--- title: "Control for Utilities Water | Firevault" url: https://fire-vault.com/control-blueprint/utilities-water description: "Control by Firevault gives Utilities Water teams physical control of every network path into critical systems, so exposure exists only when it is authorised." lang: en-GB --- Industry Blueprint · Water # Keep the water flowing. Control every route in. Water companies depend on suppliers, remote engineering and telemetry to keep treatment works, reservoirs and pumping stations running. Control for Water protects treatment operations, governs remote access and preserves your ability to recover, without touching the process. Discuss your industry Blueprint Explore the Control Plans - Treatment works, reservoirs and remote pumping stations - NIS Regulations, with DWI oversight for drinking water - Five Control Plans, plus Offline Secure Storage® - Treatment, pumping and telemetry never disconnected automatically The industry reality ## Water runs on connections. Most were never designed to close. Treatment works, reservoirs and pumping stations depend on telemetry, specialist suppliers and equipment built to run for decades. That connectivity keeps water flowing. It is also how incidents get in. **Remote, unstaffed sites**Pumping stations and reservoirs report over telemetry, often with nobody on site. **Equipment built to last decades**PLCs and HMIs stay in service long after vendors stop updating them. **Specialist suppliers**Pump, instrument and SCADA suppliers need remote access to keep equipment running. Threats this Blueprint addresses Supply chain risk Ransomware Legacy system risk Insider threat Regulatory risk **0 %** of breaches in Verizon’s 2026 report involved a third party, up from 30% the year before. Verizon 2026 Data Breach Investigations Report (https://www.verizon.com/business/resources/reports/dbir/) **0 hours** to report an incident affecting the essential service under the NIS Regulations, overseen for drinking water by the DWI. Drinking Water Inspectorate, NIS Regulations 2018 (https://www.dwi.gov.uk/the-network-and-information-systems-nis-regulations-2018/) **0 ** nationally significant cyber incidents handled by the NCSC in the year to August 2025, up from 89. NCSC Annual Review 2025 (https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly) ### In each case, the water kept flowing. What stopped was everything around it: automation, billing and customer data. That is the disruption Control for Water is built to limit. _Customer data_ #### South Staffs Water2022 Attackers were inside the network for **nearly two years** before they were found. Drinking water stayed safe, but 633,887 people’s data was published, and the ICO fined the company £945,000 in 2026. Bitdefender, reporting the ICO (https://www.bitdefender.com/en-au/blog/hotforsecurity/uk-water-1-million-hackers-ransomware) _Manual operations_ #### Arkansas City, Kansas2024 After a cyber incident, the water treatment facility **switched to manual operations** as a precaution. The water supply stayed safe. Infosecurity Magazine (https://www.infosecurity-magazine.com/news/incident-arkansas-city-water/) _Customer service_ #### American Water2024 The company disconnected systems, took its customer portal offline and **paused billing**. It said its water and wastewater facilities were not affected. TechTarget (https://www.techtarget.com/cybersecurity/news/366612830/American-Water-discloses-breach-utilities-unaffected) What needs protecting ## Not just systems. The service people rely on. A water operator is not simply worried about ransomware. It has to keep treatment, distribution, telemetry, safety and its regulatory obligations intact. **Treatment and disinfection**The control of treatment processes at each works. **Distribution and pumping**The pumping stations and reservoirs that keep supply moving. **Telemetry and SCADA**The visibility operators rely on to run the network. **PLC programs and configurations**The logic that runs the plant, and the known-good copies to restore it. **Customer and billing data**Including information about customers on the Priority Services Register. **The people who depend on supply**Households, hospitals, schools and businesses. Threats and failure scenarios ## How an incident could actually develop. Four credible scenarios for a water operator, and the Control Plans that address each one. ### Ransomware on corporate IT Starts in corporate IT 1. A laptop opens a malicious attachment. 2. Ransomware spreads across corporate IT. 3. It reaches the industrial DMZ over the always-on IT–OT link. Addressed by CP-04 Physical Segmentation (https://fire-vault.com/control-plan/enforce-physical-segmentation)CP-01 Ransomware Containment (https://fire-vault.com/control-plan/stop-kill-chain-ransomware) ### A compromised supplier session Starts on a supplier’s laptop 1. A supplier’s laptop is compromised. 2. Its standing VPN reaches the access broker. 3. The engineering route leads on to treatment PLCs. Addressed by CP-03 Third-Party Access (https://fire-vault.com/control-plan/control-third-party-access)CP-02 Incident Containment (https://fire-vault.com/control-plan/contain-active-breaches) ### Stolen engineering credentials Starts in the industrial DMZ 1. An engineer’s password is phished. 2. It works on the access broker. 3. PLC programs can be changed remotely. Addressed by CP-03 Third-Party Access (https://fire-vault.com/control-plan/control-third-party-access)CP-05 Critical Infrastructure (https://fire-vault.com/control-plan/protect-critical-infrastructure) ### An unknown route at a remote site Starts at a pumping station 1. A modem was installed for support years ago. 2. It is not on any network drawing. 