diff --git a/fast/stages/2-networking-b-nva/README.md b/fast/stages/2-networking-b-nva/README.md
index 1320474a5f..8836944b09 100644
--- a/fast/stages/2-networking-b-nva/README.md
+++ b/fast/stages/2-networking-b-nva/README.md
@@ -570,7 +570,7 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS
 | [custom_roles](variables-fast.tf#L40) | Custom roles defined at the org level, in key => id format. | <code title="object&#40;&#123;&#10;  project_iam_viewer &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> | <code>0-bootstrap</code> |
 | [dns](variables.tf#L48) | DNS configuration. | <code title="object&#40;&#123;&#10;  resolvers &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [essential_contacts](variables.tf#L57) | Email used for essential contacts, unset if null. | <code>string</code> |  | <code>null</code> |  |
-| [factories_config](variables.tf#L63) | Configuration for network resource factories. | <code title="object&#40;&#123;&#10;  data_dir              &#61; optional&#40;string, &#34;data&#34;&#41;&#10;  dns_policy_rules_file &#61; optional&#40;string, &#34;data&#47;dns-policy-rules.yaml&#34;&#41;&#10;  firewall_policy_name  &#61; optional&#40;string, &#34;net-default&#34;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  data_dir &#61; &#34;data&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
+| [factories_config](variables.tf#L63) | Configuration for network resource factories. | <code title="object&#40;&#123;&#10;  dashboards       &#61; optional&#40;string, &#34;data&#47;dashboards&#34;&#41;&#10;  dns_policy_rules &#61; optional&#40;string, &#34;data&#47;dns-policy-rules.yaml&#34;&#41;&#10;  firewall &#61; optional&#40;object&#40;&#123;&#10;    cidr_file     &#61; optional&#40;string, &#34;data&#47;cidrs.yaml&#34;&#41;&#10;    classic_rules &#61; optional&#40;string, &#34;data&#47;firewall-rules&#34;&#41;&#10;    hierarchical &#61; optional&#40;object&#40;&#123;&#10;      egress_rules  &#61; optional&#40;string, &#34;data&#47;hierarchical-egress-rules.yaml&#34;&#41;&#10;      ingress_rules &#61; optional&#40;string, &#34;data&#47;hierarchical-ingress-rules.yaml&#34;&#41;&#10;      policy_name   &#61; optional&#40;string, &#34;net-default&#34;&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    policy_rules &#61; optional&#40;string, &#34;data&#47;firewall-policies&#34;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  subnets &#61; optional&#40;string, &#34;data&#47;subnets&#34;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [gcp_ranges](variables.tf#L84) | GCP address ranges in name => range format. | <code>map&#40;string&#41;</code> |  | <code title="&#123;&#10;  gcp_dev_primary            &#61; &#34;10.68.0.0&#47;16&#34;&#10;  gcp_dev_secondary          &#61; &#34;10.84.0.0&#47;16&#34;&#10;  gcp_regional_vpc_primary   &#61; &#34;10.65.0.0&#47;17&#34;&#10;  gcp_regional_vpc_secondary &#61; &#34;10.81.0.0&#47;17&#34;&#10;  gcp_landing_primary        &#61; &#34;10.64.0.0&#47;17&#34;&#10;  gcp_landing_secondary      &#61; &#34;10.80.0.0&#47;17&#34;&#10;  gcp_dmz_primary            &#61; &#34;10.64.128.0&#47;17&#34;&#10;  gcp_dmz_secondary          &#61; &#34;10.80.128.0&#47;17&#34;&#10;  gcp_prod_primary           &#61; &#34;10.72.0.0&#47;16&#34;&#10;  gcp_prod_secondary         &#61; &#34;10.88.0.0&#47;16&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
 | [network_mode](variables.tf#L101) | Selection of the network design to deploy. | <code>string</code> |  | <code>&#34;simple&#34;</code> |  |
 | [outputs_location](variables.tf#L112) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> |  | <code>null</code> |  |
diff --git a/fast/stages/2-networking-b-nva/dns-landing.tf b/fast/stages/2-networking-b-nva/dns-landing.tf
index f36965a2f8..415a96cebb 100644
--- a/fast/stages/2-networking-b-nva/dns-landing.tf
+++ b/fast/stages/2-networking-b-nva/dns-landing.tf
@@ -98,7 +98,7 @@ module "landing-dns-policy-googleapis" {
   project_id = module.landing-project.project_id
   name       = "googleapis"
   factories_config = {
-    rules = var.factories_config.dns_policy_rules_file
+    rules = var.factories_config.dns_policy_rules
   }
   networks = merge(
     {
diff --git a/fast/stages/2-networking-b-nva/main.tf b/fast/stages/2-networking-b-nva/main.tf
index 179ddbfaf1..2493c6dd83 100644
--- a/fast/stages/2-networking-b-nva/main.tf
+++ b/fast/stages/2-networking-b-nva/main.tf
@@ -76,10 +76,11 @@ module "folder" {
 
