Cyber Resilience

← ISO 27001 Annex A

A.8.22 Technological

Segregation of networks

AttributesPreventive C·I·A Protect System and network security Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (14)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-18←M AC-4←M →M SC-32←M →M SC-40←P SC-7←F →M

Why these map — AI rationale (under review)

AC-4mostlyaligns with — Both controls enforce information flow restrictions between network segments by requiring gateway controls and policy-based decisions on permitted traffic between domains.
AC-4mostlycovers — A.8.22's network segmentation and boundary traffic control directly implements the core of AC-4's information flow enforcement between connected systems; residual exists in AC-4's intra-system flow rules that network-level segregation reaches only partially.
SC-32mostlyaligns with — The ISO control's use of separate network domains to isolate systems of differing criticality and sensitivity directly supports the NIST objective of partitioning the system into distinct components with defined security boundaries.
SC-32mostlycovers — A.8.22's network segmentation and traffic control based on business needs accounts for the bulk of SC-32's partitioning into separate domains/environments, but leaves a residual of non-network (e.g., application/process/memory) partitioning and non-business criteria (e.g., risk, criticality) uncovered
SC-7mostlycovers — Both controls require dividing networks into distinct segments with controlled gateways at the boundaries to enforce security policies based on trust levels and information sensitivity.
SC-2partialaligns with — Network domain segregation contributes to separating user-facing and system-facing functions by isolating different trust levels and organizational functions into distinct network segments.
SC-3partialaligns with — By placing security enforcement points (gateways) at domain perimeters, the ISO control supports isolation of security functions from less-trusted network zones.
SC-2covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
SC-3covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (14)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

PR.IR-01←F →M ID.AM-03gov ID.AM-05gov PR.AA-05gov PR.PS-01gov

Why these map — AI rationale (under review)

PR.IR-01mostlycovers — Network domain segregation with perimeter gateways directly implements the outcome of protecting networks and environments from unauthorized logical access.
ID.AM-03partialaligns with — Mapping domains and their trust boundaries contributes to maintaining representations of authorized network communication and data flows.
PR.AA-05partialaligns with — Defining and enforcing access rules between network domains through gateways aligns with managing and reviewing access permissions and authorizations.
PR.PS-01partialaligns with — Establishing domain boundaries and gateway controls is a form of configuration management applied to the network infrastructure.
ID.AM-03implements — A.8.22's technical segregation and traffic-control mechanisms give operational effect to maintaining accurate representations of authorized flows (ID.AM-03) within the asset-management domain, but the CSF outcome does not name segregation specifically.
PR.AA-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (10)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V12.3.3←M V12.3.5←M →P V13.2.4←P →M V13.2.5→M V3.5.2←P V3.5.4←M →P V8.4.1→P

Why these map — AI rationale (under review)

V13.2.4mostlycovers — Defining perimeters and controlling inter-domain traffic through gateways implements an allow-list of permitted external or internal communication targets.
V13.2.5mostlycovers — Gateway-enforced access rules between domains equate to configuring the web or application server with an allow-list of resources it may reach.
V12.3.5partialaligns with — Segregating networks by trust level and routing traffic through controlled gateways provides the strong authentication and isolation required for intra-service communications.
V3.5.4partialaligns with — Network-domain segregation based on trust and sensitivity directly supports hosting separate applications on distinct hostnames to enforce same-origin policy boundaries.
V8.4.1partialaligns with — Dividing networks into domains according to organizational units or risk levels helps ensure that operations in one tenant cannot affect another.

Related weaknesses / CWE (38)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-673noneprevents — Network segregation reduces external actors' ability to influence sphere definitions across domains.
CWE-1125prevents — Network segregation limits lateral exposure and therefore the effective attack surface.
CWE-1327mitigates — Network segregation can limit the blast radius of an unrestricted binding but does not prevent the binding itself.
CWE-200prevents — Limiting which domains can communicate reduces the number of systems that can receive or observe sensitive data, lowering the chance of accidental or malicious exposure.
CWE-207mitigates — Network segregation can prevent attackers from observing behavioral differences across products.
CWE-284mitigates — Network domain segregation with perimeter gateways enforces explicit boundaries and access mediation, directly stopping unauthorized actors from reaching resources they should not touch.
CWE-285mitigates — By requiring gateways to evaluate every cross-domain request against security requirements, the control stops requests from bypassing intended authorization checks.
CWE-291mitigates — Network segregation reduces the attack surface but does not replace authentication.
CWE-300mitigates — Network segregation reduces exposure but does not verify endpoint identity or channel integrity.
CWE-346mitigates — Network segregation reduces exposure but does not directly validate origins.
CWE-385mitigates — Network segregation limits external timing observation but not internal covert timing.
CWE-402mitigates — Network segregation reduces blast radius but does not prevent the product from leaking resources.
CWE-419mitigates — Network segregation can isolate the primary channel from untrusted networks.
CWE-420mitigates — Network segregation can reduce exposure of alternate channels but does not guarantee equivalent protection levels.
CWE-421mitigates — Segregating networks limits the reach of alternate communication paths to unintended parties.
CWE-509mitigates — Network segregation restricts worm propagation across segments.
CWE-514mitigates — Segregating networks reduces inter-zone covert channels, yet leaves intra-zone or process-level channels untouched.
CWE-515mitigates — Network segregation reduces opportunities for covert storage between domains but does not address intra-process channels.
CWE-553mitigates — Network segregation reduces reachability of the vulnerable directory but does not eliminate the weakness.
CWE-653prevents — Network segregation is a classic technical control for isolating different privilege domains.
CWE-668mitigates — Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.
CWE-669mitigates — Network segregation directly limits unintended resource movement between spheres.
CWE-862mitigates — Mandatory gateway enforcement at each domain boundary ensures that missing authorization checks inside an application cannot be reached without first passing an external control point.
CWE-923mitigates — Network segregation reduces exposure but does not itself validate specific endpoints.
CWE-940mitigates — Network segregation limits exposure but does not directly verify source of individual channels.
CWE-941mitigates — Network segregation reduces exposure but does not address destination specification within allowed segments.

Mitigated MITRE ATT&CK techniques (534)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.001←M T1001.002←M T1001.003←M →P T1003→P T1003.003→P T1003.006→P T1003.008→P T1006←M T1008←M →P T1011←M →P T1011.001←M →P T1014←M T1016.001→P T1016.002→P T1018←M →P T1020←M →P T1020.001←M →P T1021←M →P T1021.001←M →P T1021.002←M →P T1021.003→P T1021.004←M →P T1021.005←M →P T1021.006←P →P T1021.007←M T1021.008←M →P T1027.002←M T1027.003←P T1027.006←M T1027.008←P T1027.010←M T1027.011←P T1027.014←M T1027.017←P T1029←M T1030←M →P T1036.003←M T1036.005←M T1036.008←M T1036.009←M T1036.012←M T1037.003←P →P T1039←M →P T1040→P T1041←M →P T1046←M →P T1047←M →P T1048←M →P T1048.001←M →P T1048.002←M →P T1048.003←M →P T1052←M →P T1052.001←M →P T1055←M →P T1055.001←M T1055.002←M T1055.003←M →P T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1059→P T1059.004→P T1059.007→P T1059.008←P T1059.009→P T1068←M T1070←M T1070.010←M T1071←M →P T1071.001←M →P T1071.002←M →P T1071.003←M →P T1071.004←M →P T1071.005←M →P T1072→P T1074→P T1074.001→P T1074.002←M →P T1078←P →P T1078.001←P T1078.002←P →P T1078.003←P T1078.004←M T1080←M →P T1090←M →P T1090.001←M →P T1090.002←M →P T1090.003←M →P T1090.004←M T1091←M →P T1092←M →P T1095←M →P T1098.001←M T1098.005←M T1102←M →P T1102.001←M →P T1102.002←M →P T1102.003←M →P T1104←M T1105←M →P T1110←P →P T1110.001→M T1110.003←M →P T1110.004←M →P T1111←P T1114.002←P →P T1119→P T1127←M T1132←P T1132.001←M T1132.002←M T1133→P T1134←M T1134.001←M T1134.002←P T1134.003←M T1134.004←P T1134.005←M T1135←P →P T1185←M →P T1187←M →P T1189←M →P T1190←M →M T1199←M →P T1200←M T1202←P T1203←P →P T1204←M T1204.001←M T1204.002←M T1204.004←P T1205←M →P T1205.001←M →P T1205.002←M T1207←M T1210←M →P T1211←P T1213→P T1213.001←M T1213.002←M T1213.003→P T1213.006→P T1216←P T1218←M T1218.005←M T1218.007←P T1218.012←P T1218.013←M T1219←M →P T1219.001←M →P T1219.002←M →P T1219.003←M →P T1221←P T1222←M T1222.001←P T1222.002←M T1480←P T1480.001←P T1484←M T1484.001←P T1484.002←M →P T1485→P T1486→M T1496→P T1496.001→P T1496.002→P T1497←P T1498←M →P T1498.001←M →P T1498.002→P T1499←P →P T1499.001→P T1499.002←M →P T1499.003→P T1505.003←M →P T1528←M T1530→P T1534←P T1535←M T1537←M →P T1539←M T1542←M T1542.002←M T1542.005→P T1546.003→P T1548←P T1550←M T1550.001←M T1550.002←M T1550.003←M →P T1550.004←F T1552.005←M →P T1552.007→P T1552.008←M →P T1553.002←P T1553.003←M T1553.004←P T1553.005←M T1556←M T1556.001←M T1556.006←M T1556.007←M T1556.009←M T1557←M →P T1557.001←M →P T1557.002←M →P T1557.003←M →P T1557.004←M →P T1558←P →P T1558.001←M T1558.002←M T1560←P T1560.003←P T1561→P T1561.001→P T1561.002→M T1563→P T1563.001→P T1563.002←M →P T1565.002→P T1566.002←M T1566.003←M T1566.004←P T1567→P T1567.001←M →P T1567.002←M →P T1567.003←M →P T1567.004←M →P T1568←M →P T1568.001←M T1568.002←M T1568.003←M →P T1570←M →P T1571←M →P T1572←M →P T1573←M T1574←M T1574.001←M T1574.004←M T1574.008←P T1578←M T1578.001←M T1578.002←M T1578.003←M →P T1578.004←M T1578.005←M T1580→P T1583←M T1583.003←M T1583.007←M T1584←M T1584.003←M T1584.004←M T1584.007←M T1584.008←M T1587.004←P T1590.003←P T1590.004→P T1595←M →P T1595.001→P T1595.002→P T1595.003→P T1599→M T1599.001←M →P T1600←P T1600.001←P T1601←P T1601.001←M T1601.002←M T1602→P T1602.001→P T1602.002→P T1606←M T1606.001←M T1606.002←M T1608.004←M T1610←P →P T1611←M →P T1612←P T1620←M T1621←P T1647←P T1649←P T1659←M →P T1665←M T1666←M T1669←M →M T1678←P T1685←M T1685.002←M T1685.003←M T1685.005←M T1686←M →P T1686.001←M →P T1686.002←M →P T1686.003←M →P T1687←P T1688←M T1689←P