3. It gives a direct route to a pumping station controller. Addressed by CP-05 Critical Infrastructure (https://fire-vault.com/control-plan/protect-critical-infrastructure) Industry architecture ## Illustrative sector connections. Corporate IT, the industrial DMZ, treatment works, remote sites, operational suppliers and the management network, with Offline Secure Storage® deployed separately. Step through each stage. Illustrative sector connection Stage Without Control: the selected routes remain open. Modules in this Blueprint Unlink: https://fire-vault.com/control-module/unlink Fracture: https://fire-vault.com/control-module/fracture Relay: https://fire-vault.com/control-module/relay Lock: https://fire-vault.com/control-module/lock Execute: https://fire-vault.com/control-module/execute Isolate: https://fire-vault.com/control-module/isolate Shown when the agreed Control response is selected. An illustrative ransomware event starts in a connected system and follows the open routes shown here. This is a connection model, not a prediction of a real attack.**The open connections allow movement in this simplified model. Actual exposure depends on your environment and existing defences.** Selected connection states - Supplier VPN _Always connected_ - Engineering route _Always connected_ - IT–OT link _Always connected_ - Data feed _Always connected_ - Recovery access (OSS) _Disconnected_ 1. _!_**Illustrative threat starts at** · Laptops and email 2. _+_**Modelled movement to** · Billing 3. _+_**Modelled movement to** · Logins 4. _+_**Modelled movement to** · Historian 5. _+_**Modelled movement to** · Access broker, SCADA 6. _+_**Modelled movement to** · Treatment PLCs, Control room, Pumping stations 7. _+_**Modelled movement to** · Engineering PC, Reservoirs This model only shows the selected routes. An interrupted route does not remove an existing compromise or protect unmodelled paths. Your security tools detect the event; the agreed Control design governs the response. Offline Secure Storage® holds copies separately; it is not a Control module. Recommended industry Blueprint ## Our recommended Blueprint for Water. For Water, we recommend controlled supplier access and selected boundaries between corporate IT and operational systems, with treatment, telemetry and safety dependencies assessed separately. Start with these connections Supplier support into engineering systems, and the boundary between corporate IT and operational support. Agree how access works Open the selected support route for an authorised task, with an owner, a defined scope and agreed closing conditions. Plan the response Change only the agreed boundary after assessing the service impact. Treatment control, telemetry and safety links are not assumed disconnectable. Refine this recommendation with water operations, engineering and security leads. Offline Secure Storage® can hold recovery copies separately; it is not a Control module. As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks Operational scenarios ## Safe at every stage. Available throughout. How the Blueprint behaves in normal operation, maintenance, supplier access, incident response and recovery, with safety and availability first. Stage What happens Who decides On record _1_Normal operation **No standing routes** Supplier and engineering routes stay disconnected. The IT–OT link and data feed stay connected, with Firebreak® ready.Unlink Fracture Set in the Blueprint, signed off by operations and your NIS lead. Crossing states, continuously. _2_Maintenance **Planned engineering change** The engineering route opens to the named equipment for an approved change, then is removed.Relay Lock Unlink The operations owner approves. The duty operator confirms the plant is ready. Change, window and session. _3_Supplier access **Booked supplier visit** Two people approve. Relay opens the supplier route to the access broker and the one PLC in the job, Lock limits it to the named engineer, and Unlink removes it afterwards.Relay Lock Unlink The operations owner and the duty operator. Request, both approvals, session and close. _4_Incident response **Confirm, then close** The duty operator confirms the plant is safe. Execute runs the agreed action, Firebreak® closes the routes into treatment and Isolate holds OT apart.Execute Fracture Isolate The incident owner authorises. The IT–OT link can close automatically on a high-confidence alert. The decision, who made it, why, and each cut. _5_Recovery **Check, then reconnect** PLC programs are checked against known-good copies in Offline Secure Storage®, the industrial DMZ is rebuilt, and crossings are reconnected one at a time. The operations owner signs off each reconnection. Every check and reconnection. **Never part of an automatic disconnection:** treatment control loops, disinfection dosing, local control at sites and the telemetry operators rely on. Those dependencies are mapped before any crossing is agreed. ### Why it is safe to rely on **01**Independent zones ### Close the supplier route. Keep the plant running. **What we engineered:** Suppliers, the industrial DMZ, treatment works and remote sites are separate zones. A route between them can be closed without touching the process. **The result:** A misused session goes no further, and the water keeps flowing. Control for OT environments (https://fire-vault.com/control-plan/operational-technology-protection) **02**Out-of-band command path ### Take control independently of the process network. **What we engineered:** An independently governed command path for authorised connection changes. Available methods and operating conditions are agreed for the deployment. **The result:** The authorised operator can manage agreed connection changes without relying solely on the affected process path. Command availability still needs to be verified. Protecting the management plane (https://fire-vault.com/control-plan/privileged-access-control) **03**An evidential record ### Supplier windows, on record. **What we engineered:** Configured window openings, closures and approvals are timestamped and logged locally and, where integrated, to SysLog. **The result:** Evidence for your NIS lead, the regulator and your insurer. Control in a live incident (https://fire-vault.com/control-plan/contain-active-breaches) Resilience and recovery ## Control the route. Protect the baselines. Control for Water decides which routes into OT exist. Offline Secure Storage® is a separate, physically disconnected environment with its own access and recovery arrangements. - Known-good PLC programs and configurations - Recovery images for industrial DMZ and SCADA servers - Evidence retained for your NIS lead and the regulator Explore Offline Secure Storage®: https://fire-vault.com/offline-secure-storage Standards and governance ## What it supports, and what you keep. Control for Water can help support these obligations. It does not make you compliant on its own. #### Aligned to how you are regulated 1. _1_**NIS Regulations 2018**Overseen for drinking water by the DWI, with incident reporting within 72 hours. 