Hospital Network: NIS2 Minimum Segmentation

Cybersecurity in healthcare facilities is no longer an option but a stringent legal and moral requirement. The NIS2 Directive, specifically Article 21, mandates essential and important service operators, including healthcare organizations, to adopt adequate technical and organizational measures to manage security risks. Among these, network segmentation emerges as an indispensable foundation for protecting sensitive data and ensuring operational continuity. This is not a luxury, but the absolute minimum to pass an audit and, more importantly, to protect patients.

Hospital networks are immensely complex, encompassing clinical management systems (HIS), picture archiving and communication systems (PACS), connected medical devices (medical IoT), and traditional IT infrastructure. A flat network, where a single point of compromise can grant indiscriminate access to the entire environment, poses an unacceptable risk. I have personally witnessed scenarios where malware on a single administrative workstation nearly propagated to critical systems due to a lack of adequate segmentation. This article explores the minimum network segmentation measures a hospital should implement to comply with current directives and, crucially, to be resilient against cyberattacks.

Tested on: Cisco Catalyst 9300 · FortiGate 200F · VMware NSX-T · May 2026

Prerequisites / Test Environment

Before implementing any segmentation strategy, a clear understanding of the existing network environment is crucial. This includes a detailed inventory of all connected devices, critical application systems, and traffic flows. Network infrastructure capable of supporting VLANs (Virtual Local Area Networks) and ACLs (Access Control Lists) at the switch and router level is necessary. A Next-Generation Firewall (NGFW) is essential for policy management and traffic inspection. In our test environment, we used Cisco Catalyst 9300 switches, a FortiGate 200F firewall, and for some advanced implementations, VMware NSX-T for micro-segmentation. Read also: FortiGate: Basic Perimeter Security Configuration

1. Identification and Classification of Critical Systems

The first step is to identify and classify all systems that handle sensitive data or are essential for hospital operations. This includes:

Hospital Information Systems (HIS/EMR): Electronic health records, patient management systems.
Imaging Systems (PACS/RIS): Diagnostic images and radiology reports.
Laboratory Information Systems (LIS): Lab analyses and results.
Pharmacy Systems: Medication management and distribution.
Medical IoT Devices: Infusion pumps, patient monitors, connected diagnostic equipment.
Critical Infrastructure: Domain Controllers, DNS servers, backup systems.

Each system must be evaluated based on its impact on operational continuity and data confidentiality. This classification will guide VLAN creation and security policy enforcement. For an example of an anonymized network diagram showing segmentation, refer to reference architecture diagrams for digital healthcare.

2. Implementing VLANs for Logical Segmentation

VLANs are the foundation of logical segmentation. They allow for the isolation of groups of devices and systems even if physically connected to the same switch. This reduces the broadcast domain and, crucially, limits the lateral propagation of an attack. Below is an example of VLAN configuration on a Cisco switch:

configure terminal
vlan 10
 name HIS_VLAN
vlan 20
 name PACS_VLAN
vlan 30
 name IoT_Medicale
vlan 40
 name Administrative_Workstations
vlan 50
 name Server_Infrastructure
exit
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
exit

It is essential to create separate VLANs for:

Clinical Management VLAN: HIS, PACS, LIS.
Medical IoT VLAN: All connected medical devices. These devices are often difficult to patch and represent a high risk.
Workstation VLAN: Administrative workstations, clinical workstations, internet stations.
Core Server VLAN: Domain Controllers, DNS, DHCP, backup servers, SIEM.
Guest VLAN: For visitor internet access, completely isolated.

3. Firewalling Between VLANs (East-West Controls)

Simply creating VLANs is not enough. It is essential that traffic between these VLANs is filtered and controlled by a firewall. This is known as East-West traffic control. A Next-Generation Firewall (NGFW) allows for the implementation of granular policies based not only on IP and ports but also on applications, users, and security contexts.

Example FortiGate policy to allow traffic only from HIS_VLAN to Server_Infrastructure (e.g., Domain Controller) on the LDAP port:

config firewall policy
    edit 0
        set name "HIS_to_DC_LDAP"
        set srcintf "HIS_VLAN_Interface"
        set dstintf "Server_Infrastructure_Interface"
        set srcaddr "HIS_VLAN_Address_Object"
        set dstaddr "DC_IP_Address_Object"
        set service "LDAP"
        set action accept
    next
end

These policies must be strict and follow the principle of least privilege: only allow strictly necessary traffic. Everything else must be explicitly denied.

4. Medical IoT Traffic Segmentation

Medical IoT devices present unique challenges: they often run on outdated operating systems, do not support robust authentication, and are vulnerable to known exploits. Isolating them in a dedicated VLAN is imperative. Furthermore, traffic to and from these devices should be carefully monitored and limited to the bare minimum required for their operation. Network Access Control (NAC) solutions should be considered to authenticate and authorize only recognized IoT devices to connect to their dedicated VLAN.

Common Errors and Troubleshooting

Overly permissive policies: One of the most common errors is creating “any-any” firewall policies between VLANs to resolve connectivity issues. This completely negates the benefit of segmentation. It is crucial to invest time in mapping traffic flows and defining precise policies.
Lack of logging and monitoring: Without a SIEM or a centralized logging system, it is impossible to detect unauthorized access attempts or anomalies in inter-VLAN traffic. Ensure that firewall and switch logs are sent to an analysis system.
Ignoring legacy devices: Old medical devices or IT systems that cannot be patched or updated pose a significant risk. They must be aggressively isolated and, if possible, replaced.
Inadequate documentation: The lack of updated documentation for VLANs, policies, and traffic flows makes management and troubleshooting a nightmare, in addition to making it impossible to demonstrate compliance.

FAQ — Frequently Asked Questions

Is network segmentation sufficient for NIS2 compliance?

No, segmentation is a fundamental component, but NIS2 requires a holistic approach that includes incident management, risk assessment, supply chain security, and much more. It is a pillar, not the only measure.

What is the difference between network segmentation and micro-segmentation?

Network segmentation divides the network into broader segments (VLANs). Micro-segmentation takes this concept to a more granular level, isolating individual workloads or applications within the same VLAN, often through software firewalls or SDN solutions like VMware NSX-T. It offers even more precise control but is more complex to implement.

How can I test the effectiveness of my segmentation?

Through regular penetration tests, vulnerability assessments, and attack simulations (red teaming). It is crucial that these tests include lateral movement scenarios between network segments to verify the effectiveness of internal firewall policies.

Should I also segment OT (Operational Technology) and IT networks?

Absolutely. OT networks, which manage medical equipment and critical infrastructure, must be rigorously separated from traditional IT networks. The protocols and vulnerabilities are different, and an attack on the OT network can have direct consequences on patient lives.

Conclusions with Operational Takeaways

Network segmentation in a hospital setting is not a theoretical exercise but a pragmatic and mandatory security measure for NIS2 compliance. Implementing dedicated VLANs for critical systems, medical IoT devices, and workstations, and applying strict firewall policies between these segments, represents the absolute minimum. This not only protects against external attacks but also limits the propagation of internal threats. Investing in a robust segmented network architecture means investing in patient safety and operational resilience, reducing the risk of disruptions that could have devastating consequences.

Sources

Updated: August 2026