Provider Assigned Address Space is IP address space that an internet provider assigns from its own allocated range. The prefix stays under the provider’s control and is typically reused or renumbered when the customer changes service or the provider changes routing arrangements.
What provider assigned address space means
Provider assigned address space is a routed IP prefix that remains under the internet provider’s control rather than the customer’s. That makes the address space part of the provider’s allocation and routing model, not a portable block owned outright by the subscriber. In practice, it is often tied to service continuity, not long-term customer permanence.
This distinction matters because the public Internet sees the prefix as belonging to the provider’s infrastructure and routing decisions, even when the customer is the day-to-day user of the addresses. The provider can renumber the customer, withdraw the route, or change how the prefix is advertised when commercial or routing arrangements change.
How provider assigned address space behaves operationally
The operational trait of provider assigned address space is control by the upstream network operator. The provider advertises the prefix, manages reachability, and decides whether the customer keeps the same addressing after a contract change, uplink migration, or routing reconfiguration. That is why these prefixes are usually treated as assigned, not customer-owned assets.
For network engineers, the practical consequence is that the address plan must assume possible renumbering. Any service design that embeds the prefix into DNS records, firewall rules, allowlists, logging expectations, or partner integrations may need updating if the provider changes the assignment. The more the address is used as an external trust signal, the more careful the design needs to be.
Why the distinction matters for routing and resilience
Provider assigned space is different from portable or independently allocated space because the customer’s continuity depends on the provider’s routing policy and address management. That creates a dependency on the upstream provider’s operational stability, announcement discipline, and customer migration process. A change in provider or routing arrangement can turn a previously valid prefix into a stale dependency.
It also affects resilience planning. Services exposed on provider assigned space may be reachable today but become brittle if the prefix is renumbered unexpectedly. A resilient design separates service identity from the address itself, so that routing changes do not silently break external connectivity, access rules, or monitoring assumptions.
Where provider assigned address space is commonly used
This model is common in ordinary Internet service, branch connectivity, hosting, and other environments where the provider wants to keep address control centralized. It is a straightforward operational arrangement, but it is not the same as address portability. When a business needs stable public reachability across network changes, the design should account for the fact that the prefix may move or be replaced.
That is why provider assigned address space is best understood as a routing relationship as much as an addressing one. The customer uses the space, but the provider owns the assignment and can change the routing context around it. For that reason, documentation, change management, and external dependency reviews should reflect the provider as the controlling party.
Risk and Threat Considerations
Provider assigned address space can create operational exposure when organisations assume the prefix is fixed, durable, or under their exclusive control. If that assumption is wrong, renumbering, route withdrawal, or routing changes can disrupt services, break partner allowlists, and expose stale records that still reference the old prefix.
Failure mechanism: The failure mode is trust in an address block that is externally controlled, which means the customer may lose continuity when the provider changes allocation or routing behaviour.
Impact: The result can be service outage, access failure, misdirected traffic, or lingering security rules that no longer match the active exposure surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Provider assigned address space depends on accurate inventory of externally reachable systems and prefixes. |
| GV.SC-01 — Cybersecurity supply chain risk management strategy is established | The prefix is controlled by an upstream provider, creating a third-party dependency risk. | |
| PR.IR-01 — Networks are protected against unauthorized access and malicious traffic | Provider assigned address space can change and must be defended through stable network-control design. | |
| Recommendation — Inventory every system using the provider-assigned prefix so renumbering and exposure changes are visible. Define provider dependency assumptions and review them whenever routing or service arrangements change. Use adaptable network controls that do not rely on a permanently fixed provider-assigned address. | ||
Practitioner Guidance
Why practitioners should care: Treat provider assigned space as a dependency, not a permanent asset. If a service, control list, or external partner process depends on the prefix remaining stable, the network design should explicitly account for renumbering and provider change scenarios.
What to watch for: Watch for hard-coded IP references in allowlists, DNS, monitoring, partner integrations, and documentation. Those are the places where a provider-controlled prefix most often turns into an availability or access problem during change.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org