---
title: "BP-10 Data Centres | Control by Firevault"
url: https://fire-vault.com/control-blueprint/colocations
description: "Colocation facilities share power, cooling, fibre and management infrastructure across tenants. Control may govern selected network paths and cross-connect…"
lang: en-GB
---

BP-10 · Industry Blueprint · Data Centres

# Data centres depend on connections. Not all need to stay open.

Image: BP-10 Data Centres Control Blueprint icon (https://fire-vault.com/__l5e/assets-v1/16cbf091-56b4-44ac-8dbd-dad963cfdc9a/BP-10_data-centres.png)

Colocation facilities share power, cooling, fibre and management infrastructure across tenants. Control may govern selected network paths and cross-connect processes, with facility and tenant obligations reviewed together.

Book a briefing: https://fire-vault.com/demo
Explore the Control Plans

- A support supplier needs a facility-management session without gaining access to unrelated tenant environments. Review the named support and cross-zone boundaries; operationally required links are not assumed disconnectable.
- Reference design for adaptation with the service owner, not a validated deployment. Confirm complete boundary coverage, operational dependencies and the consequences of opening or closing each selected path.
- 3 matching Control Plans. Offline Secure Storage® is separate.
- Control does not replace operational safety systems, network security controls, incident response, supplier governance or service continuity planning. Changing connectivity does not establish a safe process state, stop local execution or guarantee service restoration.

The industry reality

## Data Centres: the connections your operation relies on.

Data centres and colocation operations depend on connected systems, specialist suppliers and site infrastructure. A path that is convenient during planned work may also remain available outside that purpose.

**Operational interruption**A disrupted data centres and colocation connection may affect services beyond the intended maintenance or response scope.

**Safety dependencies**Connections supporting safe operation of data centres and colocation assets require careful dependency review before any intervention.

**Persistent third-party paths**An always-available supplier route can extend access beyond the approved task or maintenance window.

**Unclear connection state**Logical policy and tickets alone may not show which selected paths were available at a particular point.

What needs protecting

## The service, systems and people behind the connections.

A support supplier needs a facility-management session without gaining access to unrelated tenant environments. Review the named support and cross-zone boundaries; operationally required links are not assumed disconnectable.

**Tenant boundaries**Shared facilities need clear demarcation between tenant networks and facility management systems.

**Cross-connect lifecycle**An approved cross-connect may outlive its original business need unless removal and review are explicit.

**Facility continuity**Power, cooling and environmental systems support site availability and are not assumed disconnectable.

Threats and failure scenarios

## Situations to plan for, before the next incident.

A support supplier needs a facility-management session without gaining access to unrelated tenant environments. Control acts on selected physical connections, not every connection in the environment.

**Scoped support for Data Centres**A support supplier needs a facility-management session without gaining access to unrelated tenant environments. The owner authorises the selected route and its closing conditions.

**Review an affected boundary**Review a tenant or shared-management boundary against contracted services, redundant cross-connects and the agreed interruption authority.

**CP-12: agree the connection and authority**Review a tenant or shared-management boundary against contracted services, redundant cross-connects and the agreed interruption authority. Use CP-12 only where its scope and approval requirements fit this connection.

Industry architecture

## Illustrative sector connections.

Illustrative sector connection

Stage

Without Control: the selected routes remain open.

Modules in this Blueprint

Validate: https://fire-vault.com/control-module/validate
Relay: https://fire-vault.com/control-module/relay
Lock: https://fire-vault.com/control-module/lock
Execute: https://fire-vault.com/control-module/execute
Fracture: https://fire-vault.com/control-module/fracture
Isolate: https://fire-vault.com/control-module/isolate
Unlink: https://fire-vault.com/control-module/unlink
Anchor: https://fire-vault.com/control-module/anchor

Shown when the agreed Control response is selected.

