diff --git a/fast/stage-links.sh b/fast/stage-links.sh
deleted file mode 100755
index 5ad46edd8..000000000
--- a/fast/stage-links.sh
+++ /dev/null
@@ -1,187 +0,0 @@
-#!/bin/bash
-# Copyright 2024 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-if [ $# -eq 0 ]; then
-  echo "Error: no folder or GCS bucket specified. Use -h or --help for usage."
-  exit 1
-fi
-
-if [[ "$1" == "-h" || "$1" == "--help" ]]; then
-  cat <<END
-Create commands to initialize stage provider and tfvars files.
-
-Usage with GCS output files bucket:
-  stage-links.sh GCS_BUCKET_URI
-
-Usage with local output files folder:
-  stage-links.sh FOLDER_PATH
-
-Point path/GCS URI to the tenant folder in tenant mode:
-  stage-links.sh FOLDER_PATH/TENANT_SHORTNAME
-END
-  exit 0
-fi
-
-if [[ "$1" == "gs://"* ]]; then
-  CMD="gcloud storage cp $1"
-  CP_CMD=$CMD
-elif [ ! -d "$1" ]; then
-  echo "folder $1 not found"
-  exit 1
-else
-  CMD="ln -s $1"
-  CP_CMD="cp $1"
-fi
-
-GLOBALS="tfvars/0-globals.auto.tfvars.json"
-PROVIDER_CMD=$CMD
-STAGE_NAME=$(basename "$(pwd)")
-EXTRA_FILES=""
-
-case $STAGE_NAME in
-
-"0-bootstrap")
-  unset GLOBALS
-  PROVIDER="providers/0-bootstrap-providers.tf"
-  SELF="$STAGE_NAME.auto.tfvars"
-  TFVARS=""
-  ;;
-"1-resman" | "1-tenant-factory")
-  PROVIDER="providers/${STAGE_NAME}-providers.tf"
-  SELF="$STAGE_NAME.auto.tfvars"
-  TFVARS="tfvars/0-bootstrap.auto.tfvars.json"
-  ;;
-"1-vpcsc")
-  PROVIDER="providers/1-vpcsc-providers.tf"
-  SELF="$STAGE_NAME.auto.tfvars"
-  TFVARS="tfvars/0-bootstrap.auto.tfvars.json"
-  ;;
-"2-networking"*)
-  if [[ -z "$TENANT" ]]; then
-    echo "# if this is a tenant stage, set a \$TENANT variable with the tenant shortname and run the command again"
-    PROVIDER="providers/2-networking-providers.tf"
-    SELF="2-networking.auto.tfvars"
-    TFVARS="tfvars/0-bootstrap.auto.tfvars.json
-    tfvars/1-resman.auto.tfvars.json"
-  else
-    unset GLOBALS
-    PROVIDER="tenants/$TENANT/providers/2-networking-providers.tf"
-    SELF="tenants/$TENANT/2-networking.auto.tfvars"
-    TFVARS="tenants/$TENANT/tfvars/0-bootstrap-tenant.auto.tfvars.json
-    tenants/$TENANT/tfvars/1-resman.auto.tfvars.json"
-  fi
-  ;;
-"2-project-factory"*)
-  if [[ -z "$TENANT" ]]; then
-    echo "# if this is a tenant stage, set a \$TENANT variable with the tenant shortname and run the command again"
-    PROVIDER="providers/2-project-factory-providers.tf"
-    SELF="$STAGE_NAME.auto.tfvars"
-    TFVARS="tfvars/0-bootstrap.auto.tfvars.json
-    tfvars/1-resman.auto.tfvars.json"
-    EXTRA_FILES="tfvars/2-networking.auto.tfvars.json"
-  else
-    unset GLOBALS
-    PROVIDER="tenants/$TENANT/providers/2-project-factory-providers.tf"
-    SELF="tenants/$TENANT/$STAGE_NAME.auto.tfvars"
-    TFVARS="tenants/$TENANT/tfvars/0-bootstrap-tenant.auto.tfvars.json
-    tenants/$TENANT/tfvars/1-resman.auto.tfvars.json"
-    EXTRA_FILES="tenants/$TENANT/tfvars/2-networking.auto.tfvars.json"
-  fi
-  ;;
-"2-security"*)
-  if [[ -z "$TENANT" ]]; then
-    echo "# if this is a tenant stage, set a \$TENANT variable with the tenant shortname and run the command again"
-    PROVIDER="providers/2-security-providers.tf"
-    SELF="$STAGE_NAME.auto.tfvars"
-    TFVARS="tfvars/0-bootstrap.auto.tfvars.json
-    tfvars/1-resman.auto.tfvars.json"
-  else
-    unset GLOBALS
-    PROVIDER="tenants/$TENANT/providers/2-security-providers.tf"
-    SELF="tenants/$TENANT/$STAGE_NAME.auto.tfvars"
-    TFVARS="tenants/$TENANT/tfvars/0-bootstrap-tenant.auto.tfvars.json
-    tenants/$TENANT/tfvars/1-resman.auto.tfvars.json"
-  fi
-  ;;
-"3-network-security"*)
-  if [[ -z "$TENANT" ]]; then
-    echo "# if this is a tenant stage, set a \$TENANT variable with the tenant shortname and run the command again"
-    PROVIDER="providers/3-network-security-providers.tf"
-    SELF="$STAGE_NAME.auto.tfvars"
-    TFVARS="tfvars/0-bootstrap.auto.tfvars.json
-    tfvars/1-resman.auto.tfvars.json
