Most organisations can say how many firewalls they own but not whether an attacker who lands on one laptop, or on one internet-facing appliance, could reach the systems that matter. This model describes five levels of network security maturity, from Ad hoc to Optimised, across six dimensions: segmentation, visibility and detection, edge and perimeter hardening, remote and zero trust access, network identity and access, and governance. Each dimension has observable indicators, self-assessment questions and the steps to move up a level. It is written for network and security architects, security operations leads, CISOs and the executives who fund network change. The discipline itself (layers, enforcement points, core services, threats) is covered in the Network Security Guide; this page assumes it and focuses on staged maturity.
Key takeaways
- Maturity is measured by blast radius. The test is how far an attacker can move from a compromised user device, server or edge appliance, and how quickly you would see it, not how many controls are deployed.
- Edge devices are the weakest dimension in most programmes. VPN concentrators, firewalls and remote access gateways are internet facing, privileged and often poorly logged, which is why threat actors target them.
- Level 3 means enforced and evidenced. At Defined, critical systems sit in segments with default-deny rules, firewall rules have owners and review dates, and network logs reach the SOC.
- Zero trust access is a Level 4 trait, not a Level 1 purchase. Replacing a VPN with a ZTNA product helps only when identity, device posture and application inventory are already in place.
- Machine traffic is where models stall. Service-to-service connections authorised by IP allowlist, shared SNMP communities and device admin accounts keep many organisations below Level 4.
The five levels
| Level | Name | Description |
|---|---|---|
| 1 | Ad hoc | The network is largely flat. Firewall rules accumulate without owners or expiry, and "any any" rules exist. Edge devices are patched when someone notices. Remote access is a VPN with password-only login for some users. There is no reliable network diagram or asset inventory, and network logs stay on the devices. |
| 2 | Developing | User, server and management networks are separated by VLANs and a core firewall, but many internal paths remain open. An inventory of network devices exists. Edge devices have a patch process and MFA for remote access users. Firewall and VPN logs are collected centrally but rarely reviewed. |
| 3 | Defined | Critical systems and administration interfaces sit in segments with default-deny rules. Every firewall rule has an owner, a business reason and a review date. Edge devices are hardened to a standard, patched against a defined timeline for known exploited vulnerabilities, and administered only from a management network. Network, DNS and VPN logs feed the SOC with tested detections. |
| 4 | Managed | Microsegmentation protects high-value workloads, and east-west traffic is monitored with flow or packet data. Users reach applications through identity- and device-aware access rather than broad network access. Rule changes are tested and deployed through change control, ideally as code. Segmentation is validated by testing, and metrics are reported to leadership. |
| 5 | Optimised | Access between users, services and workloads is decided per request from identity, device and context, consistent with zero trust principles. Segmentation policy is generated from observed dependencies and kept current automatically. Detection uses network behaviour baselines. Lessons from incidents, red team results and threat intelligence change the architecture. |
The levels follow the NHI Mgmt Group five-level scale. They line up with the CISA Zero Trust Maturity Model Version 2.0 stages (Traditional, Initial, Advanced, Optimal) in the Networks pillar, which covers network segmentation, traffic management, traffic encryption and network resilience. See the CISA Zero Trust Maturity Model Guide.
The six dimensions
| Dimension | Level 2 indicator | Level 3 indicator | Level 4 to 5 indicator |
|---|---|---|---|
| Segmentation | VLANs separate users, servers and management | Default-deny zones for critical systems; owned, reviewed rules | Workload microsegmentation; policy from observed dependencies |
| Visibility and detection | Firewall and VPN logs collected centrally | DNS, VPN, firewall and proxy logs in the SIEM with tested use cases | East-west flow monitoring, NDR or packet capture at key points; behaviour baselines |
| Edge and perimeter hardening | Device inventory and patch process | Hardening standard; management interfaces not internet facing; defined timeline for known exploited vulnerabilities | Integrity checking, end of life replacement plan, attack surface monitoring |
| Remote and zero trust access | VPN with MFA for users | Phishing-resistant MFA for privileged and third-party access; split by role | Application-level ZTNA with device posture; no broad network access for third parties |
| Network identity and access | Named admin accounts on major devices | Central AAA (RADIUS or TACACS+), no shared device credentials, 802.1X or NAC on sensitive sites | Workload identity (for example mutual TLS) for service-to-service traffic; device credentials vaulted and rotated |
| Governance | Network owner named; diagrams exist | Rule review cycle; change control; segmentation requirements in architecture standards | Metrics to leadership; segmentation validated by testing; architecture changes driven by incidents |
Why these dimensions
Segmentation and visibility decide whether an intruder can move and whether you see it. Edge hardening matters because public-facing applications and external remote services are among the most used initial access routes in MITRE ATT&CK (T1190 Exploit Public-Facing Application, T1133 External Remote Services). Remote access and network identity matter because valid accounts (T1078) let attackers use your own paths. Governance keeps rules from decaying back to Level 1. See the Network Segmentation Guide and the Edge Device Security Guide for the controls in depth.