An illustrative ransomware event starts in a connected system and follows the open routes shown here. This is a connection model, not a prediction of a real attack.**The open connections allow movement in this simplified model. Actual exposure depends on your environment and existing defences.**

Selected connection states

- Supplier support to facility administration _Always connected_
- Tenant management to shared-services boundary _Always connected_
- Tenant production to required cross-connect _Always connected_
- Remote administration to management network _Always connected_
- Recovery access (OSS) _Disconnected_
1. _!_**Illustrative threat starts at** · Corporate IT
2. _+_**Modelled movement to** · Supplier access, Identity
3. _+_**Modelled movement to** · Approved access, Tenant networks
4. _+_**Modelled movement to** · Supporting service, Cage and service links, Facility OT
5. _+_**Modelled movement to** · Protected service, Cross-connects

This model only shows the selected routes. An interrupted route does not remove an existing compromise or protect unmodelled paths. Your security tools detect the event; the agreed Control design governs the response. Offline Secure Storage® holds copies separately; it is not a Control module.

Recommended industry Blueprint

## Our recommended Blueprint for Data Centres.

Start with these connections

Supplier support to facility administration; Tenant management to shared-services boundary

Agree how access works

Open only for the authorised support task; close under agreed completion conditions

Plan the response

Change only the selected boundary after the service owner approves the impact

Refine this recommendation with tenant service owners, data-centre operations and security leads. Offline Secure Storage® can hold recovery copies separately; it is not a Control module.

As featured in

- Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough
- Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html
- Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/
- Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/
- Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks

Operational scenarios

## Who decides, what changes, and what is checked.

Agree responsibility and service dependencies before relying on a controlled connection.

1. **Normal operation**
   Colocation facilities share power, cooling, fibre and management infrastructure across tenants. Control may govern selected network paths and cross-connect processes, with facility and tenant obligations reviewed together.
2. **Approved work**
   A support supplier needs a facility-management session without gaining access to unrelated tenant environments. The owner authorises the selected route and its closing conditions.
3. **Incident response**
   A support supplier needs a facility-management session without gaining access to unrelated tenant environments. Control acts on selected physical connections, not every connection in the environment.
4. **Reconnection**
   The owner reviews service dependencies and security checks, authorises reconnection and verifies the observed result. Evidence is retained only through the specified supporting systems.

Control does not replace operational safety systems, network security controls, incident response, supplier governance or service continuity planning. Changing connectivity does not establish a safe process state, stop local execution or guarantee service restoration.

Resilience and recovery

## Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Offline Secure Storage (OSS) is separate from Control. If selected, it can hold retained copies of configurations, records or recovery material. Collection, completeness and recovery readiness depend on the supporting tools, retention design and tested recovery procedures.

Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage)

Standards and governance

## Support your obligations. Keep the boundaries clear.

Alignment may be assessed against ISO/IEC 27001 and applicable data-centre contractual and regulatory requirements; this Blueprint does not imply certification or a compliance outcome. Any assessment needs deployment-specific scope and evidence; this Blueprint provides no certification, complete audit trail or guaranteed response time.

**What this addresses**A support supplier needs a facility-management session without gaining access to unrelated tenant environments. Control acts on selected physical connections, not every connection in the environment.

**What it does not replace**Control does not replace operational safety systems, network security controls, incident response, supplier governance or service continuity planning. Changing connectivity does not establish a safe process state, stop local execution or guarantee service restoration.

**Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Detection and the decision to act belong to the operational owner and supporting security systems. Identity, approval workflow, session expiry and evidence collection require specified integrations. Execute initiates an approved action; Fracture physically disconnects the selected path through Firebreak hardware. Confirm the observed connection state separately. Anchor keeps critical assets within defined physical connection boundaries; it does not collect or retain records. Transfer governs a designated exchange path, not content inspection or de-identification.

Deployment and proof of concept

## Start with one boundary. Test it. Then expand.

Review the first selected connection with tenant service owners, data-centre operations and security leads, agree who can authorise a change and test the service impact.

1. **Map the complete boundary**
   Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
2. **Agree an independent command route**
   Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
3. **Test the effect, not just the command**
   Verify the observed link state, service dependencies and failure behaviour in an agreed test window.

Plan your first route

## Start with the route you would close first.

Outcomes

## What changes, and how you will verify it.

Judge the Blueprint on agreed, observed outcomes.

