Contain Active Breaches
When prevention fails, containment must be physical, immediate and provable.
- CP-02
- Controls the path
What this Blueprint does.
Live incident containment and recovery
When prevention fails, containment must be physical, immediate and provable.
Live incident containment and recovery
Financial services, Energy, Public sector, Defence
How CP-02 contains a live incident.
A FIRE-led pattern for live containment. Affected zones are severed at the conduit, recovery zones are reached only through an authorised Execute event.
Grounded in NIST CSF RS.MI-1, IEC 62443-3-3 FR 6 and the CISA Incident Response Playbook.
Affected zone
Where the
Where the live incident is unfolding
Firebreak
IsolateSevered on alert. Blast radius bounded.
Unaffected production
Operational zones
Operational zones still running
Execute
Lock
ArchiveReach into forensic and recovery only as an approved event.
Forensic and recovery zone
Where evidence
Where evidence is held and recovery is staged
Crown jewels · detail callout
Sealed evidence and recovery vault
Logs, snapshots and golden images sealed offline for the incident response and any later investigation.
Modules & symbols
FirebreakPhysical severIsolateZone boundaryExecuteApproved actionLockNamed accessArchiveDisconnected copyHow the CP-02 pattern composes.
The Blueprint in full.
Firebreak disconnects the exposed path. Isolate contains the breach area. Execute allows immediate action during a live incident. Archive preserves logs, evidence and recovery points while Lock protects what remains as recovery begins.
Where CP-02 applies.
Build control around your environment
Talk to our team about composing this Blueprint for your estate.
Takes about 2 minutes. No account needed.