Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control BlueprintCP-02

Contain Active Breaches

When a breach is already under way, separate the affected area from the services still running and the evidence needed to investigate.

Blueprint
CP-02
Primary modules
  • Firebreak
  • Isolate
  • Execute
Supporting
  • Archive
  • Lock
Where it fits
Live incident containment and recovery
CP-02 Contain Active Breaches, as drawnIllustration
Zone 0Affected zoneWhere the live incident is unfolding
Boundary 1
  • Firebreak
  • Isolate
Severed
Severed on alert. Blast radius bounded.
Zone 1Unaffected productionOperational zones still running
Boundary 2
  • Execute
  • Lock
  • Archive
Scoped
Reach into forensic and recovery only as an approved event.
Zone 2Forensic and recovery zoneWhere evidence is held and recovery is staged
Held offlineSealed evidence and recovery vaultLogs, snapshots and golden images sealed offline for the incident response and any later investigation.Offline

Out-of-band command pathManagement Ethernet, cellular SMS or an authenticated API, off the production network.

The sequenceStep through how the modules work together, as the Blueprint sets them out.

The pattern

Contain the incident without losing the recovery position.

What it does

CP-02 starts with a live incident, not a hypothetical attack. It defines which exposed links can be disconnected, which production zones must stay separate and how responders reach forensic and recovery systems through an authorised event.

Where it fits

Use it in incident response plans for financial services, energy, public services and defence. The useful starting point is a breach scenario with named affected systems, operational dependencies and a person accountable for restoration.

Zone by zone

How CP-02 contains a live incident.

Keep three decisions distinct: where the incident is unfolding, what can continue operating and where investigation and recovery take place.

  1. Zone 0

    Affected zone

    This is the environment under investigation. Define the links that could extend the incident before deciding what to disconnect.

  2. Boundary 1

    Severed

    Close the identified conduit on the agreed incident signal, limiting the exposed area rather than assuming a whole-site shutdown is necessary.

    • FirebreakPhysical sever. Primary in CP-02
    • IsolateZone boundary. Primary in CP-02
  3. Zone 1

    Unaffected production

    Unaffected production needs a boundary from the incident zone and a clear view of the services it still depends on.

  4. Boundary 2

    Scoped

    Authorise responder access to forensic and recovery systems as a specific event, separate from routine production reach.

    • ExecuteTrigger, act, terminate. Primary in CP-02
    • LockNamed access. Supporting in CP-02
    • ArchivePreserve, freeze, access. Supporting in CP-02
  5. Zone 2

    Forensic and recovery zone

    Stage investigation and recovery here, with named access and a record of the work performed.

  6. Offline

    Sealed evidence and recovery vault

    Preserve selected logs, snapshots and recovery images offline so later investigation does not depend solely on the affected estate.

    Offline Secure Storage®

Bill of modules

Firebreak, Isolate and Execute lead. Archive and Lock support.

Containment modules act on the exposed links. Evidence and access modules keep the response work accountable.

Module Layer In CP-02 Where it sits What it does here
Firebreak Control the path Primary Boundary 1 Disconnects the exposed incident conduit selected in the containment plan.
Isolate Control the path Primary Boundary 1 Separates the breach zone from unaffected production so investigation has a defined scope.
Execute Control the path Primary Boundary 2 Initiates the authorised incident action and governs the event used to reach recovery systems.
Archive Protect the asset Supporting Boundary 2 Preserves response records and collected evidence for the investigation and subsequent review.
Lock Protect the asset Supporting Boundary 2 Restricts the forensic and recovery area to the responders authorised to use it.

Firebreak® is supplied by Firevault within Control for the incident links that require a physical disconnect. The incident plan determines which links are safe and proportionate to close.Explore Firebreak®

All nine modules

Versus the alternatives

Containment needs scope, authority and evidence.

A response platform, a manual cable break and a prepared physical control each contribute differently during a live incident.

Question Detect and respond Manual shutdown CP-02
Incident decision SIEM or SOAR supplies the response decision An operator decides which connection to remove An authorised signal invokes the prepared containment action
Affected area Host and policy controls depend on coverage Staff must identify the correct physical link Isolate separates the incident zone specified in the plan
Responder access Normal administration paths may remain exposed Investigators need an alternative route Execute governs a separate authorised recovery event
Evidence preservation Logs depend on collection and retention settings A cable break alone preserves no records Archive protects collected incident records
Command channel Depends on the response platform integration Requires access to the physical connection The containment command uses the out-of-band channel
Restoration decision Follow the response platform workflow Authorise staff to reconnect the link The incident owner approves the checked boundary state

Questions

Questions for the incident response plan.

CP-01 focuses on the route ransomware needs to reach critical systems. CP-02 starts when an incident is active and separates containment, continuing production and forensic recovery.

Not necessarily. The plan identifies the affected crossing and its dependencies. A narrower action may be appropriate, but operational owners must establish that before the incident.

Yes, through the authorised event defined for the recovery boundary. That access should not reopen an unrestricted path between the affected area and unaffected production.

Relevant logs, snapshots, decision records and recovery images. Archive preserves the records collected; it does not replace the forensic tools that acquire or interpret them.

Human override remains part of the control model. Specify who can pause, override or restore the action and how that decision is recorded.

The incident owner needs an agreed acceptance check covering the affected systems and their dependencies. Reconnection is an authorised recovery decision, not proof that the compromise has been removed.

All questions

Disconnect to Protect®

Make containment a prepared decision.

Bring your incident scenarios and the services that must continue running. We will work through the boundaries and responder access with you.