-    tfvars/2-networking.auto.tfvars.json
-    tfvars/2-security.auto.tfvars.json"
-  else
-    unset GLOBALS
-    PROVIDER="tenants/$TENANT/providers/3-network-security-providers.tf"
-    SELF="tenants/$TENANT/$STAGE_NAME.auto.tfvars"
-    TFVARS="tenants/$TENANT/tfvars/0-bootstrap-tenant.auto.tfvars.json
-    tenants/$TENANT/tfvars/1-resman.auto.tfvars.json
-    tenants/$TENANT/tfvars/2-networking.auto.tfvars.json
-    tenants/$TENANT/tfvars/2-security.auto.tfvars.json"
-  fi
-  ;;
-*)
-  # check for a "dev" stage 3
-  echo "no stage found, trying for parent stage 3..."
-  STAGE_NAME=$(basename $(dirname "$(pwd)"))
-  if [[ "$STAGE_NAME" == "3-"* ]]; then
-    if [[ "$STAGE_NAME" == "3-gke-multitenant"* ]]; then
-      STAGE_NAME="3-gke"
-    fi
-    SUFFIX=$(basename "$(pwd)")
-    STAGE_NAME="${STAGE_NAME}-$SUFFIX"
-    PROVIDER="providers/${STAGE_NAME}-providers.tf"
-    TFVARS="tfvars/0-bootstrap.auto.tfvars.json
-    tfvars/1-resman.auto.tfvars.json
-    tfvars/2-networking.auto.tfvars.json
-    tfvars/2-security.auto.tfvars.json"
-  else
-    echo "stage '$STAGE_NAME' not found"
-  fi
-  ;;
-
-esac
-
-echo -e "# copy and paste the following commands for '$STAGE_NAME'\n"
-
-echo "$PROVIDER_CMD/$PROVIDER ./"
-
-# if [[ -v GLOBALS ]]; then
-# OSX uses an old bash version
-if [[ ! -z ${GLOBALS+x} ]]; then
-  echo "$CMD/$GLOBALS ./"
-fi
-
-for f in $TFVARS; do
-  echo "$CMD/$f ./"
-done
-
-if [[ ! -z ${SELF+x} ]]; then
-  echo "# conventional place for stage tfvars (manually created)"
-  echo "$CMD/$SELF ./"
-fi
-
-if [[ ! -z ${EXTRA_FILES+x} ]]; then
-  echo "# optional files"
-  for f in $EXTRA_FILES; do
-    echo "$CMD/$f ./"
-  done
-fi
-
-if [[ ! -z ${MESSAGE+x} ]]; then
-  echo -e "\n# ---> $MESSAGE <---"
-fi
diff --git a/fast/stages/2-networking-a-simple/.fast-stage.env b/fast/stages/2-networking-a-simple/.fast-stage.env
index 592fb344a..9b10516e9 100644
--- a/fast/stages/2-networking-a-simple/.fast-stage.env
+++ b/fast/stages/2-networking-a-simple/.fast-stage.env
@@ -2,4 +2,4 @@ FAST_STAGE_DESCRIPTION="networking (simple)"
 FAST_STAGE_LEVEL=2
 FAST_STAGE_NAME=networking
 FAST_STAGE_DEPS="0-globals 0-bootstrap 1-resman"
-FAST_STAGE_OPTIONAL="2-nsec"
\ No newline at end of file
+FAST_STAGE_OPTIONAL="2-networking-ngfw"
\ No newline at end of file
diff --git a/fast/stages/2-networking-a-simple/README.md b/fast/stages/2-networking-a-simple/README.md
index 415390d5f..926209c9a 100644
--- a/fast/stages/2-networking-a-simple/README.md
+++ b/fast/stages/2-networking-a-simple/README.md
@@ -513,9 +513,10 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS
 | [outputs_location](variables.tf#L84) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> |  | <code>null</code> |  |
 | [psa_ranges](variables.tf#L90) | IP ranges used for Private Service Access (CloudSQL, etc.). | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;  prod &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [regions](variables.tf#L110) | Region definitions. | <code title="object&#40;&#123;&#10;  primary   &#61; string&#10;  secondary &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  primary   &#61; &#34;europe-west1&#34;&#10;  secondary &#61; &#34;europe-west4&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
+| [security_profile_groups](variables-fast.tf#L86) | Security profile group ids used for policy rule substitutions. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>2-networking-ngfw</code> |