Dimension to framework mapping
| Dimension | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 |
|---|---|---|---|
| Segmentation | PR.IR-01 | SC-7 Boundary Protection; AC-4 Information Flow Enforcement | Control 12 Network Infrastructure Management |
| Visibility and detection | DE.CM-01 | SI-4 System Monitoring | Control 13 Network Monitoring and Defense |
| Edge hardening | PR.IR-01; ID.RA-01 | CM-7 Least Functionality; RA-5 Vulnerability Monitoring and Scanning | Controls 4 and 7 |
| Remote and zero trust access | PR.IR-01 | SC-7; SC-8 Transmission Confidentiality and Integrity | Controls 6 and 12 |
| Governance | GV.OV-01 | CM-3 Configuration Change Control | Control 12 |
Self-assessment questions
Answer yes only with evidence (a rule export, a log query, a test report). Two or more "no" answers in a dimension place you below the level named.
Segmentation (Level 3)
- Can a standard user laptop reach the management interfaces of your firewalls, hypervisors or backup systems? If yes, you are below Level 3.
- Do your most critical systems sit in zones where inbound traffic is denied by default and every allowed flow is documented?
- Does every firewall rule have an owner, a reason and a review date, and were stale rules removed in the last 12 months?
Visibility and detection (Level 3 to 4)
- Do DNS, VPN, firewall and proxy logs reach the SIEM, with retention long enough to investigate an intrusion that began months ago?
- Do you have tested detections for VPN logins from unusual locations, new admin sessions on network devices and large outbound transfers? See the VPN and Firewall Log Detection Guide.
- Could you see lateral movement between two servers in the same segment?
Edge and perimeter hardening (Level 3)
- Is every internet-facing device in the inventory with its owner, software version and support end date?
- Are management interfaces of edge devices unreachable from the internet?
- When a vulnerability in one of your edge products is added to the CISA Known Exploited Vulnerabilities catalogue, do you patch or mitigate within a defined, measured timeline?
Remote and zero trust access (Level 3 to 4)
- Does every remote access path, including legacy VPN profiles and vendor portals, require MFA, and are unused accounts disabled?
- Do third parties get access to named applications only, rather than a network segment?
- Is device posture checked before access is granted?
Network identity and access (Level 3 to 4)
- Are network device administrators authenticated centrally with named accounts, and are local fallback credentials vaulted?
- Are SNMP communities, device API keys and service accounts used by monitoring and automation tools inventoried and rotated?
- Is service-to-service traffic between critical workloads authorised by identity rather than by IP address alone?
Governance (Level 4)
- Are network changes made through change control, and are rule sets kept as reviewed configuration or code?
- Has segmentation been validated by a penetration test or red team in the last year?
- Are network security metrics reported to leadership at least quarterly?
Where identity fits
Network devices and network tools run on non-human identities: local admin accounts on firewalls, TACACS+ service accounts, SNMP communities, API tokens used by orchestration and monitoring platforms, and certificates for VPN and mutual TLS. These credentials are often shared, rarely rotated and highly privileged, so one leaked config backup can expose the whole estate. Treat them as privileged accounts: vault them, rotate them, and log their use. At Level 4 and above, workload identity replaces IP allowlists for service traffic. See the Network Device Management Plane Hardening Guide, the SNMP Security Guide and the ZTNA Guide.
Scoring and evidence
Score each dimension separately and report the profile, not an average. A network that is Level 4 for remote access and Level 1 for edge hardening is a Level 1 risk at the edge, and an average of 2.5 hides that. Score each site or environment separately where they differ: data centre, cloud networks, branch offices and operational technology often sit at different levels.
| Dimension | Evidence that supports a Level 3 score |
|---|---|
| Segmentation | Rule base export showing default-deny between zones; zone diagram matching the rule base; rule review record |
| Visibility and detection | SIEM source list; detection rules with last test date; a sample investigation using network logs |
| Edge hardening | Edge inventory with versions and support dates; patch records against KEV entries; external scan showing no exposed management interfaces |
| Remote access | Identity provider policy showing MFA on every remote path; list of disabled dormant accounts; third-party access register |
| Network identity | AAA configuration; vault records for device credentials; rotation log for SNMP communities and API tokens |
| Governance | Change records for rule changes; last segmentation test report; quarterly metrics pack |
A level claimed without evidence should be scored one lower. Repeat the assessment every 12 months and after major changes such as a merger, a data centre exit or a move to a new remote access platform.
