Build Series Vol. 08 — Network Segmentation & Zero Trust

The containment substrate the rest of the series assumes: isolating a host, keeping a compromised endpoint away from the backups, restricting an unmanaged device to a narrow slice.

The decision this volume is really about: what to separate and why, and which layer enforces the policy.

Control mapping first. The exact SOC 2, ISO 27001:2022, NIST CSF 2.0, CIS v8.1, CMMC, PCI DSS v4.0.1 and HIPAA clauses this build satisfies are printed before any installation step, so the work becomes audit evidence rather than a side effect of it.

A validation harness, not just a build. How to prove the control works and — the part nothing free covers — how to catch it failing quietly: the expired scan credential, the canary that stopped, the encryption key nobody can recover, the segmentation your diagram claims and your firewall does not.

Three sized architectures with honest hour counts. Tier 1 is 25–40 hrs to build · 4–6 hrs a month.

Stack: WireGuard · Headscale · NetBird · OPNsense · Pomerium · Open Policy Agent.

Current as of August 2026. NIST SP 1800-35 was finalised on 10 June 2025 and frames zero trust as crawl, walk, run. Most small organisations should not attempt microsegmentation — four enforced zones and an unreachable management plane deliver most of the risk reduction, and this volume says where to stop.

Every volume runs the same nine sections: prerequisites, control mapping, the decisions that matter, three sized architectures, a build runbook, a validation harness, an evidence pack, an operating cadence with honest hour counts, failure modes and the buy line, and an AI prompt pack.

Reading order: read 10th of ten. Each volume stands alone, and each is cheaper to build if the one before it exists.

Ships without support. This is a document, not a service contract — and Section 8 tells you plainly where the buy line is.