Why these map — AI rationale (under review)

T1001.003prevents — Network segregation plus perimeter gateways (firewalls) can block or filter impersonated C2 traffic that does not match allowed domain-to-domain rules or expected protocols, but the control does not stop the adversary from crafting the impersonation itself or using allowed legitimate-looking traffic that blends in.
T1003detects — A.8.22's network segmentation and perimeter gateways can surface anomalous credential-dumping traffic or lateral-movement patterns crossing domain boundaries, but the technique itself executes in host memory/OS structures with no inherent network component, so detection is limited to the subset that crosses monitored perimeters.
T1003prevents — network segregation with perimeters and gateways can block lateral movement paths that credential dumping relies on to reach other systems or exfiltrate material, but does not stop the initial local dumping from OS caches/memory on a compromised host
T1003.003prevents — Network segregation into domains (with perimeters and gateways) can prevent an adversary from reaching a domain controller or its NTDS.dit file from lower-trust segments, but leaves the technique fully executable once inside the high-trust/server domain where DCs normally reside.
T1003.006detects — A.8.22's perimeter gateways and domain segregation (with monitoring implied at boundaries per related 8.20) can surface anomalous replication traffic from non-DC hosts or unusual sources, but the technique itself is a legitimate-looking DRSR API call from a privileged domain account that does not inherently cross a network boundary or generate detectable perimeter anomalies in all implementations.
T1003.006prevents — Network segregation with well-defined perimeters and gateway controls (firewalls) at domain boundaries can prevent DCSync replication traffic from untrusted/low-trust zones or guest wireless to domain controllers, but does not stop the technique when run from an already-authorized high-privilege account inside the server/domain-controller domain.
T1003.008prevents — Network segregation with perimeters and gateways can block lateral movement or remote access needed to reach a Linux host and run cat/unshadow on the files, but does not stop the technique once an adversary has local access (e.g. via initial foothold, compromised account, or insider) on that host.
T1008detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous fallback traffic crossing defined boundaries, but the control's scope is network segmentation rather than mandating detection instrumentation, leaving most in-process or encrypted fallback channels unseen.
T1008prevents — network segregation into domains with perimeter gateways (firewalls) can block or constrain many fallback C2 channels that cross trust boundaries, but leaves open same-domain, wireless, or stealthy channels that do not violate the defined segregation rules
T1011detects — A.8.22 requires well-defined perimeters, gateways and monitoring of traffic between segregated domains (including special treatment and gateway passage for wireless), which can surface anomalous exfiltration over alternate media such as WiFi/cellular/Bluetooth when it crosses a controlled boundary, but does not mandate instrumentation on the alternate media themselves or on endpoints using them.
T1011prevents — A.8.22's segregation of networks into domains (including wireless/guest treatment and perimeter gateways) directly constrains exfiltration over alternate media by forcing such paths through defined, assessed boundaries and controls, but leaves residual paths (e.g., proximity-based Bluetooth/RF or unmonitored guest WiFi) that the control's own guidance does not fully eliminate.
T1011.001detects — A.8.22 requires monitoring and control at well-defined wired/wireless perimeters and gateways (with wireless often treated as external until gatewayed); this surfaces anomalous Bluetooth exfiltration that crosses or evades those boundaries, but Bluetooth's short-range, non-routed nature means much of it can occur inside a domain or without triggering perimeter controls.
T1011.001prevents — A.8.22's segregation of networks into domains (by trust/criticality) and perimeter gateways can block Bluetooth exfiltration when treated as an external/wireless channel (per its explicit wireless guidance), but leaves a remainder where proximity-based Bluetooth bypasses internal wired domains without triggering the assessed gateway controls.
T1016.001prevents — Network segregation plus perimeter gateways can block outbound discovery probes (e.g. to external ping/HTTP targets) from selected internal domains, stopping the technique from succeeding, but the control's domain-based scoping, guest-wireless carve-outs, and allowance for assessed legitimate outbound paths leave a substantial slice of systems and traffic where the check can still run.
T1016.002prevents — A.8.22's segregation of wireless networks (treating guest Wi-Fi as external, radio coverage adjustment, gateway enforcement before internal access) constrains some discovery vectors on compromised hosts by limiting reachable networks and credential exposure across boundaries, but does not stop local enumeration commands or file reads on an already-compromised endpoint.
T1018prevents — Network segregation into domains with perimeters and gateways directly blocks many cross-domain discovery techniques (e.g. ping, net view, ARP across boundaries), but leaves same-domain discovery, local host files, passive cache entries, and intra-domain infrastructure queries untouched.
T1020detects — Network segregation and perimeter gateways (firewalls) can be instrumented to detect anomalous outbound traffic patterns indicative of automated exfiltration, but this is scoped only to boundary crossings and does not broadly detect the automated processing itself across all platforms or internal collection phases.
T1020prevents — network segregation plus perimeter gateways can block automated exfiltration paths that cross domain boundaries or attempt outbound transfer from internal to external networks, but does not stop exfiltration that stays inside an allowed domain or uses already-permitted channels
T1020.001prevents — Network segregation and perimeter gateways directly block many forms of traffic mirroring/redirection to attacker-controlled infrastructure (especially on-prem and guest-wireless paths), but the control does not address cloud-native mirroring features, ROMMON/patch attacks on devices inside a domain, or insider-enabled mirroring within a trusted segment.
T1021prevents — Network segregation with defined perimeters and controlled gateways (firewalls) directly blocks lateral use of remote services like SSH/RDP between low-trust or high-risk domains even after credential compromise, but leaves intra-domain remote logons and certain wireless/guest paths reachable.
T1021.001detects — A.8.22 requires monitoring and control of traffic at well-defined domain perimeters/gateways (including treating wireless as external until gatewayed), which can surface anomalous RDP connections crossing boundaries but does not instrument or observe the RDP login itself on an already-authorized internal endpoint.
T1021.001prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block RDP traffic between untrusted domains or from external networks, stopping the technique from reaching the target; partial because RDP often uses legitimate internal accounts/ports allowed by business-driven rules, and wireless/guest guidance is narrower than the full technique surface.
T1021.002detects — A.8.22 requires monitoring and control of traffic at well-defined domain perimeters/gateways (e.g. firewalls); this can surface anomalous SMB admin-share connections crossing boundaries, but the control's scope is limited to perimeter traffic and does not mandate host-level or intra-domain detection of the technique.
T1021.002prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block SMB traffic between domains based on trust/criticality, stopping lateral movement to admin shares; partial because it depends on chosen domain boundaries, allowed gateway rules, and does not block intra-domain SMB or authenticated use within the same segment.
T1021.003prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block DCOM/RPC traffic between domains or from external sources, stopping the technique from reaching remote machines; partial because it does not address intra-domain lateral movement, ACL misconfigurations, or already-privileged users inside the same trust boundary.
T1021.004prevents — Network segregation with perimeters and gateways can block unauthorized SSH access between domains (e.g. preventing lateral movement from a compromised low-trust segment), but does not stop valid-account SSH logins within a domain or on systems where the adversary already has foothold access.
T1021.005detects — A.8.22 requires monitoring and control at well-defined network perimeters/gateways between domains (including treating wireless as external until gatewayed), which can surface anomalous VNC traffic crossing boundaries but does not instrument or observe the technique's in-host execution or use of valid accounts.
T1021.005prevents — Network segregation with defined perimeters and controlled gateways (e.g. firewalls) can block unauthorized VNC traffic between domains based on trust/criticality, stopping the technique from reaching internal targets; partial because it does not stop VNC use within a permitted domain or via allowed legitimate accounts.
T1021.006detects — A.8.22's perimeter gateways and domain monitoring for anomalous cross-boundary traffic can surface WinRM usage that violates defined trust, access, or domain rules, but this is limited to observable boundary crossings rather than all WinRM instances (e.g., intra-domain or non-perimeter use).
T1021.006prevents — Network segregation with defined perimeters and controlled gateways (e.g. firewalls) can block unauthorized WinRM traffic between domains based on trust/criticality, preventing the technique from reaching remote systems; partial because it depends on policy-driven configuration, does not address intra-domain use or already-authenticated sessions, and leaves wireless/guest edge cases as named remainders.
T1021.008prevents — Network segregation into domains with perimeter gateways (firewalls) can block unauthorized direct access paths to cloud VMs from other network segments or the internet, but the control does not address cloud-native API-driven console methods, authentication tokens, or intra-cloud pivoting that bypass traditional network boundaries.
T1030detects — A.8.22's perimeter gateways and domain segregation (with traffic control based on assessed requirements) can surface anomalous chunked exfiltration patterns at domain boundaries, but this is limited to observable flows crossing perimeters rather than reliably detecting the technique itself across all platforms, wireless, or internal lateral movement.
T1037.003detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous logon-script execution or traffic at boundaries, but the control's focus is segregation rather than mandated detection of this persistence technique inside domains.
T1039detects — A.8.22 requires monitoring and control of traffic at well-defined domain perimeters/gateways (e.g. firewalls), which can surface anomalous access to or from network shares as part of perimeter traffic inspection, but this is limited to boundary flows and does not broadly detect the technique once an adversary is already inside a domain using local commands on a compromised host.
T1039prevents — A.8.22's domain segregation and perimeter gateways can prevent the technique from reaching shares in other domains (especially high-trust or sensitive ones) by blocking unauthorized cross-domain access, but cannot prevent access to shares within the already-compromised domain where the adversary is running.
T1040prevents — Network segregation into domains with perimeters and controlled gateways (firewalls) directly stops sniffing across boundaries by limiting what traffic an adversary on one domain can passively observe, especially on wireless/guest segments; it leaves same-domain sniffing, unencrypted intra-domain traffic, and cloud mirroring/spanning fully reachable.
T1041detects — A.8.22's perimeter gateways and domain segregation enable monitoring and anomaly detection of outbound C2 traffic at well-defined boundaries (especially for wireless/external), but do not mandate or guarantee detection of encoded exfiltration within already-allowed C2 channels.
T1041prevents — A.8.22's network segregation and perimeter gateways (firewalls) can block or filter outbound C2 traffic carrying exfiltrated data based on domain trust boundaries and access policy, but this is only a slice: it does not stop all C2 protocols, encrypted channels, or exfil that blends with allowed traffic, nor does it address all platforms or wireless edge cases.
