An isolation plan for a legacy system should state the boundary, the short list of allowed connections, the controls that enforce the boundary, the tests that prove it, and who reviews it and when. If you cannot test a line in the plan, the line is a wish, not a control.
Why isolation is the usual answer
NIST's text on unsupported components says the increased risk can be mitigated, for example, by prohibiting connection to public or uncontrolled networks or implementing other forms of isolation. Its boundary protection enhancement on isolating system components says isolation limits unauthorized information flows among components and provides the chance to apply greater protection to selected ones. It adds that the degree of isolation varies depending on the mechanism, from separate physical networks to firewalls, virtualization and encryption with distinct keys.
That last point matters. "Isolated" is a spectrum, so the plan has to say which kind you mean.
The checklist
| Item | What to write | How to test |
|---|---|---|
| Boundary | Segment name, address range, devices inside | Review a network diagram against actual configuration |
| Inbound allow list | Source, port, purpose, owner for each entry | Attempt a connection from a non-listed host. It must fail |
| Outbound allow list | Destinations the system must reach, if any | Attempt an internet connection from the host. It must fail |
| Administrative path | Jump host or console, with authentication | Try direct management access. It must fail |
| Data movement | How files and updates enter and leave | Review the process, including removable media rules |
| Monitoring | What is logged, where, who reads it | Cause a denied connection and find it in the log |
| Recovery | Backups and restore steps | Perform a restore test |
| Review | Date, reviewer, trigger events | Calendar entry exists |
Common gaps
- A second network card. A host in the isolated segment with another interface on a general network defeats the plan.
- Old firewall rules. Rules for a previous vendor or project that nobody removed.
- Shared management tools. A monitoring or backup server that reaches both worlds becomes a bridge.
- Removable media. A USB stick is a network cable that nobody logged.
Run the tests, keep the output
Run each test from the table, save the result with a date and the tester's name, and attach it to the exception record. Rerun them after any firewall change, any change to the host's network settings and on every scheduled review.
Set review triggers
Beyond the calendar, write down events that reopen the plan: a new connection request, a new vulnerability in the system that is actively exploited, a change of owner, a vendor ending support for a connected system, or an incident nearby.
Try it yourself
Click through it at your own pace, or open it full screen. Step through it to see how findings are listed and prioritized.
Quick check
Is a VLAN enough to count as isolation?
A VLAN separates traffic only if the rules between VLANs are strict. A VLAN with permissive routing is segmentation in name only, so test it.
Do isolated systems still need patching?
Where a patch exists and can be applied safely, apply it. Isolation is for the cases where it cannot be.
Sources
- NIST SP 800-53 Rev 5 control catalog (OSCAL JSON, NIST oscal-content repository) (SA-22 Unsupported System Components and SC-7(21) Isolation of System Components)
Last reviewed: 19 October 2026.
