What it asks for. This control expects groups of information services, users and information systems to be segregated in the organisation's networks. The aim is to split networks into security boundaries and control traffic between them based on business needs.
In practice. Good practice means dividing networks into separate domains based on trust level, criticality and function, for example separating user, server, management, guest and OT networks, and controlling traffic between them. Cloud environments apply equivalent separation through virtual networks and security groups. Auditors look for network diagrams showing segments, rules controlling traffic between them and reviews of those rules.
Common gaps. Common gaps are flat networks, management interfaces reachable from user segments and guest or IoT networks that can reach internal systems. Rules between segments also tend to grow broader over time without review.