A system for domain separation in a control plane of a Layer 2, L2, network for use in critical infrastructure applications, the L2 network having a plurality of network instances, the system comprising: (a) a first ring network; (b) a second network configured as a Spanning Tree Protocol / Rapid Spanning Tree Protocol, STP/RSTP, having the plurality of network instances, each instance of the second network connected to the first ring network through a plurality of network devices and configured for generating at least one second network control frame within the control plane across the plurality of network instances and configured for generating at least one second network data frame within a data plane of the L2 network across the plurality of network instances and each network device keeping the control plane of the first ring network and the second network separate while integrating the data plane of the first and second networks; (c) each network device configured for receiving the at least one second network control frame and the at least one second network data frame from each instance associated with the plurality of network devices and configured for assigning each of the at least one second network control frame a second network domain ID and a control frame domain ID thereto by each network device while leaving the at least one second network data frame unmarked, and configured for releasing the at least one second network control frame with the control frame domain ID as a marked second network control frame to be carried on the first ring network while also configured for releasing the data frame unmarked to be carried on the first ring network; wherein, when each network device configured for receiving the marked second network control frame from the first ring network and where the control frame domain ID of the marked second network control frame matches the domain ID of the specific instance of the second network, the network device configured for releasing the second network control frame, unmarked, to the instance of the second network associated with that domain ID after removing the control frame domain ID from the marked second network control frame and when each network device receives the unmarked data frame from the first ring network, the network device configured for releasing the unmarked data frame to the plurality of network instance of the second network such that the control plane across the plurality of instances of the second network is segmented based on the second network domain ID while the data plane across the plurality of instances of the second network remains integrated across the plurality of the instances of the second network. (a) a first ring network; (b) a second network configured as a Spanning Tree Protocol / Rapid Spanning Tree Protocol, STP/RSTP, having the plurality of network instances, each instance of the second network connected to the first ring network through a plurality of network devices and configured for generating at least one second network control frame within the control plane across the plurality of network instances and configured for generating at least one second network data frame within a data plane of the L2 network across the plurality of network instances and each network device keeping the control plane of the first ring network and the second network separate while integrating the data plane of the first and second networks; (c) each network device configured for receiving the at least one second network control frame and the at least one second network data frame from each instance associated with the plurality of network devices and configured for assigning each of the at least one second network control frame a second network domain ID and a control frame domain ID thereto by each network device while leaving the at least one second network data frame unmarked, and configured for releasing the at least one second network control frame with the control frame domain ID as a marked second network control frame to be carried on the first ring network while also configured for releasing the data frame unmarked to be carried on the first ring network;