 | [spoke_configs](variables.tf#L122) | Spoke connectivity configurations. | <code title="object&#40;&#123;&#10;  ncc_configs &#61; optional&#40;object&#40;&#123;&#10;    export_psc &#61; optional&#40;bool, true&#41;&#10;    dev &#61; optional&#40;object&#40;&#123;&#10;      exclude_export_ranges &#61; list&#40;string&#41;&#10;      &#125;&#41;, &#123;&#10;      exclude_export_ranges &#61; &#91;&#93;&#10;    &#125;&#41;&#10;    prod &#61; optional&#40;object&#40;&#123;&#10;      exclude_export_ranges &#61; list&#40;string&#41;&#10;      &#125;&#41;, &#123;&#10;      exclude_export_ranges &#61; &#91;&#93;&#10;    &#125;&#41;&#10;  &#125;&#41;&#41;&#10;  peering_configs &#61; optional&#40;object&#40;&#123;&#10;    dev &#61; optional&#40;object&#40;&#123;&#10;      export        &#61; optional&#40;bool, true&#41;&#10;      import        &#61; optional&#40;bool, true&#41;&#10;      public_export &#61; optional&#40;bool&#41;&#10;      public_import &#61; optional&#40;bool&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    prod &#61; optional&#40;object&#40;&#123;&#10;      export        &#61; optional&#40;bool, true&#41;&#10;      import        &#61; optional&#40;bool, true&#41;&#10;      public_export &#61; optional&#40;bool&#41;&#10;      public_import &#61; optional&#40;bool&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;&#41;&#10;  vpn_configs &#61; optional&#40;object&#40;&#123;&#10;    dev &#61; optional&#40;object&#40;&#123;&#10;      asn &#61; optional&#40;number, 65501&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets &#61; bool&#10;        ip_ranges   &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    landing &#61; optional&#40;object&#40;&#123;&#10;      asn &#61; optional&#40;number, 65500&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets &#61; bool&#10;        ip_ranges   &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    prod &#61; optional&#40;object&#40;&#123;&#10;      asn &#61; optional&#40;number, 65502&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets &#61; bool&#10;        ip_ranges   &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  peering_configs &#61; &#123;&#125;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
-| [stage_config](variables-fast.tf#L86) | FAST stage configuration. | <code title="object&#40;&#123;&#10;  networking &#61; optional&#40;object&#40;&#123;&#10;    short_name               &#61; optional&#40;string&#41;&#10;    iam_delegated_principals &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_viewer_principals    &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
-| [tag_values](variables-fast.tf#L100) | Root-level tag values. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
+| [stage_config](variables-fast.tf#L94) | FAST stage configuration. | <code title="object&#40;&#123;&#10;  networking &#61; optional&#40;object&#40;&#123;&#10;    short_name               &#61; optional&#40;string&#41;&#10;    iam_delegated_principals &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_viewer_principals    &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
+| [tag_values](variables-fast.tf#L108) | Root-level tag values. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
 | [vpc_configs](variables.tf#L191) | Optional VPC network configurations. | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    cloudnat &#61; optional&#40;object&#40;&#123;&#10;      enable &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  landing &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    cloudnat &#61; optional&#40;object&#40;&#123;&#10;      enable &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  prod &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    cloudnat &#61; optional&#40;object&#40;&#123;&#10;      enable &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [vpn_onprem_primary_config](variables.tf#L244) | VPN gateway configuration for onprem interconnection in the primary region. | <code title="object&#40;&#123;&#10;  peer_external_gateways &#61; map&#40;object&#40;&#123;&#10;    redundancy_type &#61; string&#10;    interfaces      &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  router_config &#61; object&#40;&#123;&#10;    create    &#61; optional&#40;bool, true&#41;&#10;    asn       &#61; number&#10;    name      &#61; optional&#40;string&#41;&#10;    keepalive &#61; optional&#40;number&#41;&#10;    custom_advertise &#61; optional&#40;object&#40;&#123;&#10;      all_subnets &#61; bool&#10;      ip_ranges   &#61; map&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#10;  tunnels &#61; map&#40;object&#40;&#123;&#10;    bgp_peer &#61; object&#40;&#123;&#10;      address        &#61; string&#10;      asn            &#61; number&#10;      route_priority &#61; optional&#40;number, 1000&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets          &#61; bool&#10;        all_vpc_subnets      &#61; bool&#10;        all_peer_vpc_subnets &#61; bool&#10;        ip_ranges            &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#10;    bgp_session_range               &#61; string&#10;    ike_version                     &#61; optional&#40;number, 2&#41;&#10;    peer_external_gateway_interface &#61; optional&#40;number&#41;&#10;    peer_gateway                    &#61; optional&#40;string, &#34;default&#34;&#41;&#10;    router                          &#61; optional&#40;string&#41;&#10;    shared_secret                   &#61; optional&#40;string&#41;&#10;    vpn_gateway_interface           &#61; number&#10;  &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |  |
 
diff --git a/fast/stages/2-networking-a-simple/net-dev.tf b/fast/stages/2-networking-a-simple/net-dev.tf
index 57599abf0..d4776d0e0 100644
--- a/fast/stages/2-networking-a-simple/net-dev.tf
+++ b/fast/stages/2-networking-a-simple/net-dev.tf
@@ -136,12 +136,12 @@ module "dev-firewall-policy" {
   attachments = {
     dev-spoke-0 = module.dev-spoke-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dev/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dev/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "dev-spoke-cloudnat" {
diff --git a/fast/stages/2-networking-a-simple/net-landing.tf b/fast/stages/2-networking-a-simple/net-landing.tf
index b55702efe..0e137b9b5 100644
--- a/fast/stages/2-networking-a-simple/net-landing.tf
+++ b/fast/stages/2-networking-a-simple/net-landing.tf
@@ -114,12 +114,12 @@ module "landing-firewall-policy" {
   attachments = {
     landing-0 = module.landing-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/landing/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/landing/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "landing-nat-primary" {
diff --git a/fast/stages/2-networking-a-simple/net-prod.tf b/fast/stages/2-networking-a-simple/net-prod.tf
index 62175101d..999d34368 100644
--- a/fast/stages/2-networking-a-simple/net-prod.tf
+++ b/fast/stages/2-networking-a-simple/net-prod.tf
@@ -131,12 +131,12 @@ module "prod-firewall-policy" {
   attachments = {
     prod-spoke-0 = module.prod-spoke-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/prod/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/prod/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "prod-spoke-cloudnat" {
diff --git a/fast/stages/2-networking-a-simple/schemas/firewall-policy-rules.schema.json b/fast/stages/2-networking-a-simple/schemas/firewall-policy-rules.schema.json
new file mode 120000
index 000000000..e37a764d2
--- /dev/null
+++ b/fast/stages/2-networking-a-simple/schemas/firewall-policy-rules.schema.json
@@ -0,0 +1 @@
+../../../../modules/net-firewall-policy/schemas/firewall-policy-rules.schema.json
\ No newline at end of file
diff --git a/fast/stages/2-networking-a-simple/variables-fast.tf b/fast/stages/2-networking-a-simple/variables-fast.tf
index dd7f96bf5..c01b3f27f 100644
--- a/fast/stages/2-networking-a-simple/variables-fast.tf
+++ b/fast/stages/2-networking-a-simple/variables-fast.tf
@@ -83,6 +83,14 @@ variable "prefix" {
   }
 }
 
+variable "security_profile_groups" {
+  # tfdoc:variable:source 2-networking-ngfw
+  description = "Security profile group ids used for policy rule substitutions."
+  type        = map(string)
+  nullable    = false
+  default     = {}
+}
+
 variable "stage_config" {
   # tfdoc:variable:source 1-resman
   description = "FAST stage configuration."
