Abstract Software Defined Networks (SDN) is a networking paradigm that separates the control plane from the forwarding plane. There is little research on structuring the SDN data plane for security. The Robust Network and Segmentation Algorithm (RNS) is an algorithm based on Product Family Algebra (PFA) that implements layered defence and segmentation strategies to segment resources towards designing secure networks. In this paper, we present an additional plane in charge of the configuration and governance of SDN data planes that we call Dynamic Configuration and Governance (DCG) plane. It is intended to give agility to dynamic networks. It implements the RNS algorithm in SDN environment. Moreover, we propose and suggest three architectures that use DCG plane. Then we assess the three architectures. The assessment results identify an architecture that is suitable for dynamic networks and another for networks that are more stable regarding changes to policy and network topology.