Chapter 10: Quality & Acceptance

Quality benchmarks, acceptance criteria, performance KPIs, compliance validation, and the contrast between poor and best-practice segmentation deployments.

---

Quality assurance in a segmentation project is not a single event at the end of the implementation — it is a continuous process that begins with design review and continues through the operational life of the system. This chapter defines the quality benchmarks and acceptance criteria that must be met at each stage, provides a visual comparison between poor and best-practice deployments, and establishes the performance KPIs that should be monitored on an ongoing basis to detect quality degradation over time.

10.1 Quality Comparison: Poor vs. Best Practice

The visual comparison below illustrates the most common quality failures in segmentation deployments and contrasts them with the expected best-practice state. The differences are not merely cosmetic — each quality failure on the left side of the comparison represents a specific security risk or operational liability. The quality score reflects the aggregate risk posture of the deployment.

Table 10-1: Quality Failure Modes and Remediation

10.2 Acceptance Criteria

The following acceptance criteria define the minimum requirements for a segmentation deployment to be formally accepted. All criteria in the Critical tier must pass with 100% compliance. High-tier criteria must achieve at least 95% compliance, with a documented remediation plan for any gaps. Medium-tier criteria must achieve at least 80% compliance at acceptance, with full compliance within 90 days.

10.3 Ongoing Performance KPIs

After acceptance, the following KPIs must be tracked on a monthly basis and reviewed at the quarterly security review meeting. A KPI that falls below the target threshold for two consecutive months triggers a mandatory remediation review. KPIs that consistently exceed targets may indicate that the monitoring thresholds need to be recalibrated.

10.4 Compliance Validation

For organizations subject to regulatory compliance requirements, the segmentation design must be validated against the applicable framework's specific controls. The table below maps the key segmentation controls to the most common compliance frameworks. Organizations subject to multiple frameworks should use the most stringent requirement where frameworks overlap.