diff --git a/fast/stages/2-networking-b-nva/.fast-stage.env b/fast/stages/2-networking-b-nva/.fast-stage.env
index 3e8057f51..83c3bb545 100644
--- a/fast/stages/2-networking-b-nva/.fast-stage.env
+++ b/fast/stages/2-networking-b-nva/.fast-stage.env
@@ -2,4 +2,4 @@ FAST_STAGE_DESCRIPTION="networking (nva)"
 FAST_STAGE_LEVEL=2
 FAST_STAGE_NAME=networking
 FAST_STAGE_DEPS="0-globals 0-bootstrap 1-resman"
-FAST_STAGE_OPTIONAL="2-nsec"
\ No newline at end of file
+FAST_STAGE_OPTIONAL="2-networking-ngfw"
\ No newline at end of file
diff --git a/fast/stages/2-networking-b-nva/README.md b/fast/stages/2-networking-b-nva/README.md
index db6db9716..20b88a151 100644
--- a/fast/stages/2-networking-b-nva/README.md
+++ b/fast/stages/2-networking-b-nva/README.md
@@ -576,8 +576,9 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS
 | [outputs_location](variables.tf#L112) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> |  | <code>null</code> |  |
 | [psa_ranges](variables.tf#L118) | IP ranges used for Private Service Access (e.g. CloudSQL). Ranges is in name => range format. | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;  prod &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [regions](variables.tf#L138) | Region definitions. | <code title="object&#40;&#123;&#10;  primary   &#61; string&#10;  secondary &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  primary   &#61; &#34;europe-west1&#34;&#10;  secondary &#61; &#34;europe-west4&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
-| [stage_config](variables-fast.tf#L86) | FAST stage configuration. | <code title="object&#40;&#123;&#10;  networking &#61; optional&#40;object&#40;&#123;&#10;    short_name               &#61; optional&#40;string&#41;&#10;    iam_delegated_principals &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_viewer_principals    &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
-| [tag_values](variables-fast.tf#L100) | Root-level tag values. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
+| [security_profile_groups](variables-fast.tf#L86) | Security profile group ids used for policy rule substitutions. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>2-networking-ngfw</code> |
+| [stage_config](variables-fast.tf#L94) | FAST stage configuration. | <code title="object&#40;&#123;&#10;  networking &#61; optional&#40;object&#40;&#123;&#10;    short_name               &#61; optional&#40;string&#41;&#10;    iam_delegated_principals &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_viewer_principals    &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
+| [tag_values](variables-fast.tf#L108) | Root-level tag values. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
 | [vpc_configs](variables.tf#L150) | Optional VPC network configurations. | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  dmz &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    cloudnat &#61; optional&#40;object&#40;&#123;&#10;      enable &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  landing &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  prod &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  regional_primary &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  regional_secondary &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [vpn_onprem_primary_config](variables.tf#L233) | VPN gateway configuration for onprem interconnection in the primary region. | <code title="object&#40;&#123;&#10;  peer_external_gateways &#61; map&#40;object&#40;&#123;&#10;    redundancy_type &#61; string&#10;    interfaces      &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  router_config &#61; object&#40;&#123;&#10;    create    &#61; optional&#40;bool, true&#41;&#10;    asn       &#61; number&#10;    name      &#61; optional&#40;string&#41;&#10;    keepalive &#61; optional&#40;number&#41;&#10;    custom_advertise &#61; optional&#40;object&#40;&#123;&#10;      all_subnets &#61; bool&#10;      ip_ranges   &#61; map&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#10;  tunnels &#61; map&#40;object&#40;&#123;&#10;    bgp_peer &#61; object&#40;&#123;&#10;      address        &#61; string&#10;      asn            &#61; number&#10;      route_priority &#61; optional&#40;number, 1000&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets          &#61; bool&#10;        all_vpc_subnets      &#61; bool&#10;        all_peer_vpc_subnets &#61; bool&#10;        ip_ranges            &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#10;    bgp_session_range               &#61; string&#10;    ike_version                     &#61; optional&#40;number, 2&#41;&#10;    peer_external_gateway_interface &#61; optional&#40;number&#41;&#10;    peer_gateway                    &#61; optional&#40;string, &#34;default&#34;&#41;&#10;    router                          &#61; optional&#40;string&#41;&#10;    shared_secret                   &#61; optional&#40;string&#41;&#10;    vpn_gateway_interface           &#61; number&#10;  &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |  |
