NSPM: manage network security policies without losing control
Network Security Policy Management (NSPM) covers the practices and tools used to define, check, change and prove the rules of your network security devices. Wabba-Sego belongs to this family, with an approach of its own.
What NSPM covers
Visibility
An inventory of devices, objects, rules and the flows they allow.
Policy analysis
Rules that are unused, too broad, duplicated or against company standards.
Change management
From the flow opening request to its implementation, with risk analysis.
Compliance and audit
Evidence for audits, periodic rule recertification, traceability.
Governance
Company rules (zones, allowed flows, forbidden ports) applied everywhere.
Why it has become essential
Policies keep growing
Thousands of rules, added project after project, rarely removed.
Regulatory requirements
NIS2, DORA, ISO/IEC 27001 and PCI DSS require network security and segmentation to be controlled and documented.
The risk of change
A modified rule or label can cut a production flow, or open one too many.
Microsegmentation
It multiplies rules and objects (labels, label groups) and brings the policy close to every server.
Your requirements, and what Wabba-Sego brings
| Text | What it requires | What Wabba-Sego brings |
|---|---|---|
| NIS2: Directive (EU) 2022/2555, Article 21 | Risk-management measures, including the security of network and information systems and access control. | Guardrails checked at every change, audit log, compliance report per instance. |
| DORA: Regulation (EU) 2022/2554 and Delegated Regulation (EU) 2024/1774, Article 13 | Network security management, including the segregation and segmentation of systems and networks. | A segmentation policy kept in shape over time: recertification, unused or too broad rules, dated exceptions. |
| ISO/IEC 27001:2022, Annex A, controls 8.20 to 8.22 | Networks security, security of network services, segregation of networks. | Your labelling model and allowed flow matrices as the reference; deviations detected at every synchronisation. |
| PCI DSS v4.0, Requirement 1 | Network security controls installed, maintained and reviewed periodically. | Rule review, recertification when due, exportable evidence. |
Wabba-Sego does not make you compliant on its own: it helps you apply your requirements and produce the evidence.
Where Wabba-Sego fits
| Common NSPM approach | Wabba-Sego | |
|---|---|---|
| Starting point | Firewalls, often from several vendors. | Microsegmentation (Illumio Core), then firewalls. |
| How it acts | Analysis and request workflow; implementation often stays manual or scripted. | Direct actions on the device, one at a time or in bulk, always through a plan. |
| Before the change | Risk analysis of the request. | Dry run on the live state, flows cut and opened calculated, rules proposed to keep them. |
| Reference | Zone matrices and security standards. | Your labelling model (types, tags, catalogue, label groups) and guardrails built on it. |
| Deployment | Often an online service or a connected central server. | On your premises, offline, from a signed bundle. |
Frequently asked questions
Does Wabba-Sego replace the Illumio console?
No. The console can still be used: Wabba-Sego reads the PCE at every synchronisation and takes the changes made there into account. It adds governance, bulk actions and safe changes.
Is internet access needed?
No. Wabba-Sego is installed and runs offline, on your premises: a virtual appliance (OVA for VMware, VHDX for Hyper-V) or Linux containers.
Can Wabba-Sego write to my PCE unchecked?
No. Every write goes through a plan: dry run on the live state, approval if you enable it, application in order, logging. With a read-only API key, plans are run by hand from their workbook, then checked.
Which devices will be covered next?
After the ITSM integration (ServiceNow first), the Firewalls module, governed just like microsegmentation; later, other microsegmentation vendors, proxies and SASE/SSE.
How is Wabba-Sego licensed?
In work units: you pay for the useful operations that succeed, not for the size of your fleet. Synchronisations, consultations and applying plans are free.
Try Wabba-Sego on your infrastructure
- Demonstration
On your use cases, with your conventions.
- 90-day pilot
Installed on your premises, offline, connected to your PCE: a pilot on a real scope.
- Pilot review
From the labelling model to enforcement: objectives set at the start, measured at the end.