T1046detects — A.8.22's perimeter gateways and domain segregation (with wireless special handling) can instrument and surface anomalous discovery scans crossing boundaries, but the control's purpose and guidance focus on prevention via segmentation rather than mandated detection, leaving most intra-domain or non-perimeter discovery (e.g., local mDNS/Bonjour, cloud lateral) unreached.
T1046prevents — Network segregation into domains with perimeter gateways (firewalls) directly blocks many forms of remote port/vulnerability scanning and mDNS/Bonjour queries across trust boundaries, but leaves intra-domain discovery, local scans, and guest-wireless edge cases intact.
T1047detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous WMI traffic (esp. remote DCOM/WinRM on ports 135/5985-6) crossing trust boundaries, but local WMI abuse and in-domain activity fall outside its network-segregation scope.
T1047prevents — Network segregation plus perimeter gateways can block remote WMI (ports 135/5985/5986) between domains or from external networks, but cannot stop local WMI abuse inside a compromised domain or on a system already inside the allowed boundary.
T1048detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous protocol use or traffic at boundaries (especially for wireless/guest networks), but the control's core purpose is segregation rather than broad detection of in-domain exfiltration over alternate protocols or cloud APIs.
T1048prevents — Network segregation into domains with perimeter gateways (firewalls) can block many alternate-protocol exfiltration paths (e.g. SMB, FTP, DNS) between trust zones, but leaves open same-domain exfil, allowed gateway rules, cloud APIs, and wireless/guest bypasses.
T1048responds — network segregation and perimeter gateways (firewalls) can detect and contain anomalous exfiltration traffic crossing domain boundaries once underway, but only for traffic that traverses a monitored gateway; many alternate-protocol cases (cloud APIs, direct console downloads, intra-domain exfil, obfuscated channels) remain outside the control's perimeter enforcement
T1048.001detects — A.8.22's perimeter gateways and domain segregation (with wireless treated as external) can surface anomalous exfiltration flows at defined boundaries, but the control only sets requirements for segregation and gateway policy rather than mandating specific detection instrumentation or monitoring of symmetric-encrypted non-C2 traffic.
T1048.001prevents — Network segregation and perimeter gateways (firewalls) can block or restrict the outbound exfiltration channel on non-C2 protocols when it crosses a defined domain boundary, but this is only a slice: the technique can still succeed inside a permitted domain, via allowed protocols/ports, from compromised endpoints already inside the high-trust segment, or by blending with permitted traffic.
T1048.002detects — A.8.22 requires well-defined perimeters and gateway-based traffic control between domains (including treating wireless as external until gatewayed), which surfaces anomalous exfiltration flows crossing those boundaries; it is silent on deep-packet inspection or protocol-specific detection of asymmetric exfil inside an allowed channel, leaving most of the technique unseen.
T1048.002prevents — Network segregation plus perimeter gateways (firewalls) can block or restrict outbound exfiltration flows to untrusted external destinations over protocols such as HTTPS, directly stopping many instances of the technique; it is only partial because the control's domain boundaries and gateway rules are scoped by business needs and risk assessment rather than universally prohibiting all asymmetric-encrypted outbound channels an adversary could abuse.
T1048.003detects — A.8.22 requires well-defined perimeters and gateways (e.g. firewalls) that monitor and control inter-domain traffic based on assessed security requirements, which can surface anomalous exfiltration over unencrypted non-C2 protocols at those boundaries; however, the control's scope is set by business-driven domain segregation rather than mandating instrumentation for all possible exfil channels or protocols, leaving many intra-domain or wireless cases as an implementer-chosen slice.
T1048.003prevents — Network segregation plus perimeter gateways (firewalls) can block or filter many unencrypted exfiltration channels (e.g. blocking outbound FTP/HTTP to unauthorized destinations or isolating high-value domains), but cannot stop all protocol abuse, obfuscation, or exfil from already-authorized network paths.
T1052prevents — A.8.22's segregation into domains (including air-gapped/high-risk ones) and perimeter gateways can block the network pathways that would allow data to reach a removable medium in the first place, but the technique's core (user-introduced physical media on an already-compromised air-gapped system) sits outside network boundaries and is not stopped by them.
T1052.001detects — A.8.22 requires well-defined perimeters and gateways that monitor/control traffic between domains (including treating wireless as external until gatewayed), which can surface anomalous USB-based exfiltration attempts crossing those boundaries, but the control's focus is logical network segregation and does not address physical USB device insertion or data staging on air-gapped systems.
T1052.001prevents — A.8.22's network-domain segregation and perimeter gateways (including air-gap treatment of wireless as external) can block USB-mediated hops between disconnected systems when those systems sit in differently-trusted domains, but cannot stop a user from copying data onto a USB device that stays inside the same domain or is physically carried out.
T1055detects — A.8.22 requires monitoring and control at well-defined network domain perimeters (gateways/firewalls) and treats wireless as external until gateway-checked, which can surface anomalous cross-domain process-injection traffic or IPC channels when they cross boundaries, but most in-process injection (same host, no network) is invisible to network segregation.
T1055.003detects — Network segregation and perimeter gateways can surface anomalous cross-domain traffic or connections that result from the hijacking (e.g. when the injected thread reaches out over the network), but the core in-process memory manipulation occurs locally with no network component and is invisible to A.8.22.
T1059prevents — network segregation and perimeter gateways can block lateral movement or remote execution paths that rely on interpreters across domains, but the technique itself (local abuse of built-in shells, scripts, or embedded payloads) remains fully available inside any given domain
T1059.004prevents — Network segregation and perimeter gateways can block initial access vectors (e.g. SSH lateral movement or C2 reaching a Unix shell on a high-trust domain), but cannot stop abuse of an already-present local shell once the adversary is inside the domain or on an allowed path.
T1059.007prevents — Network segregation plus perimeter gateways can block many common delivery vectors for JS/JScript/JXA payloads (web drive-by, lateral download of secondary payloads) but leaves local JS interpreters, in-memory execution, and same-domain abuse untouched.
T1059.009prevents — Network segregation plus perimeter gateways can block some abuse vectors (e.g. guest WiFi or external shells reaching internal tenant APIs) but leaves the dominant case (authenticated API calls from inside a permitted domain or via stolen credentials) untouched.
T1071prevents — Network segregation plus perimeter gateways (firewalls) can block or filter many application-layer C2 protocols at domain boundaries, but internal enclave traffic (SMB/SSH/RDP) and blending with allowed protocols remain unaddressed.
T1071.001detects — A.8.22's perimeter gateways and domain segregation enable traffic inspection and anomaly detection at well-defined boundaries (especially for non-web or guest wireless flows), surfacing some blended C2 that deviates from assessed domain policy, but the control itself only sets up boundaries rather than mandating detection mechanisms and leaves internal web-mimicking traffic largely untouched.
T1071.001prevents — Network segregation plus perimeter gateways (firewalls) can block or filter the outbound C2 web-protocol channels that T1071.001 relies on to reach adversary infrastructure, but the control does not stop the technique from running inside a permitted domain or over allowed web traffic that blends with legitimate flows.
T1071.002prevents — Network segregation plus perimeter gateways (firewalls) can block or filter the outbound/inbound file-transfer protocol traffic used by the technique, especially when domains are chosen by trust or sensitivity; it is only a slice because common internal protocols (SMB) often must remain allowed between authorized domains, wireless/guest networks are a bounded exception, and the control does not reach protocol steganography inside permitted flows.
T1071.003detects — A.8.22's perimeter gateways and domain segregation enable traffic monitoring/filtering at boundaries that can surface anomalous mail-protocol C2 blending with legitimate SMTP/POP3/IMAP flows, but this is scoped only to defined perimeters rather than all internal lateral movement or non-gateway paths.
T1071.003prevents — network segregation plus perimeter gateways can block or filter the outbound/inbound mail-protocol C2 flows when they cross domain boundaries (especially guest/wireless to internal), but the technique can still run entirely inside a single domain or by blending with permitted mail traffic that the gateway assessment allows
T1071.004detects — A.8.22 requires well-defined perimeters and gateways (e.g. firewalls) that can implement traffic controls and monitoring between domains based on assessed security requirements, which surfaces anomalous or tunneled DNS blending with legitimate traffic at those boundaries; however, it is a network architecture control whose scope is set by business-driven domain choices rather than mandating instrumentation depth, leaving internal lateral movement or unmonitored segments as an implementer-chosen slice (cf. A.8.16 vs T1055 partial anchor).
T1071.004prevents — Network segregation plus perimeter gateways (firewalls) can block or filter unauthorized DNS tunneling to C2 by enforcing domain boundaries and access rules, but the technique blends with legitimate DNS (common, pre-auth, infrequent) so prevention is incomplete and depends on the exact policy and gateway configuration.
T1071.005prevents — Network segregation plus perimeter gateways can block or filter pub/sub broker traffic between domains (especially when wireless or guest networks are isolated per the guidance), but the technique can still succeed inside a single permitted domain by blending with allowed traffic, as the control is scoped to domain boundaries rather than deep protocol inspection.
T1072prevents — Network segregation with defined perimeters and controlled gateways (firewalls) limits lateral movement and broad remote code execution via enterprise deployment tools across trust/criticality domains, but does not stop initial access to or abuse of the management suite itself within a domain (or via permitted gateways, SaaS, or admin credentials).
T1074prevents — Network segregation with perimeters and gateways can block lateral movement to a central staging location across domains (especially in cloud/IaaS where instances may be isolated), but does not stop staging within a compromised domain, on local filesystems, or via allowed intra-domain traffic.
T1074.001detects — A.8.22's network-domain monitoring at well-defined perimeters and gateways can surface anomalous staging-to-exfil traffic or guest-wireless exfil attempts, but the technique is a local filesystem/registry copy that can occur entirely inside a trusted domain with no network crossing.
T1074.002detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous internal-to-staging traffic or cross-domain copies as part of boundary anomaly detection, but the control's core purpose is segregation rather than broad detection and leaves most local staging commands (cmd, bash, cloud-instance staging) inside a domain unseen.
T1074.002prevents — Network segregation with defined perimeters and controlled gateways (firewalls) directly blocks lateral movement and data copying across trust/criticality boundaries that adversaries rely on to reach a central staging location from multiple systems.
T1078prevents — Network segregation with perimeters and gateways limits lateral movement and pivoting that T1078 relies on after credential abuse, but does not stop initial acquisition or use of valid accounts for initial access, persistence, or local privilege escalation.
T1078.002prevents — Network segregation with defined perimeters and controlled gateways limits lateral movement and unauthorized domain resource access after credential abuse, but does not stop initial credential compromise (e.g. dumping or reuse) itself.
T1080detects — Network segregation and perimeter gateways (firewalls) can detect anomalous traffic or access patterns when tainted content is opened and executes across domains, but this is limited to observable network effects rather than the content-tainting or lateral-movement act itself.
