What access is actually possible?
Check effective reachability, authentication, privileges, segmentation and logging. A reachable endpoint alone does not establish the ability to change the process.
Network security domain · NSPM
Establish which access
your controls actually allow.
Our network security specialists and platform examine routing, address translation and enforcement together. We explain effective access, relate it to the operation it supports and help your team prioritise changes that reduce exposure while preserving required access.
Network security domainNSPM
SourceNamed access
Network policyRoute · NAT · enforce
ServiceOperating context
IntendedWhat should be allowed?
DeployedWhat is configured?
EffectiveWhat can the path support?
IntendedWhat should
What should
be allowed?
The service requirement, authorised policy and expected relationships between sources and targets.
DeployedWhat has
What has
been configured?
The collected configuration and control state, with its source, scope and relevant time.
EffectiveWhat can
What can
actually happen?
The result of reasoning across forwarding, routing, address translation and enforcement for the bounded question.
Reason through the path, not just the individual rule.
A firewall rule is one part of an access decision. Routing, translation and other enforcement points can change the effective result.
NSPM examines the relevant conditions together. The result needs a clear scope, decisive evidence, an explanation of the path and an honest account of what cannot be established.
The evidence behind the access decision
- The source or identity context, target and service examined
- The relevant routing and address translation
- The enforcement points and decisive controls
- Whether the evidence covers the path sufficiently
- The difference from the intended policy
- Any unsupported, missing or conflicting condition
Deterministic reasoning that can be examined.
01
Define the access question
Specify the source, target, service and context. Identify which evidence and supported semantics are required to answer it.
02
Retain the basis of the result
Keep the input evidence, relevant state and reasoning version identifiable. Another authorised reviewer should be able to inspect why the conclusion follows.
03
Give a clear result within its limits
Where sufficient evidence supports the question, explain the effective access and decisive controls. Where it does not, name the missing or conflicting condition.
04
Compare intention with effect
Assess the result against the agreed policy and service need. Separate the technical difference from its priority and consequence in the client environment.
NSPM within Shared Reality
Connect network access to its operating consequence.
NSPM establishes network and security-policy results. Shared Reality connects the relevant assets, identities, service dependencies, physical context and evidence so specialists can assess their wider meaning.
The cyber view considers exposure, segmentation, privilege and the opportunity for compromise. The operational view considers what the access supports, what an interruption would affect and the constraints on changing it.
How Shared Reality connects the domainsKeep the reasoning steps separate.
Reachability alone does not establish authentication or permission. Permission alone does not establish a process-control capability. A technical capability needs an evidenced dependency before an operational consequence can be asserted.
Each step retains its own evidence and specialist authority.
Carry the result through to verified change.
Illustrative scenario · Shared Reality
A remote-access path supports production maintenance.
Configuration evidence establishes a vendor path to a production system. The service owner confirms that the path is used for maintenance. The permitted actions and process dependencies need their own evidence.
What does the operation depend on?
Establish the maintenance need, control and visibility dependencies, and the consequence of removing access. The service owner and relevant engineers determine the operating constraints.
Governed response & verification
Agree the required access and any restrictions, a safe change window, fallback and authority. After authorised work, verify both that inappropriate access is prevented and that required maintenance still works.
These scenarios explain the method. They are not client outcomes or claims that every domain is automated.
Agree the analysis your environment needs.
Configuration sources, deployment, identity context and analysis coverage determine which questions the evidence can answer. Restricted or disconnected environments require an appropriate, validated evidence workflow.
Network security results connect with the other domains through Shared Reality. We agree domain depth, evidence coverage and specialist support for the work being proposed.
After authorised work
Recollect the relevant evidence and repeat the checks. Verify the intended access restriction or control change, and confirm that required operation and maintenance still work.
Record the result, remaining limits and any further action. The change record and the verified outcome remain distinct.
Discuss the access your operations depend on.
We’ll work with your team to establish effective access, prioritise improvements and agree how to verify them.