Separate critical systems and sensitive data networks from general user networks.

• Air-gap networks for highest-sensitivity environments
• Dedicated management networks for infrastructure devices
• Separate guest WiFi from corporate networks
• Use jump boxes / bastion hosts for admin access to isolated segments