6.8.2. For that purpose, the relevant entities shall: (a) consider the functional, logical and …

(a)

consider the functional, logical and physical relationship, including location, between trustworthy systems and services;

(b)

grant access to a network or zone based on an assessment of its security requirements;

(c)

keep systems that are critical to the relevant entities operation or to safety in secured zones;

(d)

deploy a demilitarised zone within their communication networks to ensure secure communication originating from or destined to their networks;

(e)

restrict access and communications between and within zones to those necessary for the operation of the relevant entities or for safety;

(f)

separate the dedicated network for administration of network and information systems from the relevant entities’ operational network;

(g)

segregate network administration channels from other network traffic;

(h)

separate the production systems for the relevant entities’ services from systems used in development and testing, including backups.