1. A method of managing a network, comprising; generating a set of security policies for a set of managed machines in a network; identifying a cloud-accessible subset of the set of managed machines configured to be exposed to an external cloud environment; and generating a partitioned security class in the set of security policies identifying a set of access conditions to permit access of the cloud-accessible subset to the external cloud environment.