--- title: "Stop Kill-Chain Ransomware by Firevault - Control Blueprint…" description: "Stop ransomware moving, spreading or reaching the crown jewels." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-01#webpage", "url": "https://fire-vault.com/control-blueprints/cp-01", "name": "Stop Kill-Chain Ransomware by Firevault - Control Blueprint…", "description": "Stop ransomware moving, spreading or reaching the crown jewels.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/f03f4aaa-5a3b-417e-8ce7-367b76832037/og-blueprint-cp-01.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-01#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-01#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Stop Kill-Chain Ransomware by Firevault - Control Blueprint…", "item": "https://fire-vault.com/control-blueprints/cp-01" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Stop Kill-Chain Ransomware - Control Blueprint CP-01", "description": "Stop ransomware moving, spreading or reaching the crown jewels.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-01", "about": { "@type": "Thing", "name": "Control Blueprint CP-01" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) FIRE-led · CP-01 # Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. - CP-01 - Controls the path Discuss this Blueprint [Read the guide](/learn/guides/stopping-kill-chain-ransomware-control-blueprint) [All Blueprints](/control-blueprints) ![Control Blueprint CP-01, Stop Kill-Chain Ransomware: an isometric diagram of an attack path severed before it reaches protected data](/__l5e/assets-v1/ab81da21-fd7a-4035-8659-2649a317cc07/blueprint-cp-01-hero.webp) 01 At a glance ## What this Blueprint does. Lateral movement prevention across IT and OT What it does Stop ransomware moving, spreading or reaching the crown jewels. Where it fits Lateral movement prevention across IT and OT Who uses it Financial services, Healthcare, Public sector, Defence CP-01 topology ## How CP-01 stops the kill chain. A FIRE-led pattern. The path between any compromised zone and the crown jewels is severed by default, opened only as a named event, and severed again on alert. Grounded in MITRE ATT&CK TA0008, IEC 62443-3-3 SR 5.1 and NCSC ransomware guidance. Z0 User and endpoint zone Where the User and endpoint zone zone Where the foothold typically lands ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named, scoped reach into core services Z1 Core IT services Identity, file, Core IT services zone Identity, file, mail, collaboration ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink Severed by default. Restored only as an approved Execute event. Z2 Crown-jewel systems Database, ERP, Crown-jewel systems zone Database, ERP, core record systems OSS Crown jewels · detail callout Offline recovery vault Tamper-evident copies, not reachable on the live network. The ransomware cannot touch them. Modules & symbols ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate Zone boundary ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named access ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak Physical sever ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute Approved action ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink Remove trust Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-01 pattern composes. How the primary modules compose 1. [1 ![Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png) Firebreak FIRE Physically breaks the connection path so the attack cannot continue. ](/control/modules/firebreak) 2. [2 ![Isolate module icon](/assets/isolate-icon-B9t8fl3o.png) Isolate FIRE Separates the affected environment into a controlled zone. ](/control/modules/isolate) 3. [3 ![Execute module icon](/assets/execute-icon-kJl5Gtmk.png) Execute FIRE Fires the control action the moment a signal demands it. ](/control/modules/execute) Supporting modules - [![Unlink module icon](/assets/unlink-icon-B8GFAVW1.png) Unlink VAULT Removes the persistent dependencies that quietly bypass the control. ](/control/modules/unlink) - [![Lock module icon](/assets/lock-icon-UU3vOaKE.png) Lock VAULT Holds the asset behind identity, role and policy controls. ](/control/modules/lock) 03 How it reads end to end ## The Blueprint in full. Firebreak physically breaks the connection path. Isolate separates the affected environment. Execute triggers the control action the moment risk is detected. Unlink removes the persistent dependencies and Lock holds the crown jewels behind identity controls that ransomware cannot reach. 04 Sector relevance ## Where CP-01 applies. Financial services Healthcare Public sector Defence 05 Related Blueprints ## Compose alongside. [See all](/control-blueprints) [ CP-02 FIRE-led ### Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. View Blueprint ](/control-blueprints/cp-02)[ CP-04 FIRE-led ### Enforce Physical Segmentation Segmentation should not just be logical. It should be physically enforceable. View Blueprint ](/control-blueprints/cp-04)[ CP-07 FIRE-led ### Protect Aviation and Aerospace Networks Block incoming traffic by default. Open the air-lock only for verified, time-bound reach. View Blueprint ](/control-blueprints/cp-07) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Build control around your environment Talk to our team about composing this Blueprint for your estate. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up