T1080prevents — network segregation plus perimeter gateways can block lateral movement from a tainted share in one domain to systems/users in another, but cannot stop the initial tainting of the share itself nor prevent execution inside the already-trusted domain where the share resides
T1090detects — A.8.22's perimeter gateways and domain-boundary monitoring can surface anomalous proxying or unexpected inter-domain/C2 flows at well-defined perimeters, but the control's core purpose is segregation and access enforcement rather than broad detection, leaving most in-host, chained, or CDN-based proxy usage outside its scope.
T1090prevents — Network segregation with defined perimeters and controlled gateways (firewalls) directly blocks or constrains many forms of unauthorized proxying/routing of C2 traffic between trust domains, but leaves open the possibility of proxies inside a single domain, via allowed gateways, or using CDNs/routing schemes that mimic legitimate paths.
T1090.001detects — A.8.22's perimeter gateways and domain segregation enable monitoring/filtering of anomalous internal traffic (including proxy redirection), but this is scoped only to defined boundaries and assessed requirements rather than universal internal coverage of all proxy behaviors.
T1090.001prevents — Network segregation into domains with perimeter gateways (firewalls) directly constrains internal lateral proxying by limiting allowed traffic flows between trust/criticality zones, but leaves residual paths inside the same domain or via permitted p2p/SMB blending that the control does not block.
T1090.002detects — A.8.22 requires well-defined perimeters and gateway-based traffic control between domains (including treating wireless/guest access as external until it passes a gateway), which surfaces anomalous or unauthorized external proxy traffic at those boundaries; it does not instrument or discover proxies chosen outside the victim environment or inside allowed flows.
T1090.002prevents — Network segregation and perimeter gateways (firewalls) can block or restrict outbound C2 proxy traffic based on trust boundaries and access policy, but do not stop all external-proxy usage (e.g., allowed paths, compromised external systems, or wireless/guest-network bypasses).
T1090.003detects — A.8.22 requires well-defined perimeters and gateway-based traffic control between domains (including treating wireless as external until gatewayed), which surfaces anomalous multi-hop proxy traffic at domain boundaries but does not instrument or guarantee detection deeper inside domains or of decentralized P2P/onion chains that stay within a single domain.
T1090.003prevents — network segregation into trust/criticality domains plus perimeter gateways directly blocks many multi-hop proxy chains (especially those relying on boundary bridging or unauthorized internal routing), but leaves open slices such as compromised internal hosts, allowed P2P/blockchain traffic, or Tor exit nodes inside a permitted domain
T1091prevents — Network segregation (including air-gapped domains and controlled perimeters/gateways) stops lateral movement of malware from removable media between trust/criticality domains, but cannot prevent the initial infection vector when media is manually carried and inserted into an air-gapped system.
T1092prevents — Network segregation (including air-gapped domains and controlled gateways) directly stops removable-media C2 by preventing the required cross-domain file/command exchange that T1092 relies on; partial because the control's scope is network-level and does not govern all removable-media use inside a single domain or physical transfer outside the network perimeter.
T1095prevents — A.8.22's domain segregation and perimeter gateways (firewalls) can block many non-app-layer protocols (e.g. ICMP, UDP, SOCKS) between trust/criticality domains, but the technique's broad list, required protocols like ICMP, VMCI (explicitly immune to segmentation/firewalls), and intra-domain use leave a large unaddressed slice.
T1102detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous traffic patterns to known web services used for C2, but the control's focus is on segregation and access policy rather than mandating detection of covert C2 use within allowed outbound flows.
T1102prevents — A.8.22's segregation into trust/criticality domains plus perimeter gateways can block many external web-service C2 channels that cross domain boundaries, but leaves open the common case of an already-compromised internal host using expected HTTPS traffic to legitimate services (Google, Twitter, etc.) that are deliberately permitted from inside the network.
T1102.001detects — network segregation and perimeter gateways can surface anomalous traffic patterns to known web services used as dead-drop resolvers (especially non-standard resolver patterns or unexpected redirects), but the control's focus is domain segmentation rather than deep content inspection of legitimate HTTPS flows to popular sites, leaving most of the technique's covert use undetected
T1102.002detects — A.8.22's perimeter gateways and domain segregation (with wireless treated as external) can surface anomalous bidirectional Web-service C2 traffic at defined boundaries, but the control only sets requirements for segregation and gateway policy rather than mandating specific monitoring or anomaly detection, leaving most in-network or encrypted Web-service C2 undetected.
T1102.002prevents — network segregation plus perimeter gateways can block or restrict outbound access from internal domains to the specific external web services used for bidirectional C2, stopping the technique from running; partial because the control is scoped to business-driven domain boundaries and does not mandate universal outbound denial or deep content inspection that would catch all legitimate-looking web-service channels
T1102.003detects — A.8.22's perimeter gateways and domain segregation (with traffic control based on assessed requirements) can surface anomalous one-way outbound C2 to external web services at domain boundaries, but this is limited to observable traffic patterns rather than reliably identifying the technique's covert use of legitimate services, with wireless/guest network handling adding only narrow additional coverage.
T1102.003prevents — Network segregation plus perimeter gateways can block outbound C2 traffic to the chosen external web service from selected internal domains, stopping the one-way command channel from ever running; it is only a slice because the control's domain criteria, wireless carve-outs, and allowance for 'business needs' traffic leave many common services (Google/Twitter) reachable from typical client domains.
T1105prevents — Network segregation plus perimeter gateways (firewalls) can block many external-to-internal transfer vectors (e.g. direct C2 downloads, ftp, web services from untrusted domains), but the technique still succeeds via allowed channels, compromised internal accounts, lateral spread after initial foothold, or abuse of permitted protocols/utilities inside the perimeter.
T1110prevents — Network segregation with perimeters and gateways can block brute-force attempts from external or low-trust domains (e.g. internet, guest WiFi) to internal accounts, but leaves internal brute forcing, offline attacks, and post-compromise attempts inside the same domain untouched.
T1110.001detects — A.8.22's perimeter gateways and domain segregation (with wireless treated as external) can observe and surface anomalous guessing traffic at defined boundaries, but this is limited to network-layer visibility on chosen perimeters rather than reliably catching all guessing (e.g. local, encrypted, or non-boundary attempts).
T1110.001prevents — Network segregation plus perimeter gateways (firewalls) directly block unauthenticated guessing attempts from crossing domains or reaching internal services (SSH, RDP, LDAP, etc.), especially from external/wireless/guest vectors; the named remainder is guessing that stays inside an already-trusted domain.
T1110.003prevents — network segregation plus perimeter gateways can block spraying attempts that must cross domains (especially external-to-internal or guest-to-personnel paths) but leaves internal same-domain spraying, direct SSO/cloud paths, and intra-domain management ports untouched
T1110.004prevents — Network segregation plus perimeter gateways can block credential-stuffing attempts that arrive from external or untrusted domains (e.g. guest WiFi, internet-facing vectors), but cannot stop attempts that originate from already-trusted internal endpoints or that target internal services reachable inside the same domain.
T1114.002detects — Network segregation and perimeter gateways (firewalls) can detect anomalous traffic patterns to/from email services or Exchange servers when the technique crosses a defined domain boundary, but this is limited to observable network flows and does not address credentialed access within a permitted domain or external SaaS usage.
T1114.002prevents — network segregation plus perimeter gateways can block external-to-internal paths and guest-wireless lateral movement that would otherwise let an adversary reach an Exchange server or cloud mail endpoint with stolen credentials, but cannot stop an already-authenticated insider (or compromised internal account) from querying mail via legitimate protocols inside its own domain
T1119prevents — network segregation with perimeters and gateways can block automated collection from reaching sensitive domains or data stores (especially in cloud/IaaS scenarios), but leaves the technique fully executable inside a single domain or on local endpoints where the adversary is already established
T1133prevents — A.8.22's segregation of networks into domains with perimeter gateways (firewalls) and special wireless treatment directly constrains external remote service access by enforcing boundaries and controlled gateways, but leaves unauthenticated exposed services, Tor hidden services, and credentialed access (via valid accounts) as open slices.
T1135prevents — Network segregation into domains with perimeter gateways (e.g. firewalls) can block discovery queries between domains or from external/wireless segments, but does not prevent the technique within a permitted domain or where shares remain accessible per business needs.
T1185prevents — Network segregation with perimeters and gateways can block pivoting from an external or low-trust browser process into an authenticated intranet resource, but the technique's core (browser injection, proxying, or session inheritance) occurs inside an already-authenticated endpoint process and is not stopped by domain boundaries.
T1187detects — Network segregation and perimeter gateways (firewalls) can be instrumented to detect anomalous outbound SMB/WebDAV/EFSRPC authentication attempts to untrusted/external IPs, but this is only a slice of the technique (e.g., external forcing via phishing or .LNK/.SCF); internal same-network relay attacks and many client-side triggers remain unseen.
T1187prevents — Network segregation plus perimeter gateways can block the external SMB/WebDAV connections that most variants of T1187 rely on to exfiltrate NTLM hashes, but internal-network EFSRPC forcing and intra-domain lateral uses remain possible.
T1189prevents — Network segregation (including guest WiFi isolation and treating wireless as external until gatewayed) can stop the post-exploitation lateral movement that drive-by typically enables on internal networks, but does not stop the initial browser exploit or code execution on the visited client endpoint itself.
T1190prevents — Placing public-facing systems in isolated domains with controlled gateways limits the impact of an exploit against an internet-accessible application by preventing direct access to internal resources.
T1199detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous traffic or access patterns from a compromised trusted third-party connection, but the control's focus is on segregation and boundary enforcement rather than broad detection of the technique itself, leaving most variants (e.g., delegated admin abuse in SaaS/Office 365) outside its scope.
T1199prevents — A.8.22's network domain segregation and perimeter gateways (including treating wireless/third-party access as external until gateway-controlled) can stop an adversary from using a compromised trusted relationship to reach the victim enterprise network, but this is only a slice: the technique's core (leveraging the relationship itself, delegated admin offers, or accounts already inside the same domain) is not prevented by network boundaries alone.
T1203prevents — Network segregation with perimeters and gateways can block lateral movement or C2 after initial client exploitation succeeds on an endpoint, but does not stop the initial remote exploit (browser, office doc, or third-party app) from executing code on the compromised host.
