Key concepts
The guide describes the limits of perimeter and VPN-based designs, the security appliances and configurations that address them, zero trust network access, and secure wide-area networking such as SD-WAN and SASE.
How it is organized
- Traditional network access approaches and their limits
- Network security appliances
- Network configurations for basic security functions
- Zero trust network access (microsegmentation, software-defined perimeter)
- Secure wide-area networking (SD-WAN, SASE)
What a school district should take from it
- With most district applications in the cloud, the network perimeter protects less than it used to.
- Content filtering, firewalls and secure access can increasingly be combined in cloud-delivered services.
How to use it in your district
- Use its categories to compare network refresh proposals on equal terms.
- Map where student, staff and building traffic flows today before choosing a design.
- Plan segmentation as part of any switch or firewall replacement.
Common misconceptions
- A strong firewall protects cloud applications.
- Cloud applications are reached directly from anywhere; identity and device controls matter as much as the firewall.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- PR.IRTechnology Infrastructure Resilience
- PR.PSPlatform Security
Tools in the program portal
- P3 Partner NetworkFind vetted help matched to your gaps
- Funding finderGrants and programs for cybersecurity work
Related publications
- SP 800-207Zero trust architecture
- SP 800-41 Rev. 1Firewalls and firewall policy
Citation and source
SP 800-215, Guide to a Secure Enterprise Network Landscape. National Institute of Standards and Technology. 2022. https://doi.org/10.6028/NIST.SP.800-215.
Topics: Network security, Cloud and connected devices. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.