The zoning and filtering provisions of the communication network shall be implemented in accordance with the principle of multi-level protection.

The division of the communication network within a given security class into separate network areas (zones and segments) may mean, for example, appropriate workstation and server separation from a data protection point of view, also covering possible project-specific separation needs.

The requirement can be met by the following measures:

• The communication network is divided into separate network areas (zones, segments) within the security class.
• Traffic between the network areas is restricted and traffic entering the environment is subject to the default-deny rule.
• The data processing environment is prepared for common network attacks.