A network segmentation control is documented but permits unrestricted lateral traffic between sensitive and ordinary workloads. What evidence matters most?

1. The number of VLAN names
2. The diagram's approval date alone
3. Actual permitted paths and tests of the intended boundary
4. The firewall's purchase price