 | [vpn_onprem_secondary_config](variables.tf#L276) | VPN gateway configuration for onprem interconnection in the secondary region. | <code title="object&#40;&#123;&#10;  peer_external_gateways &#61; map&#40;object&#40;&#123;&#10;    redundancy_type &#61; string&#10;    interfaces      &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  router_config &#61; object&#40;&#123;&#10;    create    &#61; optional&#40;bool, true&#41;&#10;    asn       &#61; number&#10;    name      &#61; optional&#40;string&#41;&#10;    keepalive &#61; optional&#40;number&#41;&#10;    custom_advertise &#61; optional&#40;object&#40;&#123;&#10;      all_subnets &#61; bool&#10;      ip_ranges   &#61; map&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#10;  tunnels &#61; map&#40;object&#40;&#123;&#10;    bgp_peer &#61; object&#40;&#123;&#10;      address        &#61; string&#10;      asn            &#61; number&#10;      route_priority &#61; optional&#40;number, 1000&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets          &#61; bool&#10;        all_vpc_subnets      &#61; bool&#10;        all_peer_vpc_subnets &#61; bool&#10;        ip_ranges            &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#10;    bgp_session_range               &#61; string&#10;    ike_version                     &#61; optional&#40;number, 2&#41;&#10;    peer_external_gateway_interface &#61; optional&#40;number&#41;&#10;    peer_gateway                    &#61; optional&#40;string, &#34;default&#34;&#41;&#10;    router                          &#61; optional&#40;string&#41;&#10;    shared_secret                   &#61; optional&#40;string&#41;&#10;    vpn_gateway_interface           &#61; number&#10;  &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |  |
diff --git a/fast/stages/2-networking-b-nva/net-dev.tf b/fast/stages/2-networking-b-nva/net-dev.tf
index 5032ea921..5a95118a1 100644
--- a/fast/stages/2-networking-b-nva/net-dev.tf
+++ b/fast/stages/2-networking-b-nva/net-dev.tf
@@ -156,12 +156,12 @@ module "dev-firewall-policy" {
   attachments = {
     dev-spoke-0 = module.dev-spoke-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dev/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dev/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "peering-dev" {
diff --git a/fast/stages/2-networking-b-nva/net-landing.tf b/fast/stages/2-networking-b-nva/net-landing.tf
index 91ec3a89b..702946765 100644
--- a/fast/stages/2-networking-b-nva/net-landing.tf
+++ b/fast/stages/2-networking-b-nva/net-landing.tf
@@ -137,12 +137,12 @@ module "dmz-firewall-policy" {
   attachments = {
     dmz-0 = module.dmz-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dmz/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dmz/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 # NAT
@@ -216,10 +216,10 @@ module "landing-firewall-policy" {
   attachments = {
     landing-0 = module.landing-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/landing/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/landing/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
diff --git a/fast/stages/2-networking-b-nva/net-prod.tf b/fast/stages/2-networking-b-nva/net-prod.tf
index a40dc9876..dfe9cdadb 100644
--- a/fast/stages/2-networking-b-nva/net-prod.tf
+++ b/fast/stages/2-networking-b-nva/net-prod.tf
@@ -156,12 +156,12 @@ module "prod-firewall-policy" {
   attachments = {
     prod-spoke-0 = module.prod-spoke-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/prod/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/prod/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "peering-prod" {
diff --git a/fast/stages/2-networking-b-nva/net-regional-vpc.tf b/fast/stages/2-networking-b-nva/net-regional-vpc.tf
index 3e7aecd6a..155ae1793 100644
--- a/fast/stages/2-networking-b-nva/net-regional-vpc.tf
+++ b/fast/stages/2-networking-b-nva/net-regional-vpc.tf
@@ -108,12 +108,12 @@ module "regional-primary-firewall-policy" {
   attachments = {
     regional-primary-0 = module.regional-primary-vpc[0].id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/regional-primary/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/regional-primary/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 # Regional Secondary VPC
@@ -172,10 +172,10 @@ module "regional-secondary-firewall-policy" {
   attachments = {
     regional-secondary-0 = module.regional-secondary-vpc[0].id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/regional-secondary/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/regional-secondary/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
diff --git a/fast/stages/2-networking-b-nva/schemas/firewall-policy-rules.schema.json b/fast/stages/2-networking-b-nva/schemas/firewall-policy-rules.schema.json
new file mode 120000
index 000000000..e37a764d2
--- /dev/null
+++ b/fast/stages/2-networking-b-nva/schemas/firewall-policy-rules.schema.json
@@ -0,0 +1 @@
+../../../../modules/net-firewall-policy/schemas/firewall-policy-rules.schema.json
\ No newline at end of file
diff --git a/fast/stages/2-networking-b-nva/variables-fast.tf b/fast/stages/2-networking-b-nva/variables-fast.tf
index dd7f96bf5..c01b3f27f 100644
--- a/fast/stages/2-networking-b-nva/variables-fast.tf
+++ b/fast/stages/2-networking-b-nva/variables-fast.tf
@@ -83,6 +83,14 @@ variable "prefix" {
   }
 }
 
+variable "security_profile_groups" {
+  # tfdoc:variable:source 2-networking-ngfw
+  description = "Security profile group ids used for policy rule substitutions."