 module "firewall-policy-default" {
   source    = "../../../modules/net-firewall-policy"
-  name      = var.factories_config.firewall_policy_name
+  name      = var.factories_config.firewall.hierarchical.policy_name
   parent_id = module.folder.id
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/hierarchical-ingress-rules.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = var.factories_config.firewall.hierarchical.egress_rules
+    ingress_rules_file_path = var.factories_config.firewall.hierarchical.ingress_rules
   }
 }
diff --git a/fast/stages/2-networking-b-nva/monitoring.tf b/fast/stages/2-networking-b-nva/monitoring.tf
index 95bb097aee..776ee24ae6 100644
--- a/fast/stages/2-networking-b-nva/monitoring.tf
+++ b/fast/stages/2-networking-b-nva/monitoring.tf
@@ -17,7 +17,7 @@
 # tfdoc:file:description Network monitoring dashboards.
 
 locals {
-  dashboard_path  = "${var.factories_config.data_dir}/dashboards"
+  dashboard_path  = var.factories_config.dashboards
   dashboard_files = fileset(local.dashboard_path, "*.json")
   dashboards = {
     for filename in local.dashboard_files :
diff --git a/fast/stages/2-networking-b-nva/net-dev.tf b/fast/stages/2-networking-b-nva/net-dev.tf
index a8a0d1b306..3e6ffdb16f 100644
--- a/fast/stages/2-networking-b-nva/net-dev.tf
+++ b/fast/stages/2-networking-b-nva/net-dev.tf
@@ -91,7 +91,7 @@ module "dev-spoke-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+    subnets_folder = "${var.factories_config.subnets}/dev"
   }
   delete_default_routes_on_create   = true
   firewall_policy_enforcement_order = local.dev_cfg.fw_order
@@ -142,8 +142,8 @@ module "dev-spoke-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/dev"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/dev"
   }
 }
 
@@ -158,9 +158,9 @@ module "dev-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/dev/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/dev/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dev/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dev/ingress.yaml"
   }
 }
 
diff --git a/fast/stages/2-networking-b-nva/net-landing.tf b/fast/stages/2-networking-b-nva/net-landing.tf
index 7a7c022b93..59d6e60849 100644
--- a/fast/stages/2-networking-b-nva/net-landing.tf
+++ b/fast/stages/2-networking-b-nva/net-landing.tf
@@ -83,7 +83,7 @@ module "dmz-vpc" {
   create_googleapis_routes = null
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/dmz"
+    subnets_folder = "${var.factories_config.subnets}/dmz"
   }
   delete_default_routes_on_create   = true
   firewall_policy_enforcement_order = local.dmz_cfg.fw_order
@@ -123,8 +123,8 @@ module "dmz-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/dmz"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/dmz"
   }
 }
 
