Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

The goal of a DMZ is to add an extra layer of security to your local area network.

Do not place servers or other IT systems that need to be accessible from the internet on to your local network. Instead, set up a "demilitarized zone" (DMZ). Place your systems that need to be accessed over the internet (e.g. web server) into your DMZ. Alternatively, you may move your systems that need to be publicly accessible to the cloud. Because you don't host anything that needs to be publicly accessible you would not need a DMZ.