+  type        = map(string)
+  nullable    = false
+  default     = {}
+}
+
 variable "stage_config" {
   # tfdoc:variable:source 1-resman
   description = "FAST stage configuration."
diff --git a/fast/stages/2-networking-c-separate-envs/.fast-stage.env b/fast/stages/2-networking-c-separate-envs/.fast-stage.env
index 0c1d6b578..1d3fffa33 100644
--- a/fast/stages/2-networking-c-separate-envs/.fast-stage.env
+++ b/fast/stages/2-networking-c-separate-envs/.fast-stage.env
@@ -2,4 +2,4 @@ FAST_STAGE_DESCRIPTION="networking (separate environments)"
 FAST_STAGE_LEVEL=2
 FAST_STAGE_NAME=networking
 FAST_STAGE_DEPS="0-globals 0-bootstrap 1-resman"
-FAST_STAGE_OPTIONAL="2-nsec"
\ No newline at end of file
+FAST_STAGE_OPTIONAL="2-networking-ngfw"
\ No newline at end of file
diff --git a/fast/stages/2-networking-c-separate-envs/README.md b/fast/stages/2-networking-c-separate-envs/README.md
index 853a0a846..175d31d79 100644
--- a/fast/stages/2-networking-c-separate-envs/README.md
+++ b/fast/stages/2-networking-c-separate-envs/README.md
@@ -371,8 +371,9 @@ Regions are defined via the `regions` variable which sets up a mapping between t
 | [outputs_location](variables.tf#L79) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> |  | <code>null</code> |  |
 | [psa_ranges](variables.tf#L85) | IP ranges used for Private Service Access (e.g. CloudSQL). | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;  prod &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [regions](variables.tf#L105) | Region definitions. | <code title="object&#40;&#123;&#10;  primary &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  primary &#61; &#34;europe-west1&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
-| [stage_config](variables-fast.tf#L86) | FAST stage configuration. | <code title="object&#40;&#123;&#10;  networking &#61; optional&#40;object&#40;&#123;&#10;    short_name               &#61; optional&#40;string&#41;&#10;    iam_delegated_principals &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_viewer_principals    &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
-| [tag_values](variables-fast.tf#L100) | Root-level tag values. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
+| [security_profile_groups](variables-fast.tf#L86) | Security profile group ids used for policy rule substitutions. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>2-networking-ngfw</code> |
+| [stage_config](variables-fast.tf#L94) | FAST stage configuration. | <code title="object&#40;&#123;&#10;  networking &#61; optional&#40;object&#40;&#123;&#10;    short_name               &#61; optional&#40;string&#41;&#10;    iam_delegated_principals &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_viewer_principals    &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
+| [tag_values](variables-fast.tf#L108) | Root-level tag values. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> | <code>1-resman</code> |
 | [vpc_configs](variables.tf#L115) | Optional VPC network configurations. | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    cloudnat &#61; optional&#40;object&#40;&#123;&#10;      enable &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  prod &#61; optional&#40;object&#40;&#123;&#10;    mtu &#61; optional&#40;number, 1500&#41;&#10;    cloudnat &#61; optional&#40;object&#40;&#123;&#10;      enable &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    dns &#61; optional&#40;object&#40;&#123;&#10;      create_inbound_policy &#61; optional&#40;bool, true&#41;&#10;      enable_logging        &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    firewall &#61; optional&#40;object&#40;&#123;&#10;      create_policy       &#61; optional&#40;bool, false&#41;&#10;      policy_has_priority &#61; optional&#40;bool, false&#41;&#10;      use_classic         &#61; optional&#40;bool, true&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [vpn_onprem_dev_primary_config](variables.tf#L153) | VPN gateway configuration for onprem interconnection from dev in the primary region. | <code title="object&#40;&#123;&#10;  peer_external_gateways &#61; map&#40;object&#40;&#123;&#10;    redundancy_type &#61; string&#10;    interfaces      &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  router_config &#61; object&#40;&#123;&#10;    create    &#61; optional&#40;bool, true&#41;&#10;    asn       &#61; number&#10;    name      &#61; optional&#40;string&#41;&#10;    keepalive &#61; optional&#40;number&#41;&#10;    custom_advertise &#61; optional&#40;object&#40;&#123;&#10;      all_subnets &#61; bool&#10;      ip_ranges   &#61; map&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#10;  tunnels &#61; map&#40;object&#40;&#123;&#10;    bgp_peer &#61; object&#40;&#123;&#10;      address        &#61; string&#10;      asn            &#61; number&#10;      route_priority &#61; optional&#40;number, 1000&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets          &#61; bool&#10;        all_vpc_subnets      &#61; bool&#10;        all_peer_vpc_subnets &#61; bool&#10;        ip_ranges            &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#10;    bgp_session_range               &#61; string&#10;    ike_version                     &#61; optional&#40;number, 2&#41;&#10;    peer_external_gateway_interface &#61; optional&#40;number&#41;&#10;    peer_gateway                    &#61; optional&#40;string, &#34;default&#34;&#41;&#10;    router                          &#61; optional&#40;string&#41;&#10;    shared_secret                   &#61; optional&#40;string&#41;&#10;    vpn_gateway_interface           &#61; number&#10;  &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |  |