@@ -139,9 +139,9 @@ module "dmz-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/dmz/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/dmz/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dmz/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dmz/ingress.yaml"
   }
 }
 
@@ -183,7 +183,7 @@ module "landing-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/landing"
+    subnets_folder = "${var.factories_config.subnets}/landing"
   }
   firewall_policy_enforcement_order = local.landing_cfg.fw_order
   # Set explicit routes for googleapis in case the default route is deleted
@@ -202,8 +202,8 @@ module "landing-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/landing"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/landing"
   }
 }
 
@@ -218,8 +218,8 @@ module "landing-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/landing/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/landing/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/landing/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/landing/ingress.yaml"
   }
 }
diff --git a/fast/stages/2-networking-b-nva/net-prod.tf b/fast/stages/2-networking-b-nva/net-prod.tf
index 431219604f..985156185a 100644
--- a/fast/stages/2-networking-b-nva/net-prod.tf
+++ b/fast/stages/2-networking-b-nva/net-prod.tf
@@ -91,7 +91,7 @@ module "prod-spoke-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+    subnets_folder = "${var.factories_config.subnets}/prod"
   }
   delete_default_routes_on_create   = true
   firewall_policy_enforcement_order = local.prod_cfg.fw_order
@@ -142,8 +142,8 @@ module "prod-spoke-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/prod"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/prod"
   }
 }
 
@@ -158,9 +158,9 @@ module "prod-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/prod/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/prod/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/prod/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/prod/ingress.yaml"
   }
 }
 
diff --git a/fast/stages/2-networking-b-nva/net-regional-vpc.tf b/fast/stages/2-networking-b-nva/net-regional-vpc.tf
index cacafbf779..0be019d026 100644
--- a/fast/stages/2-networking-b-nva/net-regional-vpc.tf
+++ b/fast/stages/2-networking-b-nva/net-regional-vpc.tf
@@ -68,7 +68,7 @@ module "regional-primary-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/regional-pri"
+    subnets_folder = "${var.factories_config.subnets}/regional-pri"
   }
   routes = {
     default = {
@@ -94,8 +94,8 @@ module "regional-primary-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/regional-pri"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/regional-pri"
   }
 }
 
@@ -110,9 +110,9 @@ module "regional-primary-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/regional-primary/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/regional-primary/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/regional-primary/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/regional-primary/ingress.yaml"
   }
 }
 
@@ -132,7 +132,7 @@ module "regional-secondary-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/regional-sec"
+    subnets_folder = "${var.factories_config.subnets}/regional-sec"
   }
   routes = {
     default = {
@@ -158,8 +158,8 @@ module "regional-secondary-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/regional-sec"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/regional-sec"
   }
 }
 
@@ -174,8 +174,8 @@ module "regional-secondary-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/regional-secondary/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/regional-secondary/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/regional-secondary/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/regional-secondary/ingress.yaml"
   }
 }
diff --git a/fast/stages/2-networking-b-nva/variables.tf b/fast/stages/2-networking-b-nva/variables.tf
index 7e716e4a2e..5f679925ad 100644
--- a/fast/stages/2-networking-b-nva/variables.tf
+++ b/fast/stages/2-networking-b-nva/variables.tf
@@ -63,22 +63,22 @@ variable "essential_contacts" {
 variable "factories_config" {
   description = "Configuration for network resource factories."
   type = object({
-    data_dir              = optional(string, "data")
-    dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml")
-    firewall_policy_name  = optional(string, "net-default")
+    dashboards       = optional(string, "data/dashboards")
+    dns_policy_rules = optional(string, "data/dns-policy-rules.yaml")
+    firewall = optional(object({
+      cidr_file     = optional(string, "data/cidrs.yaml")
+      classic_rules = optional(string, "data/firewall-rules")
+      hierarchical = optional(object({
+        egress_rules  = optional(string, "data/hierarchical-egress-rules.yaml")
+        ingress_rules = optional(string, "data/hierarchical-ingress-rules.yaml")
+        policy_name   = optional(string, "net-default")
+      }), {})
+      policy_rules = optional(string, "data/firewall-policies")
+    }), {})
+    subnets = optional(string, "data/subnets")
   })
-  default = {
-    data_dir = "data"
-  }
+  default  = {}
   nullable = false
-  validation {
-    condition     = var.factories_config.data_dir != null
-    error_message = "Data folder needs to be non-null."
-  }
-  validation {
-    condition     = var.factories_config.firewall_policy_name != null
-    error_message = "Firewall policy name needs to be non-null."
-  }
 }
 
