An organization just merged with an organization in another legal jurisdiction and must improve its network security posture in ways that do not require additional resources to implement data…

A Host-based Intrusion Detection System (HIDS) monitors individual hosts for suspicious activity but does not enforce or block lateral communication between endpoint PCs, making it ineffective for data isolation.

Configuring a host-based firewall can technically block peer-to-peer traffic, but it requires deployment, configuration, and ongoing management on every individual endpoint, which represents a significant additional resource burden the organization is explicitly trying to avoid.

Endpoint Detection and Response (EDR) is designed to detect, investigate, and respond to threats on individual endpoints - it is not a network isolation tool and does not block communication between PCs.

Network segmentation uses VLANs or subnetting on existing switches and routers to divide the network into isolated zones, preventing direct communication between endpoint PCs in different segments without installing or configuring anything on each individual device. This meets the data isolation requirement between legal jurisdictions using network-level controls that leverage existing infrastructure, satisfying the constraint of no additional per-endpoint resources.