 | [vpn_onprem_prod_primary_config](variables.tf#L196) | VPN gateway configuration for onprem interconnection from prod in the primary region. | <code title="object&#40;&#123;&#10;  peer_external_gateways &#61; map&#40;object&#40;&#123;&#10;    redundancy_type &#61; string&#10;    interfaces      &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  router_config &#61; object&#40;&#123;&#10;    create    &#61; optional&#40;bool, true&#41;&#10;    asn       &#61; number&#10;    name      &#61; optional&#40;string&#41;&#10;    keepalive &#61; optional&#40;number&#41;&#10;    custom_advertise &#61; optional&#40;object&#40;&#123;&#10;      all_subnets &#61; bool&#10;      ip_ranges   &#61; map&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#10;  tunnels &#61; map&#40;object&#40;&#123;&#10;    bgp_peer &#61; object&#40;&#123;&#10;      address        &#61; string&#10;      asn            &#61; number&#10;      route_priority &#61; optional&#40;number, 1000&#41;&#10;      custom_advertise &#61; optional&#40;object&#40;&#123;&#10;        all_subnets          &#61; bool&#10;        all_vpc_subnets      &#61; bool&#10;        all_peer_vpc_subnets &#61; bool&#10;        ip_ranges            &#61; map&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#10;    bgp_session_range               &#61; string&#10;    ike_version                     &#61; optional&#40;number, 2&#41;&#10;    peer_external_gateway_interface &#61; optional&#40;number&#41;&#10;    peer_gateway                    &#61; optional&#40;string, &#34;default&#34;&#41;&#10;    router                          &#61; optional&#40;string&#41;&#10;    shared_secret                   &#61; optional&#40;string&#41;&#10;    vpn_gateway_interface           &#61; number&#10;  &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |  |
diff --git a/fast/stages/2-networking-c-separate-envs/net-dev.tf b/fast/stages/2-networking-c-separate-envs/net-dev.tf
index cfab30d90..42b966070 100644
--- a/fast/stages/2-networking-c-separate-envs/net-dev.tf
+++ b/fast/stages/2-networking-c-separate-envs/net-dev.tf
@@ -136,12 +136,12 @@ module "dev-firewall-policy" {
   attachments = {
     dev-spoke-0 = module.dev-spoke-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dev/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dev/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "dev-spoke-cloudnat" {
diff --git a/fast/stages/2-networking-c-separate-envs/net-prod.tf b/fast/stages/2-networking-c-separate-envs/net-prod.tf
index 96b0e2c91..77c730381 100644
--- a/fast/stages/2-networking-c-separate-envs/net-prod.tf
+++ b/fast/stages/2-networking-c-separate-envs/net-prod.tf
@@ -136,12 +136,12 @@ module "prod-firewall-policy" {
   attachments = {
     prod-spoke-0 = module.prod-spoke-vpc.id
   }
-  # TODO: add context for security groups
   factories_config = {
     cidr_file_path          = var.factories_config.firewall.cidr_file
     egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/prod/egress.yaml"
     ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/prod/ingress.yaml"
   }
+  security_profile_group_ids = var.security_profile_groups
 }
 
 module "prod-spoke-cloudnat" {
diff --git a/fast/stages/2-networking-c-separate-envs/schemas/firewall-policy-rules.schema.json b/fast/stages/2-networking-c-separate-envs/schemas/firewall-policy-rules.schema.json
new file mode 120000
index 000000000..e37a764d2
--- /dev/null
+++ b/fast/stages/2-networking-c-separate-envs/schemas/firewall-policy-rules.schema.json
@@ -0,0 +1 @@
+../../../../modules/net-firewall-policy/schemas/firewall-policy-rules.schema.json
\ No newline at end of file
diff --git a/fast/stages/2-networking-c-separate-envs/variables-fast.tf b/fast/stages/2-networking-c-separate-envs/variables-fast.tf
index dd7f96bf5..c01b3f27f 100644
--- a/fast/stages/2-networking-c-separate-envs/variables-fast.tf
+++ b/fast/stages/2-networking-c-separate-envs/variables-fast.tf
@@ -83,6 +83,14 @@ variable "prefix" {
   }
 }
 
+variable "security_profile_groups" {
+  # tfdoc:variable:source 2-networking-ngfw
+  description = "Security profile group ids used for policy rule substitutions."
+  type        = map(string)
+  nullable    = false
+  default     = {}
+}
+
 variable "stage_config" {
   # tfdoc:variable:source 1-resman
   description = "FAST stage configuration."