 variable "gcp_ranges" {
diff --git a/fast/stages/2-networking-c-separate-envs/dns-dev.tf b/fast/stages/2-networking-c-separate-envs/dns-dev.tf
index b176af16b3..e29dc861ed 100644
--- a/fast/stages/2-networking-c-separate-envs/dns-dev.tf
+++ b/fast/stages/2-networking-c-separate-envs/dns-dev.tf
@@ -68,7 +68,7 @@ module "dev-dns-policy-googleapis" {
   project_id = module.dev-spoke-project.project_id
   name       = "googleapis"
   factories_config = {
-    rules = var.factories_config.dns_policy_rules_file
+    rules = var.factories_config.dns_policy_rules
   }
   networks = {
     dev = module.dev-spoke-vpc.self_link
diff --git a/fast/stages/2-networking-c-separate-envs/dns-prod.tf b/fast/stages/2-networking-c-separate-envs/dns-prod.tf
index adcc388939..7234c6e260 100644
--- a/fast/stages/2-networking-c-separate-envs/dns-prod.tf
+++ b/fast/stages/2-networking-c-separate-envs/dns-prod.tf
@@ -68,7 +68,7 @@ module "prod-dns-policy-googleapis" {
   project_id = module.prod-spoke-project.project_id
   name       = "googleapis"
   factories_config = {
-    rules = var.factories_config.dns_policy_rules_file
+    rules = var.factories_config.dns_policy_rules
   }
   networks = {
     prod = module.prod-spoke-vpc.self_link
diff --git a/fast/stages/2-networking-c-separate-envs/variables.tf b/fast/stages/2-networking-c-separate-envs/variables.tf
index b03d40010a..86d1ee18c9 100644
--- a/fast/stages/2-networking-c-separate-envs/variables.tf
+++ b/fast/stages/2-networking-c-separate-envs/variables.tf
@@ -58,22 +58,22 @@ variable "essential_contacts" {
 variable "factories_config" {
   description = "Configuration for network resource factories."
   type = object({
-    data_dir              = optional(string, "data")
-    dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml")
-    firewall_policy_name  = optional(string, "net-default")
+    dashboards       = optional(string, "data/dashboards")
+    dns_policy_rules = optional(string, "data/dns-policy-rules.yaml")
+    firewall = optional(object({
+      cidr_file     = optional(string, "data/cidrs.yaml")
+      classic_rules = optional(string, "data/firewall-rules")
+      hierarchical = optional(object({
+        egress_rules  = optional(string, "data/hierarchical-egress-rules.yaml")
+        ingress_rules = optional(string, "data/hierarchical-ingress-rules.yaml")
+        policy_name   = optional(string, "net-default")
+      }), {})
+      policy_rules = optional(string, "data/firewall-policies")
+    }), {})
+    subnets = optional(string, "data/subnets")
   })
-  default = {
-    data_dir = "data"
-  }
+  default  = {}
   nullable = false
-  validation {
-    condition     = var.factories_config.data_dir != null
-    error_message = "Data folder needs to be non-null."
-  }
-  validation {
-    condition     = var.factories_config.firewall_policy_name != null
-    error_message = "Firewall policy name needs to be non-null."
-  }
 }
 
 variable "outputs_location" {