what do I fill in regarding network segmentation

Network segmentation: technical separation between systems

With this question, the customer wants to know whether the network is divided into separate zones, so that an infection in one part cannot freely spread to production systems, financial systems or customer data in another part. Think of a separate guest network, a separate segment for OT/production equipment, or separation between test and production environments with firewalls or VLANs between them. A "yes" is defensible if that separation demonstrably exists and not only on paper — the customer often asks this precisely after a malware incident at another supplier in the chain, where segmentation could have limited ransomware spread.

If the enterprise has no formal segmentation, then "no" with a brief explanation is better than a completed "yes" without evidence: for example, that critical systems are physically separated, or that segmentation is on the roadmap for the coming quarter. Segmentation often goes hand in hand with the broader access control and management of business assets: who may access which segment, and how that is enforced. A link with the vulnerability management process is also logical, because segmentation is often cited as a compensating control when a patch has not yet been rolled out.

Where this follows from the ten measures

Network segmentation falls under the measures for network and information system security under Article 21(2) of the NIS2 Directive, and is named as a specific management control in Annex A of ISO/IEC 27001. In the Netherlands, the obligation for entities falling under the directive follows from the Cybersecurity Act, which enters into force on 15 August 2026; until that date, a customer can ask for it in a questionnaire as part of their own supply chain assessment, without this constituting a legal obligation for the supplier themselves.