---
title: "Examples of multi-tier Tag naming for global network topologies"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/examples-of-multi-tier-tag-naming-for-global-network-topologies"
language: "en"
last_updated: "2026-09-16T22:10:10.182Z"
---

# Examples of multi-tier Tag naming for global network topologies

This article provides examples of multi-tier tag naming for global network topologies.

Here are structured examples of **multi-tier tag naming conventions for global network topologies** in Spirion Sensitive Data Platform, designed to scale across geographic regions, data centers, branch offices, and hybrid cloud environments.

## Standard 3-Tier Hierarchy Model

```
Level 1 (Parent):       GEO - [Region]
   └── Level 2 (Child):    SITE - [Country/City/Data Center]
          └── Level 3:        NET - [VLAN/Subnet/Function] ([CIDR])
```

## Example 1: Global Enterprise Multi-Region (On-Premises & Offices)

```
📁 GEO - Americas (AMER)
   ├── 📁 SITE - US-East DataCenter (Ashburn DC01)
   │      ├── 🏷️ NET - Core Database Tier (10.10.10.0/24)
   │      ├── 🏷️ NET - Application Servers (10.10.20.0/24)
   │      └── 🏷️ NET - Storage & Backup VLAN (10.10.90.0/24)
   │
   ├── 📁 SITE - New York HQ Campus
   │      ├── 🏷️ NET - Executive Floor 22 (10.20.10.0/24)
   │      ├── 🏷️ NET - Finance & Legal (10.20.20.0/23)
   │      └── 🏷️ NET - Corporate WiFi (10.20.50.0/22)
   │
   └── 📁 SITE - São Paulo Regional Branch
          └── 🏷️ NET - Office LAN (10.30.10.0/24)

📁 GEO - Europe & Middle East (EMEA)
   ├── 📁 SITE - Frankfurt DataCenter (FRA01)
   │      ├── 🏷️ NET - Production Kubernetes (172.16.10.0/23)
   │      └── 🏷️ NET - EU Customer DBs (172.16.20.0/24)
   │
   └── 📁 SITE - London Office
          ├── 🏷️ NET - Engineering Workstations (172.20.10.0/23)
          └── 🏷️ NET - General Corporate LAN (172.20.30.0/24)

📁 GEO - Asia-Pacific (APAC)
   ├── 📁 SITE - Singapore Regional Hub
   │      └── 🏷️ NET - Regional Office LAN (192.168.10.0/24)
   │
   └── 📁 SITE - Sydney Office
          └── 🏷️ NET - Office & Lab Network (192.168.20.0/24)
```

## Example 2: Hybrid Cloud & Multi-Cloud Infrastructure

For organizations balancing on-premises networks with public cloud VPCs/VNets:

```
📁 CLOUD - Amazon Web Services (AWS)
   ├── 📁 ENV - Production (us-east-1)
   │      ├── 🏷️ VPC - CDE Sensitive Data Vault (10.100.1.0/24)
   │      ├── 🏷️ VPC - Production EKS Cluster (10.100.10.0/22)
   │      └── 🏷️ VPC - Internal Microservices (10.100.20.0/24)
   │
   └── 📁 ENV - Staging & UAT (us-west-2)
          └── 🏷️ VPC - Non-Prod Workloads (10.101.0.0/16)

📁 CLOUD - Microsoft Azure
   ├── 📁 ENV - Prod UK South
   │      ├── 🏷️ VNet - Core Analytics Subnet (10.200.10.0/24)
   │      └── 🏷️ VNet - Integration Gateway (10.200.20.0/24)
   │
   └── 📁 ENV - Prod East US 2
          └── 🏷️ VNet - SQL Managed Instance Subnet (10.201.10.0/24)

📁 ONPREM - Private Data Centers
   └── 📁 SITE - Primary DC (Chicago)
          ├── 🏷️ NET - SAN/NAS Storage Management (10.5.10.0/24)
          └── 🏷️ NET - Bare Metal Cluster (10.5.20.0/24)
```

## Example 3: Zero-Trust & Micro-Segmented Network Model

For security environments organized primarily by network trust level and compliance boundaries:

```
📁 ZONE - Production CDE (PCI-DSS Isolated)
   ├── 📁 TIER - Web Presentation Layer (10.0.10.0/24)
   ├── 📁 TIER - Application Processing Layer (10.0.20.0/24)
   └── 📁 TIER - Secure Token Vault / Database (10.0.30.0/24)

📁 ZONE - Corporate Intranet (Standard Trust)
   ├── 📁 SITE - HQ Workstations (10.50.0.0/16)
   └── 📁 VPN - Global Remote Workforce Pool (10.99.0.0/16)

📁 ZONE - Extranet / DMZ (Low Trust)
   ├── 🏷️ NET - Public Facing Ingress Gateways (10.1.1.0/24)
   └── 🏷️ NET - Partner API Termination (10.1.2.0/24)
```

## Key Naming Standards & Best Practices

1.  **Include CIDR in Level 3 Tag Names:**
2.  -   Adding the subnet notation (for example, `(10.10.10.0/24)`) directly in the Tag name provides immediate clarity in search pickers without opening Tag details.
3.  **Standardize Prefixes Across Levels:**
4.  -   Use consistent, 3- to 4-letter prefixes for each level
    -   -   `GEO -`, `SITE -`, `NET -`, `VPC -`, `ENV -`
5.  **Align Parent Tags with Scan Targets:**
6.  -   Targeting `GEO - Americas` in a scan policy automatically runs against all nested sites and subnets, while enabling individual subnets to be scanned separately during maintenance windows.
7.  **Leverage Inherited Permissions:**
8.  -   Set **Level 1** parent permissions to grant regional security officers access to all nested child subnets automatically.