T1205prevents — Network segregation plus perimeter gateways (firewalls) can block unauthorized signaling packets or sequences from reaching the target domain or host, but the control does not address host-based implementations, magic-value checks on already-open ports, raw-socket listeners, or Wake-on-LAN, leaving a substantial remainder of the technique reachable.
T1205.001detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous port-knocking sequences at well-defined boundaries, but the technique's stealth (closed ports, custom sniffers, raw sockets, wireless coverage) and host-based implementations largely sit inside domains or evade perimeter instrumentation.
T1205.001prevents — Network segregation plus perimeter gateways (firewalls) can block the inbound knock sequence or the subsequently opened port when the domains and rules are chosen to deny that traffic, but the control's discretionary, assessment-driven scoping leaves many implementations that do not cover the specific ports, sequences, or host-based/custom listeners involved.
T1210prevents — network segregation with defined perimeters and controlled gateways (firewalls) directly blocks lateral movement paths between domains, stopping exploitation of remote services across trust boundaries; partial because intra-domain exploitation (same segment) and wireless/guest edge cases remain unaddressed
T1213prevents — Network segregation and perimeter gateways limit lateral movement and external access to repositories (especially cloud/SaaS ones), but do not stop initial repository compromise, overly-broad internal access, or abuse of sharing features from authorized users.
T1213.003prevents — Network segregation with perimeters and gateways can block lateral movement into internal/private code repositories (or limit which segments can reach SaaS ones), stopping the technique from running in many victim-network scenarios, but leaves public/third-party SaaS repositories, already-compromised credentials, and non-network vectors untouched.
T1213.006prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block unauthorized access to database servers or cloud DB instances from untrusted domains, stopping the technique from running; partial because the control does not reach SaaS/PaaS credentials, misconfigurations, or already-compromised internal endpoints that can still query permitted databases.
T1219prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block unauthorized RAT C2 sessions crossing domain boundaries (especially external or guest wireless), but does not stop post-compromise installation/use of legitimate remote tools entirely within a trusted domain or between allowed intra-domain hosts.
T1219.001detects — A.8.22 requires monitoring and control at well-defined domain perimeters/gateways (including treating wireless as external until gatewayed), which can surface anomalous IDE tunneling traffic crossing boundaries, but the technique runs entirely within a single domain or on an already-compromised developer endpoint using legitimate protocols, leaving most in-domain or persistence aspects undetected.
T1219.001prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block unauthorized IDE tunneling sessions crossing domains or from external/wireless entry points, but does not stop the technique when it runs entirely inside an allowed domain or uses permitted developer workflows.
T1219.002detects — A.8.22 requires monitoring and control of traffic at well-defined domain perimeters/gateways (including treating wireless as external until gatewayed), which can surface anomalous or unauthorized use of remote-desktop protocols crossing boundaries, but does not mandate detection of the technique once inside a permitted domain or when it uses allowed legitimate software.
T1219.002prevents — Network segregation plus perimeter gateways can block many legitimate RMM tools from reaching internal targets or exfiltrating C2, but the control's own text (and the technique's allowance by application control) leaves open slices such as intra-domain use, permitted remote-support tools, wireless/guest bypasses, and software already inside the target domain.
T1219.003detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous hardware-based C2 traffic at well-defined boundaries (especially wireless or guest), but the technique is often physically installed post-compromise on internal endpoints using allowed legitimate peripherals, with no inherent detection of the hardware channel itself.
T1219.003prevents — network segregation into domains with perimeter gateways can block or constrain the C2 channel from hardware installed on a compromised internal host to an external adversary, but leaves the local interactive session, physical installation, and intra-domain traffic untouched
T1484.002prevents — Network segregation and perimeter gateways can block lateral movement or unauthorized cross-domain access that would otherwise be enabled by a maliciously added/modified trust, but do not stop the initial configuration change itself (which is typically performed with administrative privileges inside a domain or tenant).
T1485prevents — Network segregation and perimeter gateways limit lateral movement and worm-like propagation of destructive malware across domains, preventing network-wide data destruction on systems the adversary cannot reach, but do not stop local execution once access is obtained inside a domain (or in cloud/VM scenarios).
T1486recovers — Network segregation (with defined perimeters and controlled gateways) limits lateral movement and worm-like propagation that ransomware uses to reach encryptable data stores across domains; after encryption occurs, this enables more targeted, contained recovery of unaffected segments without the full-network impact seen in flat topologies.
T1496detects — Network segregation and perimeter gateways (firewalls) can surface anomalous resource-consumption traffic crossing domain boundaries or unusual outbound patterns (e.g. cryptomining C2, proxy traffic), but this is limited to observable flows at the defined perimeters and does not broadly instrument host-level resource abuse inside a domain.
T1496prevents — Network segregation and perimeter gateways can block many external-to-internal paths that deliver hijacking malware (e.g. cryptominers, proxyware), but do not stop insider threats, already-compromised endpoints inside a domain, or abuse of legitimate resources the organization itself provides.
T1496.001detects — A.8.22's network-domain segregation and perimeter gateways (firewalls) can surface anomalous compute traffic patterns or unauthorized internal-to-external mining C2 at domain boundaries, but this is limited to observable network flows and does not address in-process resource consumption, container API abuse, or endpoint mining without distinct network artifacts.
T1496.002detects — A.8.22 requires monitoring and control of traffic at well-defined domain perimeters/gateways (including wireless), which can surface anomalous bandwidth consumption or outbound patterns indicative of hijacking, botnet activity, or proxyjacking, but only for traffic crossing defined boundaries rather than all intra-domain or non-perimeter usage.
T1496.002prevents — Network segregation and perimeter gateways can block outbound bandwidth abuse (botnet, proxyjacking, scanning) from isolated low-trust domains, but cannot stop hijacking that originates inside a high-trust domain or uses already-permitted traffic.
T1498detects — A.8.22 requires well-defined perimeters and gateways (firewalls) that monitor and control inter-domain traffic based on assessed security requirements; this surfaces anomalous high-volume traffic at domain boundaries or on wireless/guest segments, but the control's scope is limited to internal segmentation rather than external volumetric DDoS, spoofing, or botnet detection.
T1498prevents — Network segregation and perimeter gateways (firewalls) can prevent internal domains from being directly reachable or saturated by external DDoS traffic, but cannot stop bandwidth exhaustion on internet-facing perimeters, spoofed reflection attacks, or volumetric floods that still reach allowed boundaries.
T1498.001detects — A.8.22 requires well-defined perimeters and gateways (firewalls) that monitor and control inter-domain traffic based on assessed security requirements; this surfaces anomalous high-volume floods at domain boundaries (especially external-to-internal), but the control is silent on internal traffic volume monitoring, wireless-specific flood detection, and does not mandate the depth of anomaly detection needed to distinguish sophisticated low-and-slow or legitimate-looking DDoS from normal traffic.
T1498.001prevents — Network segregation and perimeter gateways (firewalls) can prevent external flood traffic from reaching internal domains or limit its volume/scope based on assessed boundaries, but cannot stop floods originating inside a permitted domain, from compromised internal hosts, or volumetric saturation at the ISP/edge before the gateway.
T1498.002detects — A.8.22 requires well-defined perimeters and gateways (e.g. firewalls) that can monitor and control inter-domain traffic, which surfaces anomalous high-volume inbound reflection/amplification floods at domain boundaries, but the clause is scoped to business-driven segregation rather than mandating detection of this specific technique across all possible reflectors or internal amplification vectors.
T1498.002prevents — Network segregation plus perimeter gateways can block spoofed-packet reflection traffic from reaching amplifiers or from reaching the victim when the victim is inside a protected domain, but the control does not stop the adversary from sending the initial spoofed packets from an uncontrolled external vantage point, nor does it eliminate all possible reflectors.
T1499prevents — Network segregation and perimeter gateways (firewalls) can prevent some remote endpoint DoS vectors that rely on crossing domain boundaries or spoofed traffic from untrusted networks, but most of the class (local resource exhaustion, application-layer crashes, insider attacks, or already-compromised endpoints) is untouched.
T1499.001detects — Network segregation and perimeter gateways (firewalls) can be instrumented to detect anomalous inbound flood patterns (e.g. excessive SYN/ACK rates from external sources) before they reach the target endpoint, but this is limited to traffic crossing defined boundaries and does not cover internal or non-network OS exhaustion vectors.
T1499.001prevents — network segregation plus perimeter gateways (firewalls) can drop or rate-limit the inbound SYN/ACK flood packets before they reach the target endpoint's OS, but this is only a slice: the technique works against local processes, non-TCP vectors, or floods originating inside the same domain, none of which the control addresses
T1499.002detects — Network segregation and perimeter gateways (firewalls) can be instrumented to detect anomalous inbound traffic volumes or patterns indicative of service exhaustion floods, but this is only a slice dependent on what the gateway logs/monitors rather than a core purpose of A.8.22.
T1499.002prevents — Network segregation plus perimeter gateways (firewalls) can filter or rate-limit many volumetric HTTP floods and external SSL renegotiation attempts before they reach the target service, but cannot stop all variants (especially internal, protocol-exploiting, or already-admitted traffic) and leaves the named remainder of application-layer exhaustion that passes the gateway.
T1499.003detects — network segregation and perimeter gateways (firewalls) can be instrumented to detect anomalous traffic patterns indicative of application exhaustion floods, but this is limited to observable network-layer effects and does not address the technique's core application-resource targeting inside a domain
T1505.003detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous traffic patterns from an already-installed web shell acting as a network gateway, but the control's focus is on structural segregation rather than specific detection of web shell artifacts or behaviors.
T1505.003prevents — network segregation plus perimeter gateways can block the web shell from being placed on an openly accessible server or from using that server as a network gateway, but the control does not stop the initial server compromise or script upload on a web-facing host that must remain reachable
T1530prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block unauthorized cross-domain traffic to cloud storage APIs/endpoints when those are placed in separate domains, but leaves the dominant vectors (IAM misconfigs, leaked credentials, public buckets inside the same domain) untouched.
T1537detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous internal-to-cloud-account transfers that cross defined security boundaries, but the technique's use of same-provider APIs, internal address space, and cloud-native sharing often blends into allowed intra-cloud traffic without crossing a monitored perimeter.
T1542.005prevents — A.8.22's network-domain segregation and perimeter gateways can block TFTP traffic from reaching the unauthorized/malicious server (especially when wireless or guest networks are isolated), but the technique's core manipulation of device boot configuration lives inside the network-device boot sequence and is not stopped by domain boundaries or gateway filtering.
