baselineRFIWhat segmentation enforcement mechanism does the platform use — host-based agents, hypervisor-level, network overlay, or existing firewall/switch integration — and what is the deployment effort and blast radius if enforcement is misconfigured?weight 3
Answer key — what a strong answer shows
Misconfigured segmentation can cause self-inflicted outages; look for a described safe-rollout methodology (simulate/monitor before enforce) alongside the enforcement mechanism itself.
baselineRFPDescribe application-dependency mapping — can the platform automatically discover real east-west traffic flows and application dependencies before any policy is written, and what is the accuracy/completeness of this discovery in a real customer environment?weight 3
Answer key — what a strong answer shows
Writing segmentation policy without accurate dependency mapping breaks applications; look for automated discovery with a real accuracy figure, not a manual dependency-documentation exercise.
baselineRFIHow does the platform handle policy for dynamic/ephemeral workloads (containers, auto-scaling cloud instances) where IP addresses change constantly — is policy identity-based (workload/label-based) rather than IP-based?weight 3
Answer key — what a strong answer shows
IP-based policy breaks immediately in dynamic environments; look for label/identity-based policy that survives workload churn, which is now the standard expectation.
baselineRFIWhat is the simulate-before-enforce workflow — can a new segmentation policy be run in a monitor-only/what-if mode to see what it would have blocked, before actually enforcing it in production?weight 3
Answer key — what a strong answer shows
Simulation mode is the single most important safety feature for avoiding production outages from segmentation changes — a product without it is asking the customer to enforce blind.
baselineRFPDetail coverage across hybrid environments — on-prem data center, multiple public clouds, and Kubernetes — from one unified policy model, and what breaks or requires separate tooling at each boundary.weight 3
Answer key — what a strong answer shows
Look for an honest per-environment coverage breakdown; 'unified policy' claims sometimes hide separate underlying engines with different capabilities per environment.
baselineRFIHow does the platform integrate with identity providers so segmentation policy can incorporate user/service identity (not just network location) — e.g., allowing access based on authenticated service identity regardless of network path?weight 3
Answer key — what a strong answer shows
Identity-aware segmentation is materially stronger than location-only network segmentation — look for real IdP/service-identity integration.
baselineRFPExplain performance overhead of the enforcement mechanism (especially host-agent-based approaches) on production workloads, with measured figures under realistic load, not synthetic benchmarks.weight 3
Answer key — what a strong answer shows
Host-based enforcement agents can add meaningful latency/CPU overhead at scale — look for measured, realistic figures, not lab benchmarks.
baselineRFIWhat audit and compliance reporting exists — can the platform demonstrate that specific compliance-relevant segmentation requirements (e.g., PCI cardholder-data-environment isolation) are actually enforced, with continuous evidence rather than a point-in-time attestation?weight 3
Answer key — what a strong answer shows
Look for continuous, exportable enforcement evidence — compliance segmentation requirements need ongoing proof, not a one-time architecture diagram.
baselineRFIWhat is the pricing model — per workload/agent, per host, or a flat enterprise tier — and how does cost scale for autoscaling cloud environments where workload count fluctuates significantly?weight 3
Answer key — what a strong answer shows
Workload-count-based pricing interacts awkwardly with autoscaling — ask explicitly how the vendor handles pricing for a highly elastic environment rather than assuming a static count.
baselineRFPAfter a real lateral-movement incident, does the platform support post-incident analysis of exactly which segmentation policy gap allowed the movement, and can that gap be immediately closed with a targeted policy update — with a customer-referenced example?weight 3
Answer key — what a strong answer shows
Strong answers describe a real post-incident policy-gap analysis workflow with a customer example, not just the general claim that segmentation reduces lateral-movement risk.
baselineRFIDetail historical trend reporting on segmentation policy coverage and maturity (percentage of traffic flows under explicit policy versus still-unsegmented default-allow) over time, suitable for demonstrating program progress to leadership.weight 3
Answer key — what a strong answer shows
Trend-over-time coverage reporting is a distinct capability from a point-in-time policy view — confirm this exists as a maintained, exportable report.
baselineRFIHow does this platform relate to the customer's existing NGFW/firewall infrastructure — is microsegmentation a genuinely complementary layer, or does it substantially duplicate east-west policy enforcement the NGFW already provides in a data-center context?weight 3
Answer key — what a strong answer shows
This is a real, common buyer question given the functional overlap — a vendor should give an honest answer about the boundary and complementarity, not imply a standalone purchase is always necessary.
baselineRFPWho within the organization gets access to segmentation policy and the underlying application-dependency map, and is there role-based access control given that a complete map of internal application communication patterns is itself valuable reconnaissance information?weight 3
Answer key — what a strong answer shows
A complete application-dependency map is a meaningful target in its own right — role-based access control over this specific asset is an often-overlooked consideration.
baselineRFIWhat is the measured false-positive rate on policy enforcement (legitimate traffic incorrectly blocked), and what tuning process minimizes business disruption during the transition from monitor-only to full enforcement?weight 3
Answer key — what a strong answer shows
A false positive on enforced segmentation policy can break legitimate application communication — ask for a real, customer-validated false-positive figure and a safe enforcement-rollout process.
baselineRFPDetail migration/rollout support for a large, existing flat (unsegmented) network — what is a customer-referenced timeline from initial deployment to meaningful policy coverage, and what customer-side effort does that require?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, customer-validated timeline for a realistic large-scale retrofit scenario, not just a greenfield deployment example.
baselineRFIDoes the platform offer OT/ICS-specific segmentation (Purdue-model zone/conduit enforcement) distinct from generic IT microsegmentation, for a customer with converged IT/OT environments?weight 3
Answer key — what a strong answer shows
OT-specific segmentation requires genuinely different technical understanding (Purdue Model zones, OT protocols) than generic IT east-west policy — a vendor should clarify whether real OT-aware segmentation exists or coverage is IT-only.
baselineRFPAssess internal systems and segmentation for lateral movement opportunities and common misconfigurations (Internal Network Testing).weight 3
baselineRFPInternal Network Testing scope: internal network segmentation and access controls, Active Directory and authentication systems, internal applications and databases, and lateral movement/privilege escalation scenarios.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
