I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH and so on. But the only issue that the two zones don't have the same severity in terms of data security and so on. There is already a firewall in place but I thought that it would be better to have some kind of bastion hosts proxying every requests from zone1 to zone2 and vice-versa. My question is: is there is specific reference from the standards / good practices (PCI/DSS, ISO2K, CIS Controls, NIST, G7 ...) that say so or I am just being paranoid? (I am 100% convinced that there is but I can't have my hand on it). I need this reference to convince the IT guys!!!