T1546.003detects — A.8.22 requires monitoring and control at well-defined network perimeters/gateways between domains; anomalous WMI activity (e.g. unusual subscriptions or WmiPrvSe.exe behavior crossing trust boundaries) can be surfaced there, but the technique itself is local process execution with no inherent network component, so detection coverage is a limited slice.
T1550.003prevents — Network segregation with well-defined perimeters and controlled gateways limits lateral movement paths (including PtT ticket use) between trust/criticality domains, but does not stop ticket capture, forgery or use within a single domain or where gateways permit the necessary traffic.
T1552.005prevents — Network segregation with defined perimeters and controlled gateways (including treating wireless/guest as external until passing a gateway) can block lateral movement or SSRF paths from untrusted domains to the instance, but does not stop an adversary already present on the instance from directly querying the link-local metadata API.
T1552.007prevents — Network segregation with defined perimeters and controlled gateways (firewalls) limits lateral movement and unauthorized API exposure between trust domains, preventing some but not all container API credential-gathering paths (e.g., those inside a compromised high-trust domain or via wireless/guest vectors).
T1552.008detects — A.8.22's network-domain segregation and perimeter gateways (firewalls) can surface anomalous cross-domain traffic patterns that betray credential exfiltration from chat services, but this is limited to observable network flows and does not address endpoint, SaaS portal, or integration-tool access vectors named in the technique.
T1557prevents — Network segregation into domains with defined perimeters and controlled gateways (firewalls) directly blocks many AiTM positioning vectors (ARP/DNS/LLMNR poisoning, unauthorized inter-domain traffic) by enforcing boundaries; it leaves residual exposure inside domains, on wireless, or via downgrade attacks that do not cross perimeters.
T1557.001detects — A.8.22 requires well-defined perimeters and gateways (e.g. firewalls) that can monitor and control inter-domain traffic, which can surface anomalous LLMNR/NBT-NS/mDNS responses or spoofed name-resolution traffic at domain boundaries; however, the control's focus is on segregation and access enforcement rather than mandating detection of poisoning within a single local segment, leaving most intra-domain poisoning (the technique's primary locus) unreached.
T1557.001prevents — Network segregation into domains with perimeters and gateways (e.g. firewalls) can prevent LLMNR/NBT-NS/mDNS poisoning and relay by isolating high-trust segments from low-trust ones where spoofing occurs, but the technique is native to local-link multicast/broadcast on the same segment and wireless coverage issues leave real residual even after segregation.
T1557.002detects — Network segregation and perimeter gateways (firewalls) can be configured to detect anomalous ARP traffic or poisoning attempts at domain boundaries, but this is not required by the control and leaves intra-segment ARP poisoning on the same logical/physical domain undetected.
T1557.002prevents — Network segregation into domains with perimeters and gateways (firewalls) can prevent ARP cache poisoning from crossing trust boundaries or local segments, but it does not stop the attack within the same domain/segment where ARP operates.
T1557.003detects — Network segregation with well-defined perimeters and gateways (firewalls) that control inter-domain traffic can observe and surface anomalous DHCP broadcasts or rogue server responses at domain boundaries, but this is limited to boundary crossings and does not instrument or detect the technique inside a single domain or on wireless segments without additional monitoring.
T1557.003prevents — Network segregation into domains with perimeters and gateways (firewalls) directly blocks rogue DHCP servers and spoofed responses from crossing trust boundaries, stopping the AiTM setup on most of the technique; wireless-specific guidance further limits rogue access, but the control does not eliminate intra-domain spoofing or exhaustion within a single domain.
T1557.004detects — A.8.22 explicitly requires special treatment and monitoring of wireless networks (poorly-defined perimeter, radio coverage adjustment, treating wireless as external until gatewayed per 8.20, and segregating guest WiFi), which surfaces anomalous or rogue APs/probes as part of domain perimeter enforcement; this is a genuine but minority slice of the full technique (which also includes physical deployment, stronger-signal coercion, fake portals, and non-wireless variants).
T1557.004prevents — A.8.22 explicitly requires segregating guest Wi-Fi from internal networks, treating wireless as external until it passes a gateway, and adjusting radio coverage or using perimeters/gateways based on trust — directly stopping many evil-twin connection and follow-on behaviors on compliant networks, but leaves open rogue APs in public spaces, signal-strength coercion outside organizational control, and PNL probe-response attacks that do not cross a defined domain boundary.
T1558prevents — network segregation into trust/criticality domains plus perimeter gateways can prevent an adversary from reaching a KDC or service host to steal or forge tickets from a lower-trust segment, but the technique can still succeed inside a single domain or realm where the adversary already has a foothold
T1561prevents — Network segregation and perimeter gateways limit lateral movement and worm-like propagation across domains (reducing the scale of disk-wipe impact), but do not stop an already-privileged adversary from executing a wipe on systems they have reached.
T1561.001detects — A.8.22's network-domain segregation and perimeter gateways (firewalls) can surface anomalous traffic patterns tied to worm-like propagation that often precedes or accompanies T1561.001, but the technique itself (local direct disk overwrite via raw access or drivers) is invisible to network-boundary monitoring and leaves most instances undetected.
T1561.002recovers — A.8.22's network segmentation and perimeter gateways limit lateral movement and worm-like propagation of disk-wipe malware (explicitly called out in the T1561.002 description), thereby enabling faster containment and recovery of unaffected network segments after the technique has run.
T1563detects — network segregation and perimeter gateways (firewalls) can be instrumented to surface anomalous session hijacking traffic between domains, but the control itself only defines boundaries and does not mandate or perform detection
T1563prevents — Network segregation with defined perimeters and controlled gateways (firewalls) limits lateral movement paths and can block hijacking of sessions crossing domains, but does not stop hijacking within a single domain/segment where the session already exists.
T1563.001detects — A.8.22 requires monitoring and control at well-defined network perimeters/gateways between domains (and special treatment of wireless), which can surface anomalous lateral SSH traffic crossing those boundaries but does not instrument or observe the in-process agent/socket compromise that realises the technique on an already-trusted host.
T1563.001prevents — Network segregation with well-defined perimeters and controlled gateways (e.g. firewalls) can block lateral movement paths that SSH hijacking would otherwise use across domains, but does not stop the initial agent/socket compromise or hijack on the already-compromised host inside a domain.
T1563.002detects — A.8.22 requires monitoring and control at well-defined network perimeters/gateways between domains (including treating wireless as external until gatewayed), which can surface anomalous RDP hijacking traffic crossing boundaries but does not instrument or observe the local tscon.exe session theft itself.
T1563.002prevents — Network segregation with defined perimeters and controlled gateways (firewalls) can block the remote portion of RDP hijacking by denying unauthorized cross-domain RDP traffic, but leaves local hijacking (tscon.exe with System privileges on the same host) and intra-domain RDP sessions untouched.
T1565.002prevents — network segregation plus perimeter gateways (firewalls) directly block many interception/man-in-the-middle opportunities on the wire between domains, but leave residual paths inside a domain, on wireless segments before gateway enforcement, and between processes on the same host
T1567detects — A.8.22 requires well-defined perimeters and controlled gateways (firewalls) between domains that can surface anomalous outbound traffic to external web services at those boundaries, but the control's focus is on segregation and access policy rather than mandating monitoring or anomaly detection, leaving most of the technique's covert use of legitimate channels undetected.
T1567prevents — A.8.22's domain segregation and perimeter gateways (firewalls) can block unauthorized outbound traffic to web services from internal domains, stopping the exfiltration technique from succeeding in many cases, but the control's business-driven assessment and allowance for legitimate external web service traffic (which T1567 leverages for cover) leave a substantial slice unaddressed.
T1567.001detects — A.8.22's perimeter gateways and domain segregation enable monitoring/filtering of outbound traffic to external code repository APIs (especially when treating wireless/guest as external), which can surface the anomalous exfiltration; this is only a slice because the control does not mandate specific detection instrumentation or coverage of all possible exfil paths (e.g., already-authorized HTTPS from internal hosts blending with legitimate repo use).
T1567.001prevents — Network segregation with defined perimeters and controlled gateways (e.g. firewalls) can block unauthorized outbound connections from internal domains to external code repository APIs, stopping the exfiltration technique from running; partial because it depends on policy-driven rules that may still permit HTTPS traffic to popular services like GitHub from allowed domains or guest networks.
T1567.002detects — A.8.22 requires well-defined perimeters and gateway-controlled traffic between domains (including treating wireless/guest as external until gatewayed), which surfaces anomalous exfil to cloud storage when it crosses a monitored boundary; extent is partial because the control sets domain/gateway policy rather than mandating specific detection instrumentation or coverage of all internal-to-cloud paths.
T1567.002prevents — Network segregation plus perimeter gateways can block unauthorized outbound flows to cloud storage from low-trust/internal domains, but the control's own text allows business-need access through assessed gateways and does not prohibit all exfil paths (e.g. from already-authorized cloud-using hosts or wireless/guest networks).
T1567.003detects — A.8.22's perimeter gateways and domain segregation (with wireless treated as external) can instrument boundary traffic for anomalous outbound flows to text storage sites, but this is limited to chosen perimeters/domains and does not broadly cover all exfiltration paths or post-gateway concealment.
T1567.003prevents — Network segregation plus perimeter gateways can block outbound connections from internal domains to pastebin-like sites when the policy assessment designates them untrusted, but the control does not reach exfiltration from compromised endpoints that are already allowed outbound web access or from wireless/guest networks that may still reach such sites.
T1567.004detects — A.8.22 requires well-defined perimeters and gateway-controlled traffic between domains (including treating wireless/guest as external until gatewayed per 8.20), which surfaces anomalous outbound webhook posts as violations of domain or gateway policy; partial because the control sets perimeter/gateway requirements rather than mandating specific detection instrumentation or depth, so coverage depends on what the implementer chooses to monitor at those boundaries.
T1567.004prevents — Network segregation plus perimeter gateways can block outbound webhook traffic to external SaaS/collaboration services when the chosen domains and rules explicitly deny it, but the control's business-driven, assessment-based criteria leave many common webhook destinations (HTTPS to Discord/Slack/etc.) inside allowed flows, and it has no view of the SaaS-layer linking or manual-post methods.
T1568detects — Network segregation and perimeter gateways (firewalls) can surface anomalous cross-domain traffic patterns that dynamic resolution may produce when resolving to unexpected IPs/ports, but the control's scope is limited to defined domain boundaries and does not broadly instrument for algorithm-driven evasion inside allowed flows.
