Firevault, offline secure storage, physically disconnected from the internet
Pricing

Compliance · Framework matrix

Six controls. Eleven frameworks.

Offline Secure Storage® is one architecture that produces evidence for the frameworks you are tested against: ISO 27001, UK GDPR, NIS2, DORA, PCI DSS, NCSC CAF and more.

  • 11 frameworks mapped
  • 6 control families
  • 1 architecture
  • No certification claims made on your behalf

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

How to read this

One architecture, mapped to outcomes.

The frameworks share four questions: who can reach the data, how it is protected at rest, whether you can prove what happened, and whether you can recover.

A mapping, not a certification

This is a mapping, not a certification claim. Confirm current Cyber Essentials Plus status, scope and validity with Firevault. Everything else on this page is alignment, with evidence you can use in your own assessment.

Physically disconnected Offline Secure Storage: server, three drives and a padlock

The matrix

Control by control, framework by framework.

Each control is a physical property of the architecture, not a policy statement.

Control Evidence produced Frameworks
Physical isolationData sits on hardware disconnected between sessions. Session records showing when hardware was connected, by whom and for how long.
  • ISO 27001 A.8
  • UK GDPR Art. 32
  • NIS2
  • CAF B3
Identity-verified accessMFA, and one vault per user. KYC/AML records at provisioning, and per-session authentication events.
  • ISO 27001 A.5
  • PCI DSS 7 and 8
  • SOC 2 CC6
  • CAF B2
Encryption at restData encrypted on dedicated hardware, with key custody stated in writing. Encryption attestation and key custody statements.
  • ISO 27001 A.8.24
  • UK GDPR Art. 32(1)(a)
  • PCI DSS 3
Session loggingEach access window opened, recorded and closed. Time-stamped access logs, exportable for auditors and regulators.
  • SOC 2 CC7
  • DORA
  • FCA resilience
  • CAF C1
Data classificationLive, recovery and retained data separated. A documented classification of what is held offline, and why.
  • ISO 27001 A.5.12
  • NHS DSPT
  • SRA standards
Recoverable copiesGold copies held away from the connected estate. Retrieval tests and recovery timelines per vault.
  • NIS2 continuity
  • DORA recovery
  • NCSC ransomware
  • CAF D1

What the auditor receives

The evidence pack, in plain terms.

The mapping is only useful if it produces artefacts.

Access audit logs

Who opened which vault, when, from where and for how long.

Encryption attestation

Encryption and key custody, stated in writing.

Provisioning records

Identity verification completed before access.

Classification schedule

What is held offline, by data class, and why.

Retrieval tests

Evidence that recovery works, with measured timelines.

Control statements

Auditor-ready wording per framework.

CAF-aligned

Mapped to CAF outcomes, not certified against CAF.

Firevault is not certified against the NCSC Cyber Assessment Framework, a self-assessment framework for essential service operators. Full mapping detail is available on request.

Vault product icon

Offline Secure Storage® and CAF

Objectives B and D

Physically disconnected gold copies support B3 Data Security, B5 Resilient Networks and Systems, and D1 Response and Recovery Planning.

How OSS works

Control Blueprints and CAF

Objectives A and C

Identity-verified access, session logging and separation of operational and archived data support A2 Risk Management, A4 Supply Chain and C1 Security Monitoring.

See Control Blueprints

Firebreak® and CAF

Objective B at the OT boundary

Physical-layer OT/IT separation supports B2 Identity and Access Control, B4 System Security, and B5 Resilient Networks and Systems.

Explore Firebreak®

Send us the frameworks that apply to you.

We will map Offline Secure Storage® to the outcomes your assessor is checking. From £360 a month including VAT. 36-month commitment.