Moving up a level
- Level 1 to 2: get the basics visible. Build an inventory of network and edge devices with owners and support dates. Separate users, servers and management into VLANs behind a firewall. Turn on MFA for all remote access. Send firewall and VPN logs to a central store. Remove "any any" rules.
- Level 2 to 3: enforce and own. Define zones for critical systems and move them behind default-deny rules, in monitor mode first (log what would be blocked, then enforce), with a rollback plan for each change. Assign owners and review dates to every rule. Write a hardening standard for each edge product and move management interfaces to a dedicated network. Build and test SOC detections for network logs.
- Level 3 to 4: reduce trust inside. Microsegment high-value workloads, starting with crown jewels and administration paths. Replace broad VPN access with application-level access for third parties and privileged users first. Put rule changes through change control and, where tooling allows, configuration as code. Validate segmentation with testing. See the Zero Trust Network Segmentation Playbook for Flat Networks.
- Level 4 to 5: decide per request. Authorise service-to-service traffic by workload identity, generate segmentation policy from observed flows, and use behaviour baselines for detection. Feed red team and incident lessons back into the architecture.
Small organisations can reach Level 3 with a well-configured firewall, VLANs, MFA on remote access and a managed log service. Microsegmentation and ZTNA are usually Level 4 investments for larger or regulated environments, or for any organisation where a flat network connects to operational technology.
Metrics that show maturity
| Metric | What it shows | Level 3 to 4 target |
|---|---|---|
| Firewall rules with owner and review date | Rule hygiene | Above 95% |
| Time to patch or mitigate known exploited edge vulnerabilities | Edge exposure window | Within the timeline your policy sets, measured per device |
| Critical assets in default-deny segments | Segmentation coverage | 100% of crown jewels |
| Remote access paths requiring MFA | Remote access risk | 100%, including vendor and legacy paths |
| Network log sources in the SIEM | Visibility | All edge, DNS and core firewall devices |
| Segmentation test findings closed | Validated enforcement | All high findings closed before the next test |
Common failure patterns
- Segmentation on the diagram only. Zones exist but rules between them allow almost everything, so an intruder moves freely.
- Forgotten remote access paths. A legacy VPN profile, test portal or vendor gateway without MFA survives a modernisation project.
- Edge devices treated as appliances. They are patched slowly, not logged and administered from the internet, despite being prime targets. See the Edge Device Exploitation by Threat Actors Guide.
- Buying ZTNA before knowing the applications. Without an application inventory and device posture, the product is configured as a VPN with a new name.
- Shared device credentials. One admin password or SNMP community across hundreds of devices turns a single leak into estate-wide access.
- Rules that never die. Temporary rules for projects and vendors remain for years because nobody owns them.
Lessons from incidents
- Colonial Pipeline, 2021. Attackers entered through a legacy VPN profile tied to an account that was no longer in use but had never been disabled, and the VPN did not require MFA. The company shut down its pipeline to contain the ransomware. The lesson: every remote access path must be inventoried and protected, and business IT must be separated from operational systems. See the Colonial Pipeline Ransomware Attack 2021.
- Change Healthcare, 2024. A stolen credential on a remote-access portal without MFA led to lateral movement, data theft and ransomware. The lesson: remote access without strong authentication and internal segmentation turns one login into an enterprise incident. See the Change Healthcare Breach 2024.
Practitioner checklist
- Inventory every network and edge device with owner, version and support end date.
- Remove "any any" rules and give every remaining rule an owner and review date.
- Put critical systems and admin interfaces behind default-deny segments, monitor mode first.
- Require MFA on every remote access path; disable unused VPN accounts and profiles.
- Take edge management interfaces off the internet and patch known exploited vulnerabilities against a set timeline.
- Send DNS, VPN, firewall and proxy logs to the SIEM with tested detections.
- Vault and rotate device admin credentials, SNMP communities and automation tokens.
- Validate segmentation with testing at least annually and report metrics quarterly.
Standards and references
- CISA: Zero Trust Maturity Model Version 2.0
- NIST: SP 800-207, Zero Trust Architecture
- NIST: SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls v8.1
- NCSC: Zero trust architecture design principles
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Network Security Guide · Network Segmentation Guide · Edge Device Security Guide · CISA Zero Trust Maturity Model Guide · Microsegmentation Buyers Guide