T1568prevents — network segregation plus perimeter gateways can block many dynamic C2 resolutions (especially those landing in untrusted or guest domains) but leaves open the remainder where the algorithm resolves to an allowed domain/IP inside a permitted boundary
T1568.003detects — A.8.22 requires monitoring and control at well-defined domain perimeters/gateways (including anomalous traffic patterns that would surface calculated C2 ports bypassing egress rules), but the control's scope is limited to boundary enforcement rather than deep inspection of DNS responses or in-process calculation logic itself.
T1570detects — Network segregation with well-defined perimeters and gateways (firewalls) enables monitoring and detection of anomalous lateral file transfers (e.g. SMB, RDP, scp) crossing domain boundaries, but leaves intra-domain transfers and non-network vectors (e.g. local tools, web services, or unmonitored wireless) undetected.
T1570prevents — Network segregation with defined perimeters and controlled gateways (firewalls) directly blocks many lateral file-transfer vectors that rely on crossing trust boundaries via SMB, RDP, scp, rsync, or similar, but leaves same-domain or same-segment transfers untouched and does not address web-service or local-tool transfers within a domain.
T1571detects — A.8.22 requires well-defined perimeters and gateway-controlled traffic between domains based on assessed security requirements; this surfaces anomalous non-standard port usage at domain boundaries or in wireless segregation but does not mandate broad monitoring of all protocol/port pairings or internal lateral movement.
T1571prevents — A.8.22's domain segregation and perimeter gateways (firewalls) can block non-standard port traffic between domains based on assessed rules, but this is limited to configured boundaries and does not stop all abuse (e.g., within a domain, on allowed ports/protocols, wireless edge cases, or registry changes on endpoints).
T1572detects — A.8.22 requires well-defined perimeters and gateway-based traffic control between domains (including treating wireless as external until gatewayed), which surfaces anomalous tunneling that violates the defined segregation rules or crosses perimeters without authorization; this is limited to a slice because the control is fundamentally about preventive boundary enforcement rather than broad monitoring instrumentation, and many tunneling variants (e.g., DoH blending with HTTPS) can remain undetected if they conform to allowed gateway rules.
T1572prevents — Network segregation into domains with perimeter gateways (firewalls) that enforce access based on assessed security requirements directly stops many tunneling techniques from crossing boundaries or reaching filtered destinations, but leaves open same-domain tunneling, wireless perimeter gaps, and protocol blending that evades the gateway rules.
T1578.003detects — Network segregation and perimeter gateways (firewalls) can surface anomalous delete-cloud-instance API traffic or cross-domain behavior when it crosses a monitored boundary, but this is limited to observable network flows and does not address the dominant IaaS management-plane deletion itself.
T1580prevents — Network segregation (including domain boundaries, gateways/firewalls, and wireless isolation) can prevent an adversary from reaching the APIs/CLIs used for IaaS discovery from unauthorized network locations, but does not stop discovery once the adversary has valid credentials or is inside an allowed domain.
T1590.004prevents — Network segregation and perimeter gateways directly limit what topology details (especially internal domains, trust boundaries, and non-public gateways) an adversary can discover from outside or via exposed data sets, but do not stop all collection methods such as phishing, active scanning of exposed surfaces, or public data exposure.
T1595detects — A.8.22 requires well-defined perimeters and gateways (e.g. firewalls) that can log or alert on probes crossing domains, directly enabling detection of active scanning traffic at those boundaries, but the control's core purpose and guidance focus on segregation and access control rather than mandating monitoring, with wireless/guest networks and internal domain traffic left as large unscoped slices.
T1595prevents — Network segregation plus perimeter gateways (firewalls) can block many forms of active scanning traffic from external or untrusted domains, but the control does not stop scans originating from inside permitted domains, wireless/guest networks with allowed access, or scans using protocols/ports explicitly permitted by the business-need assessment.
T1595.001detects — A.8.22 requires well-defined perimeters and gateways (e.g. firewalls) that can monitor and control inter-domain traffic, which can surface scanning attempts at those boundaries, but the control is scoped to internal domain segregation and does not mandate detection of external IP-block scans occurring before any perimeter is reached.
T1595.001prevents — Network segregation and perimeter gateways (firewalls) can block or filter scanning probes from external IP blocks into protected internal domains, stopping the technique from reaching those segments; it is only partial because the public-facing perimeter and any exposed IP blocks remain scannable, and the control's scope is limited to defined internal boundaries rather than eliminating external reconnaissance.
T1595.002detects — Network segregation and perimeter gateways (firewalls) can be instrumented to surface scanning traffic patterns as anomalous, but the control's purpose and guidance focus on domain separation and access enforcement rather than mandating detection of reconnaissance scans.
T1595.002prevents — Network segregation with perimeters and gateways can block unauthenticated external vulnerability scans from reaching internal domains, but leaves internal scanning, guest-wireless paths, and perimeter-exposed assets reachable, so only a slice of the PRE technique is stopped.
T1595.003prevents — Network segregation plus perimeter gateways can block probes from reaching internal domains or non-public assets (especially cloud buckets and hidden portals behind boundaries), but leaves public-facing perimeters, guest wireless, and externally reachable discovery surfaces untouched.
T1599prevents — A.8.22's core purpose and guidance is to define and enforce network domains and perimeters using gateways (firewalls, routers) that restrict traffic based on assessed security needs, directly stopping adversaries from freely bridging boundaries via reconfiguration of those same devices; the named remainder is post-compromise device control itself, which the control does not address.
T1599.001prevents — A.8.22's segregation into domains with perimeter gateways (firewalls) that enforce traffic rules based on trust/criticality directly stops most unauthorized boundary bridging via NAT changes, but the control assumes the boundary device itself remains uncompromised and does not address post-compromise modification of the gateway's own NAT configuration or custom NAT via OS patching.
T1602prevents — Network segregation with defined perimeters and controlled gateways (e.g. firewalls) directly blocks many lateral paths and remote-access vectors that adversaries would use to reach and exfiltrate from configuration repositories on managed network devices.
T1602.001detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous SNMP queries crossing boundaries, but the control's focus is segregation and access control rather than mandating detection of internal MIB dumps within a trusted domain.
T1602.001prevents — Network segregation with defined perimeters and controlled gateways (e.g. firewalls) can block unauthorized SNMP queries from untrusted domains or external sources, stopping the technique from reaching managed devices; it is only partial because internal domains, permitted SNMP access per policy, and wireless/guest networks still allow the queries where assessment permits.
T1602.002detects — A.8.22's perimeter gateways and domain monitoring can surface anomalous access or export attempts (e.g. via SNMP/SMI) at well-defined boundaries, but this is limited to observable perimeter traffic and does not broadly instrument internal device config access or in-memory dumps.
T1602.002prevents — Network segregation and perimeter gateways (firewalls) can block unauthorized management protocols like SNMP/SMI from untrusted domains, stopping the technique from reaching the device; this is only a slice because the technique can still run from an already-trusted domain, via physical access, or via misconfigured gateways.
T1610prevents — network segregation (including domain/perimeter gateways and wireless isolation) can block many common deployment vectors that rely on unrestricted network reach to APIs, dashboards, or nodes, but leaves open vectors inside already-trusted domains, via local container runtimes, or through allowed intra-domain traffic
T1611prevents — A.8.22's network-domain segregation and perimeter gateways can prevent some escape paths that rely on network-borne lateral movement or C2 from the host (or from one container/VM to another), but the technique's dominant vectors (bind mounts, privileged containers, docker.sock abuse, kernel-module loading, hypervisor exploits) are configuration, privilege, and code-level issues inside the host that network segmentation does not address.
T1659prevents — Network segregation and perimeter gateways (firewalls) can block or filter many forms of injected malicious content from external/upstream channels (especially 'from the side' or non-enterprise MITM), but the control does not address upstream ISP-level compromises that already control the traffic before it reaches the organization's boundary.
T1669detects — A.8.22 requires monitoring and control at well-defined perimeters/gateways (including treating wireless as external until it passes a gateway per 8.20), which surfaces unauthorized or anomalous Wi-Fi connection attempts from outside those boundaries, but does not instrument or detect post-connection activities, proximity-based bridging via dual-homed systems, or internal sniffing once attached.
T1669prevents — A.8.22 explicitly requires segregating guest Wi-Fi from personnel networks, treating wireless as external until it passes a gateway, and defining perimeters with access control based on trust/sensitivity — directly stopping the technique from reaching internal systems or dual-homed bridges without satisfying those controls.
T1686detects — A.8.22 requires well-defined perimeters and gateways (firewalls) that control traffic between domains based on assessed security requirements; anomalous firewall modifications or rule changes that enable unauthorized cross-domain flows can be surfaced by monitoring at those gateways, but the control itself only sets perimeter boundaries and does not mandate or perform detection of tampering inside a domain or on individual hosts.
T1686prevents — A.8.22's segregation into domains with perimeter gateways (firewalls) directly stops many T1686 behaviors that rely on crossing those boundaries or using unsanctioned paths, but leaves residual cases (e.g., local host firewall tampering inside an already-authorized domain, or post-compromise modification of the very gateway enforcing the rule).
T1686.001detects — A.8.22 requires well-defined perimeters and controlled gateways (firewalls) between domains, which can surface anomalous rule changes or unauthorized traffic as part of perimeter monitoring, but the control's focus is on segregation design rather than active detection of cloud-specific firewall modifications.
T1686.001prevents — A.8.22 mandates network segregation into domains with perimeter gateways (firewalls) that enforce access based on assessed requirements, which directly stops many unauthorized rule changes or bypasses in properly segmented cloud environments, but leaves a slice unaddressed for cloud-native security groups modifiable via control-plane permissions outside the network-perimeter model.
T1686.002prevents — A.8.22's segregation into domains with perimeter gateways (firewalls) directly stops many T1686.002 rule modifications from enabling unrestricted internal movement or C2, but leaves open the initial device compromise vectors, host-based manipulations, and wireless perimeter gaps that the control itself flags as requiring separate treatment.
T1686.003detects — A.8.22 requires well-defined perimeters and gateways (firewalls) whose traffic controls are based on assessed requirements; anomalous changes to host firewall rules or states are observable at those boundaries or via monitoring of gateway behavior, but the control itself only sets domain/gateway architecture and does not mandate instrumentation that would surface the specific Windows host-firewall modification techniques.
T1686.003prevents — A.8.22's segregation into domains with perimeter gateways (firewalls) directly stops many T1686.003 outcomes such as unauthorized traffic once the host firewall is altered, but does not stop the disabling/modification technique itself on an already-compromised endpoint inside a domain.

