Control Blueprints by industry

Your estate is different. The path discipline is not.

Each sector has its own regulator and its own estate layout. Pick yours to see its Blueprint: the zones, the modules, the frameworks and the evidence.

Thirteen estates, thirteen Blueprints.

Each card opens a full Blueprint for the sector: the estate, the modules, the regulatory anchors and the operator workflows.

• Control BlueprintUtilities

  Policy-enforced paths across generation, distribution and metering.

  • NCSC CAF
  • NIS2
  Open the utilities Blueprint
• Control BlueprintWater

  OT segmentation and evidence trails for treatment and distribution.

  • NCSC CAF
  • DWI
  Open the water Blueprint
• Control BlueprintEnergy

  Grid, generation and market systems separated by governed paths.

  • NIS2
  • IEC 62443
  Open the energy Blueprint
• Control BlueprintOil and gas

  Upstream, midstream and downstream held under module policy.

  • IEC 62443
  Open the oil and gas Blueprint
• Control BlueprintTelecoms

  Signalling, subscriber and support estates protected at the management plane.

  • TSA
  • NIS2
  Open the telecoms Blueprint
• Control BlueprintColocations and data centres

  Tenant isolation, cross-connect governance and shared-fabric protection.

  • ISO 27001
  • NIS2
  Open the colocations and data centres Blueprint
• Control BlueprintDefence

  Programme data and mission systems governed by physical path control.

  • DEFSTAN
  • JSP 440
  Open the defence Blueprint
• Control BlueprintPublic sector

  Central and local government estates segmented for resilience and audit.

  • NCSC CAF
  • GovAssure
  Open the public sector Blueprint
• Control BlueprintBanking

  Payments, ledgers and admin planes governed by policy rather than trust.

  • DORA
  • FCA
  Open the banking Blueprint
• Control BlueprintHealthcare

  Clinical, imaging and admin estates held apart by enforced paths.

  • DSPT
  • NIS2
  Open the healthcare Blueprint
• Control BlueprintRetail

  Point-of-sale, loyalty and supplier estates separated to contain lateral movement.

  • PCI DSS
  Open the retail Blueprint
• Control BlueprintConstruction

  Project data, design files and site systems governed across joint ventures.

  • ISO 27001
  Open the construction Blueprint
• Control BlueprintEducation

  Research data, safeguarding evidence and admin estates on separate paths.

  • DfE
  • Cyber Essentials
  Open the education Blueprint

What every Blueprint shares

Four disciplines,
applied to different estates.

The systems vary by sector. The way paths are governed stays the same.

• 

  Segment

  Splits estates into zones so one compromise cannot spread.

• 

  Enforce

  Opens each privileged path by policy, time-limits it and closes it automatically.

• 

  Verify

  Checks identity at the path rather than trusting network location.

• 

  Evidence

  Produces an audit trail for each session that regulators and insurers can review.

13

Regulated sectors mapped to Control Blueprints

Layer 1

Governance enforced in hardware

36 months

Commitment behind every deployment

Prefer to start somewhere else?

You can also start from the modules, or the hardware that enforces the paths.

Control modulesThe modules that make up a deployed Control fabric.See the modulesFirebreak® hardwareThe hardware range that enforces paths in the field. Manufactured by Firevault.See the rangeAll BlueprintsEvery deployment pattern, CP-01 onwards, with the outcome each one delivers.Compare the Blueprints

Data protection & storage

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Where protected copies are required, agree the OSS storage scope separately. OSS is not automatically included in this Plan or Blueprint. Recovery copies still need validation and tested restoration procedures; storing evidence does not itself establish compliance.