All hosted NIPRNet-only applications must be located in a local enclave Demilitarized Zone (DMZ).

Without the protection of a DMZ, production networks will be prone to outside attacks as they are allowing externally accessible services to be accessed on the internal LAN. This can cause many undesired consequences such as access to the entire network, Denial of Service attacks, or theft of sensitive information.