Prevented OWASP Web Top 10 (2025) risks (9)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01→P A02→P A05→P A06←P A07→P A08→P A09←M A10→P

Why these map — AI rationale (under review)

A01mitigates — Network segregation and perimeter gateways limit the blast radius and block some unauthorized cross-domain access (e.g. external-to-internal path traversal or SSRF), but do not address the authorization-decision failures, IDOR, missing function-level checks or CSRF that dominate the class.
A01prevents — A.8.22's network-domain segregation and perimeter gateways (firewalls) directly prevent several A01 members whose payoff crosses a trust boundary (CWE-22 path traversal to protected resources, CWE-918 SSRF, certain IDOR/exposure cases), but do not prevent the dominant in-band authorization failures (CWE-284 improper access control, CWE-862/863 missing/incorrect authorization checks, CWE-352 CSRF) that occur inside a permitted domain.
A02mitigates — network segregation and perimeter gateways limit the blast radius and reachable attack surface when a misconfiguration (e.g. exposed admin interface, weak default port) is present, but do not address the misconfiguration itself
A05mitigates — network segmentation and perimeter gateways limit the blast radius and outbound consequences of successful injection (esp. OS command, SSRF, exfil), but do not bound the dominant in-band members (SQLi, XSS) whose payoff stays inside permitted paths
A07mitigates — network segregation and perimeter gateways limit the blast radius and lateral movement available to an attacker who has hijacked or brute-forced an authenticated session, but do nothing to stop the authentication failure itself
A08mitigates — Network segregation limits the blast radius and lateral movement available to an attacker who has already realised an integrity failure (e.g. after a supply-chain compromise or deserialization gadget), but does not change the fact that the code/data was trusted without verification.
A10mitigates — network segregation and perimeter gateways limit the blast radius and data exfiltration possible when an error/exception path leaks information or lands in an inconsistent/fail-open state

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.