Control 3.13.3

★What This Means in Plain English

The interfaces and systems used for administration should be separate from those used for regular work. Admin consoles, management VLANs, and administrative jump servers should be isolated from general user environments.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Dedicated management VLAN for all administrative traffic isolated from user VLANs
• Administrative jump servers required for all system management activities
• Separate admin workstations or Privileged Access Workstations (PAWs) for administrative tasks
• FortiGate firewall rules preventing direct user network access to management interfaces
• ComplianceArmor documenting the separation of user and management environments

🔎Assessment Guidance

Assessors will verify that management interfaces are on separate network segments, test that user workstations cannot directly access admin consoles, check that administrative jump servers or PAWs are in use, and review network diagrams showing management separation.

⚠Common Implementation Gaps

• Management interfaces accessible from the general user network
• No dedicated management VLAN
• Admin consoles accessed from standard user workstations
• No jump server or PAW requirement for administration
• User and management traffic on the same network segment

⇄Cross-Framework Mapping