--- title: "Contain Active Breaches by Firevault - Control Blueprint CP…" description: "When prevention fails, containment must be physical, immediate and provable." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-02#webpage", "url": "https://fire-vault.com/control-blueprints/cp-02", "name": "Contain Active Breaches by Firevault - Control Blueprint CP…", "description": "When prevention fails, containment must be physical, immediate and provable.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/54ac3d16-ce8e-454f-a400-19637f96605c/og-blueprint-cp-02.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-02#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-02#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Contain Active Breaches by Firevault - Control Blueprint CP…", "item": "https://fire-vault.com/control-blueprints/cp-02" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Contain Active Breaches - Control Blueprint CP-02", "description": "When prevention fails, containment must be physical, immediate and provable.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-02", "about": { "@type": "Thing", "name": "Control Blueprint CP-02" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Co-operative Group 6.5M records ](/learn/breaches)[2026 Harrods Attempted intrusion ](/learn/breaches)[2026 Legal Aid Agency (Ministry of Justice) 2.1M records ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Co-operative Group 6.5M records ](/learn/breaches)[2026 Harrods Attempted intrusion ](/learn/breaches)[2026 Legal Aid Agency (Ministry of Justice) 2.1M records ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) FIRE-led · CP-02 # Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. - CP-02 - Controls the path Discuss this Blueprint [Read the guide](/learn/guides/containing-active-breaches-control-blueprint) [All Blueprints](/control-blueprints) ![Control Blueprint CP-02, Contain Active Breaches: an isometric diagram of a threat enclosed inside a sealed containment ring](/__l5e/assets-v1/5dae729b-ef1b-4644-b793-7b39dc220d8c/blueprint-cp-02-hero.webp) 01 At a glance ## What this Blueprint does. Live incident containment and recovery What it does When prevention fails, containment must be physical, immediate and provable. Where it fits Live incident containment and recovery Who uses it Financial services, Energy, Public sector, Defence CP-02 topology ## How CP-02 contains a live incident. A FIRE-led pattern for live containment. Affected zones are severed at the conduit, recovery zones are reached only through an authorised Execute event. Grounded in NIST CSF RS.MI-1, IEC 62443-3-3 FR 6 and the CISA Incident Response Playbook. Z0 Affected zone Where the Affected zone zone Where the live incident is unfolding ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate Severed on alert. Blast radius bounded. Z1 Unaffected production Operational zones Unaffected production zone Operational zones still running ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock ![FV-Archive module icon](/assets/archive-icon-B3rc85NY.png)Archive Reach into forensic and recovery only as an approved event. Z2 Forensic and recovery zone Where evidence Forensic and recovery zone zone Where evidence is held and recovery is staged OSS Crown jewels · detail callout Sealed evidence and recovery vault Logs, snapshots and golden images sealed offline for the incident response and any later investigation. Modules & symbols ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak Physical sever ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate Zone boundary ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute Approved action ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named access ![FV-Archive module icon](/assets/archive-icon-B3rc85NY.png)Archive Disconnected copy Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-02 pattern composes. How the primary modules compose 1. [1 ![Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png) Firebreak FIRE Physically breaks the connection path so the attack cannot continue. ](/control/modules/firebreak) 2. [2 ![Isolate module icon](/assets/isolate-icon-B9t8fl3o.png) Isolate FIRE Separates the affected environment into a controlled zone. ](/control/modules/isolate) 3. [3 ![Execute module icon](/assets/execute-icon-kJl5Gtmk.png) Execute FIRE Fires the control action the moment a signal demands it. ](/control/modules/execute) Supporting modules - [![Archive module icon](/assets/archive-icon-B3rc85NY.png) Archive VAULT Preserves the records, logs and evidence the control produced. ](/control/modules/archive) - [![Lock module icon](/assets/lock-icon-UU3vOaKE.png) Lock VAULT Holds the asset behind identity, role and policy controls. ](/control/modules/lock) 03 How it reads end to end ## The Blueprint in full. Firebreak disconnects the exposed path. Isolate contains the breach area. Execute allows immediate action during a live incident. Archive preserves logs, evidence and recovery points while Lock protects what remains as recovery begins. 04 Sector relevance ## Where CP-02 applies. Financial services Energy Public sector Defence 05 Related Blueprints ## Compose alongside. [See all](/control-blueprints) [ CP-01 FIRE-led ### Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. View Blueprint ](/control-blueprints/cp-01)[ CP-04 FIRE-led ### Enforce Physical Segmentation Segmentation should not just be logical. It should be physically enforceable. View Blueprint ](/control-blueprints/cp-04)[ CP-07 FIRE-led ### Protect Aviation and Aerospace Networks Block incoming traffic by default. Open the air-lock only for verified, time-bound reach. View Blueprint ](/control-blueprints/cp-07) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Build control around your environment Talk to our team about composing this Blueprint for your estate. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up