2. _2_**NCSC CAF**Objective B, protecting against cyber attack, and objective D, minimising the impact of incidents. 3. _3_**IEC 62443-3-3**SR 5.1 and SR 5.2: zones, conduits and boundary protection. 4. _4_**MITRE ATT&CK for ICS**External remote services and valid accounts used to reach control systems. #### Evidence to retain 1. _1_**Crossing register**Every route into OT, its normal state and its owner. 2. _2_**Approvals**Both approvals for every supplier and engineering window. 3. _3_**Commands and states**Every command and observed state, timestamped and sent to SysLog. 4. _4_**Test results**Island-mode and supplier-window tests, with operations present. 5. _5_**Reconnection**Checks against known-good copies, and sign-off. Technical guide #### Control for Water - The water architecture and its trust zones - The Control Plans, crossings and decision rules - Safety dependencies and what is never touched - Testing, evidence and handover Request the Blueprint (https://fire-vault.com/contact) ### What Control for Water does - **Closes routes into OT**, physically, at Layer 1. - **Leaves the process alone.** Treatment, pumping and telemetry keep running. - **Gives suppliers access on your terms**, for booked jobs only. - **Records configured windows and decisions** for your NIS lead and regulator. ### What it does not do - **Control the process.** It never starts, stops or changes plant. - **Replace OT monitoring.** Your monitoring spots problems, and Control acts on decisions. - **Patch your PLCs.** It reduces their exposure while they keep running. - **Make you compliant on its own.** It can help support your NIS duties. Deployment and proof of concept ## Start with one route. Prove it. Then expand. Most water companies start with supplier access at one site, then extend the same Blueprint across works and remote sites. 1. _1_**Assess** Map every route into OT, including modems and cellular routers at remote sites. 2. _2_**Prioritise** Choose the route that matters most. For most water companies, that is supplier access. 3. _3_**Pilot** Put one crossing under control at one site, with operations involved from the start. 4. _4_**Test** Run island-mode and supplier-window tests against agreed acceptance criteria. 5. _5_**Expand** Extend the same Blueprint to more crossings, works and remote sites. **→**Plan your first route ## Start with the route you would close first. Tick anything that sounds familiar. You’ll see where your discovery session would start, and which modules it would use. Outcomes ## What success looks like, and how it is measured. The Blueprint is judged on results you can test, not on what is installed. **No standing supplier routes**Measured by The crossing register shows supplier and engineering routes disconnected by default. **Every window approved and recorded**Measured by Each window has two approvals, a named engineer and a signed open and close. **The IT–OT link can close while sites run**Measured by An island-mode test with operations present, and service checks throughout. **Recovery checked against known-good copies**Measured by PLC programs compared with the copies in Offline Secure Storage® before access returns. **?**Questions worth asking ## Before you change how suppliers connect. Your operations team will want reassurance. Your NIS lead will want evidence. Here are the practical answers. No. Treatment, pumping, local control loops and the telemetry you rely on are never part of an automatic disconnection. Control for Water only controls the routes into them. They request a window for a named job. Two people approve it: the operations owner signs off the booking and the duty operator confirms the plant is ready. The route then opens for that job only. The duty operator confirms the plant is in a safe state, the incident owner authorises the action, and the route is closed. Sites keep running on local and SCADA control. Yes. Many PLCs and HMIs cannot be patched without stopping the plant. Control reduces their exposure by removing the standing routes to them, so they can keep doing their job. No. Firebreak® decides whether a path exists rather than inspecting what travels on it, and it keeps its control and data layers completely separate. It can help support your duties to manage risk and reduce the impact of incidents, with a record of configured actions. It does not make you compliant on its own. Usually with the supplier route. We agree the booking process and approvers, then test it with your operations team before you rely on it. See all questions: https://fire-vault.com/learn/faq **→**Your next step ## Keep the water flowing. Control the routes in. A working session with your operations team: the routes into OT, the first one to control, and the evidence your NIS lead will ask for. Discuss your industry Blueprint (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a demo: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprint/utilities-water#webpage", "url": "https://fire-vault.com/control-blueprint/utilities-water", "name": "Control for Utilities Water", "description": "Control by Firevault gives Utilities Water teams physical control of every network path into critical systems, so exposure exists only when it is authorised.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprint/utilities-water#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprint/utilities-water#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprint", "item": "https://fire-vault.com/control-blueprint" }, { "@type": "ListItem", "position": 3, "name": "Control for Utilities Water", "item": "https://fire-vault.com/control-blueprint/utilities-water" } ] } ] ```