Overview

A DMZ is a network between the internal, trusted network and the external, untrusted network, often the Internet.  This is where you place servers that are offering services to the untrusted networks or Internet, but may still need to access or be accessed from the internal, trusted, network.

DMZ networks are separated from the internal network and from the external network by firewalls, which prevent traffic from flowing directly from the external network to the internal network. The firewall between the internal network and the DMZ allows only the minimal connections needed between the internal network and the DMZ network.  The firewall between the external network and the DMZ allows only connections to the servers on the specified ports in order to offer their services to the external network.

Why are they asking this?

The use of a DMZ network for external facing servers and services is a basic security technique to enhance network defenses.  To offer services, including the reception of e-mail to on premise servers, without the use of a DMZ represents a great risk to the organization.  Other organizations want to know that your organization is at least following basic security practices.

What do they expect?

It is expected that you use a DMZ when appropriate, as in when you have any external facing servers. The questions will vary depending on the organization. Some organizations will ask if they are present, some will ask if you follow best practices, but many will ask for details. Organizations may ask for open port lists, network maps, and/or network data flow diagrams. Depending on the level of association and if there are NDAs in place, this information should be provided if it is properly and legally protected for misuse or disclosure.