**Supplier support to facility administration**Open only for the authorised support task; close under agreed completion conditions. Agree identity checks, approval, session closure and observed-state checks

**Tenant management to shared-services boundary**Change only the selected boundary after the service owner approves the impact. Map alternate routes and preserve services outside the selected scope

**Tenant production to required cross-connect**Not assumed disconnectable. Safety and continuity owners must assess this dependency separately

Questions worth asking

## Before you rely on BP-10.

Practical questions for the people who own these connections.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Your next step

## Take the next step with data centres.

Book a briefing (https://fire-vault.com/demo)

Prefer to talk first? Speak to the team: https://fire-vault.com/contact

Book a briefing: https://fire-vault.com/demo
Speak to the team: https://fire-vault.com/contact

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://fire-vault.com/#organization",
    "name": "Firevault",
    "legalName": "Firevault Limited",
    "url": "https://fire-vault.com",
    "logo": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/logo.png",
      "width": 200,
      "height": 60
    },
    "foundingDate": "2025-03",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "address": {
      "@type": "PostalAddress",
      "addressCountry": "GB",
      "addressLocality": "United Kingdom"
    },
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "customer service",
        "email": "hello@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "email": "sales@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      }
    ],
    "founder": [
      {
        "@type": "Person",
        "name": "Mark Fermor",
        "jobTitle": "Founder, CTO and CMO"
      },
      {
        "@type": "Person",
        "name": "David Bailey",
        "jobTitle": "Founder and CEO"
      }
    ],
    "areaServed": [
      "United Kingdom",
      "Europe",
      "United States",
      "Middle East"
    ],
    "sameAs": [
      "https://www.linkedin.com/company/firevault",
      "https://x.com/firevaultuk"
    ],
    "slogan": "Disconnect to Protect",
    "brand": [
      {
        "@type": "Brand",
        "name": "Offline Secure Storage"
      },
      {
        "@type": "Brand",
        "name": "Control by Firevault"
      },
      {
        "@type": "Brand",
        "name": "Firebreak"
      }
    ],
    "knowsAbout": [
      "Offline Secure Storage",
      "Physically disconnected data storage",
      "Physical Air Gap Data Protection",
      "Ransomware Protection",
      "Ransomware recovery",
      "3-2-1-1-0 backup rule",
      "AI kill switch",
      "Operational technology security",
      "Critical national infrastructure resilience",
      "Data Sovereignty",
      "GDPR Compliance",
      "NIS2 Compliance",
      "DORA Compliance",
      "NCSC Cyber Assessment Framework"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://fire-vault.com/#website",
    "name": "Firevault",
    "alternateName": [
      "Firevault",
      "Firevault UK",
      "Firevault Limited"
    ],
    "url": "https://fire-vault.com",
    "publisher": {
      "@id": "https://fire-vault.com/#organization"
    },
    "inLanguage": "en-GB",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}"
      },
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "@id": "https://fire-vault.com/control-blueprint/colocations#webpage",
    "url": "https://fire-vault.com/control-blueprint/colocations",
    "name": "BP-10 Data Centres",
    "description": "Colocation facilities share power, cooling, fibre and management infrastructure across tenants. Control may govern selected network paths and cross-connect…",
    "isPartOf": {
      "@id": "https://fire-vault.com/#website"
    },
    "about": {
      "@id": "https://fire-vault.com/#organization"
    },
    "primaryImageOfPage": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/images/og/og-base-platform.jpg"
    },
    "inLanguage": "en-GB",
    "breadcrumb": {
      "@id": "https://fire-vault.com/control-blueprint/colocations#breadcrumb"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "@id": "https://fire-vault.com/control-blueprint/colocations#breadcrumb",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://fire-vault.com"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Control Blueprint",
        "item": "https://fire-vault.com/control-blueprint"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "BP-10 Data Centres",
        "item": "https://fire-vault.com/control-blueprint/colocations"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "name": "BP-10 Data Centres",
    "description": "Colocation facilities share power, cooling, fibre and management infrastructure across tenants. Control may govern selected network paths and cross-connect processes, with facility and tenant obligations reviewed together.",
    "url": "https://fire-vault.com/control-blueprint/colocations"
  }
]
```