCI DSS scope depends on how it is implemented and validated, not on the label applied to it. The boundaries and effectiveness of any segmentation should be verified against the applicable requirements of the current published PCI DSS rather than assumed. Readers should confirm specifics against the current standard, as requirement numbering and wording differ between versions.

Microsegmentation is frequently associated with zero trust architectures and is positioned as offering finer-grained control than traditional network segmentation. It is one control among many and does not by itself eliminate the risk of compromise or lateral movement; its value depends on correct design, ongoing policy maintenance, and validation.

Who it's relevant to

Security Engineers

Engineers designing data center or cloud network architectures use microsegmentation to isolate secure zones and enforce segment-specific security policies. They are responsible for ensuring that segment boundaries are correctly implemented and maintained, and that the control performs as intended rather than in name only.

Compliance Officers

Those responsible for PCI DSS compliance need to understand that segmentation can affect the scope of the cardholder data environment, but only when properly implemented and validated against the applicable requirements of the current published standard. They should confirm scope determinations against the current version rather than assuming a fixed requirement or outcome.

Cloud and Infrastructure Teams

Teams operating cloud and data center environments implement and maintain the granular, per-segment access controls that microsegmentation requires. Because it is often associated with zero trust architectures, these teams manage policies that govern communication between individual workloads and zones.

Merchant and Acquirer Risk Teams

Risk teams evaluating merchant or processor environments may consider whether microsegmentation is used to isolate systems handling cardholder data, and whether the segmentation boundaries have been validated. They should treat the presence of segmentation as a control whose effectiveness depends on implementation and validation, not on the label alone.

Inside Microsegmentation

Granular network segmentation

Microsegmentation divides a network into small, isolated zones down to the workload, application, or host level, rather than relying only on coarse perimeter or VLAN boundaries. In a PCI DSS context, it is one technique used to reduce the systems in scope by isolating the cardholder data environment (CDE) from out-of-scope systems.

Policy-based access controls

Traffic between segments is governed by explicit allow rules that default to denying east-west (lateral) traffic. Policies are typically defined by workload identity, tags, or attributes rather than solely by IP address or physical location.

Enforcement points

Controls may be enforced through host-based firewalls, hypervisor or virtual switch controls, software-defined networking, or agents on workloads. The specific enforcement mechanism varies by implementation and affects how segmentation should be validated.

Scope reduction for the CDE

When properly implemented and validated, segmentation can limit which systems store, process, or transmit cardholder data or can affect the security of the CDE, thereby reducing the systems that fall within PCI DSS scope. Segmentation is not required by PCI DSS, but when relied upon it must be verified.

Segmentation validation and testing

Reliance on segmentation to reduce scope generally must be confirmed through testing, such as penetration testing that verifies segmentation controls are effective and that isolated segments cannot reach the CDE. Confirm the specific testing expectations and frequency against the current published PCI DSS version, as requirement wording and numbering differ between versions.

Monitoring and logging of inter-segment traffic

Effective microsegmentation includes visibility into flows between segments so that policy violations, misconfigurations, or attempted lateral movement can be detected and reviewed.

Common questions

Answers to the questions practitioners most commonly ask about Microsegmentation.

Does microsegmentation put a network out of PCI DSS scope on its own?

No. Microsegmentation is a technique that can help isolate the cardholder data environment from other systems, but the label alone does not determine scope. Scope reduction depends on how the segmentation is implemented and, critically, on validation. Segmentation controls that are intended to isolate in-scope systems must be tested to confirm they work as designed. Consult the current published PCI DSS for the applicable segmentation and scoping guidance, since requirement wording and numbering differ between versions.

Is microsegmentation the same as traditional network segmentation using firewalls and VLANs?

Not exactly. Both aim to restrict communication between systems, but microsegmentation typically applies controls at a finer granularity, often at the workload or host level, rather than only at network perimeter boundaries. This can reduce lateral movement between systems that would otherwise share a coarse network zone. However, finer granularity does not automatically improve your PCI DSS position; the effect on scope still depends on implementation and on validation that the isolation performs as intended.

How should segmentation controls be validated to support a scope claim?

Segmentation that is relied upon to reduce scope should be tested to confirm that in-scope systems cannot reach, or be reached from, out-of-scope systems in ways that would bring the latter into scope. Testing is intended to verify that the controls operate as designed rather than assuming they do. Confirm the required testing approach, frequency expectations, and documentation against the current published PCI DSS, as wording and numbering differ between versions.

What kinds of traffic should microsegmentation policies restrict around the cardholder data environment?

Policies are generally intended to permit only the communication necessary for business or operational function to and from systems in the cardholder data environment, and to deny other flows by default. This helps reduce unnecessary connectivity and may limit lateral movement. The specific flows to allow depend on your architecture, and each permitted path should be justified and documented so it can be assessed.

How does microsegmentation interact with the data-protection techniques applied to stored data?

Microsegmentation addresses connectivity and isolation between systems; it does not transform data. Techniques such as tokenization, encryption, truncation, masking, and hashing affect the data itself in different ways. Microsegmentation may complement these by limiting which systems can reach environments where cardholder data is processed or stored, but it does not substitute for the storage and handling controls those techniques support. Note that sensitive authentication data must not be retained after authorization regardless of network isolation.

How is microsegmentation typically maintained as an environment changes?

Because workloads and connectivity change over time, policies generally need to be reviewed when systems are added, moved, or reconfigured, so that isolation relied upon for scope continues to hold. Change management and periodic re-testing of segmentation are commonly used to confirm the controls still operate as intended. Confirm any expected frequency and documentation requirements against the current published PCI DSS rather than assuming a fixed interval.

Common misconceptions

Microsegmentation by itself removes a system from PCI DSS scope automatically.

Applying a segmentation label does not by itself reduce scope. Scope reduction depends on the implementation being correctly configured, maintained, and validated (for example through segmentation penetration testing). If segmentation is ineffective or unverified, the systems it was meant to isolate may remain in scope. Confirm current validation expectations against the published PCI DSS version rather than assuming a fixed requirement number.

Microsegmentation prevents breaches or eliminates lateral movement.

Microsegmentation is intended to limit and help contain lateral movement between workloads, but it does not guarantee prevention of compromise. Misconfigured policies, overly permissive rules, compromised credentials with authorized access, or gaps in enforcement can allow traffic across segments. It is one layer among many and should be paired with monitoring, access controls, and other safeguards.

Microsegmentation is just a more detailed firewall or VLAN.

While it shares goals with traditional segmentation, microsegmentation typically enforces policy at a much finer granularity (workload or application level) and often uses identity- or attribute-based rules rather than only network addresses. The distinction matters because the enforcement mechanism determines how the controls must be configured, monitored, and tested.

Best practices

Adopt a default-deny posture for east-west traffic and explicitly permit only the flows required between segments, documenting the business justification for each allowed path.

Clearly identify and isolate the cardholder data environment from out-of-scope systems, and document data flows so that segmentation boundaries align with where cardholder data is stored, processed, or transmitted.

Validate segmentation effectiveness through testing, such as penetration testing that confirms isolated segments cannot reach the CDE, and confirm the required scope and frequency against the current published PCI DSS version.

Monitor and log inter-segment traffic so policy violations, misconfigurations, and attempted lateral movement can be detected and investigated, recognizing that detection controls carry false-positive and false-negative trade-offs.

Review and update segmentation policies whenever workloads, applications, or network architecture change, so that isolation is not silently eroded over time.

Treat microsegmentation as one layer within a defense-in-depth strategy alongside access controls, encryption or tokenization, and monitoring, rather than relying on it as a standalone control.