# Ensure production private services are in a network-isolated environment

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876665892477-ensure-production-private-services-are-in-a-network-isolated-environment
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure production private services belong to a project environment that has Block cross-environment connections turned on. Private services have no public URL, but by default they can be reached by every service in the same workspace and region over the private network.

**Rationale**

A private service is only protected from the internet, not from other services. Without isolation, a staging or test service, or a compromised service in another environment, can connect to the production private service directly. Placing it in an isolated environment limits access to services in the same environment.

**Impact**

-   Only services in the production environment can reach the private service
    
-   Limits lateral movement from other environments
    
-   Services outside the environment that relied on it must be moved or reconfigured
    

**Default Value**

By default, private services can be reached over the private network by all services in the same workspace and region. Network-isolated environments require a Pro workspace or higher.

**Pre-Requisites**

-   Workspace Admin role
    
-   Pro plan or higher
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the private service to open it.
    
3.  Check which project environment the service belongs to.
    
4.  Open that environment's ••• menu and check that Block cross-environment connections is turned on.
    
5.  If the service is not in an environment, or the environment is not isolated, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Open the private service's ••• menu and click Move, then select the production project environment.
    
3.  From your workspace home, open the project and scroll to the production environment.
    
4.  Click the ••• menu at the top right of the environment and toggle on Block cross-environment connections.
    
5.  Restart services in the environment to close existing cross-environment connections.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home, open the project and scroll to the production environment.
    
3.  Toggle off Block cross-environment connections, or move the service back out of the environment.
    

**Reference**

-   [https://render.com/docs/private-services](https://render.com/docs/private-services)
    
-   [https://render.com/docs/projects](https://render.com/docs/projects)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.