Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control BlueprintCP-03

Control Third-Party Access

A supplier needs to do a job, not inherit a permanent doorway. Make access a named, approved session with a defined end.

Blueprint
CP-03
Primary modules
  • Validate
  • Relay
  • Lock
Supporting
  • Transfer
  • Archive
  • Execute
Where it fits
Time-bounded vendor and supplier access
CP-03 Control Third-Party Access, as drawnIllustration
Zone 0Vendor or supplierExternal party seeking a maintenance window
Boundary 1
  • Validate
  • Relay
  • Lock
Window only
Request validated. Window opened for the engagement only.
Zone 1Maintenance edgeThe only place a vendor session ever lands
Boundary 2
  • Execute
  • Transfer
  • Archive
Scoped
Changes scoped, recorded and revocable on signal.
Zone 2Managed estateThe systems the vendor is allowed to touch
Held offlineSession evidence archiveEvery vendor session, command and artefact preserved offline for audit and dispute.Offline

Out-of-band command pathManagement Ethernet, cellular SMS or an authenticated API, off the production network.

The sequenceStep through how the modules work together, as the Blueprint sets them out.

The pattern

Give suppliers a window, not standing reach.

What it does

CP-03 turns vendor access into an engagement with a purpose, an identity and an expiry. The request is checked before a Relay window opens. Work lands at the maintenance edge, with changes and transfers scoped to the managed systems the supplier is authorised to touch.

Validate checks the request and Lock applies the authorised role. Relay governs the temporary connection; Execute can end the engagement on an agreed signal. Your identity and monitoring tools still assess users and activity. This is control of their reach, not a declaration that a vendor is trustworthy.

Where it fits

For remote support, maintenance and supplier administration in banking, healthcare, energy and public services. Use it where an old support connection could outlive the contract, the task or the person who approved it.

Grounded in

NIS2 Art. 21(2)(d), DORA Art. 28-30 and ISO 27001 A.5.15, A.5.19. Control can help support the controls they describe.

Control for third parties

Zone by zone

How CP-03 controls third-party access.

Follow one maintenance engagement from the outside party to the controlled landing point and the systems it may change.

  1. Zone 0

    Vendor or supplier

    The external supplier requests a defined maintenance task, with a named person, target and proposed duration.

  2. Boundary 1

    Window only

    Validate checks purpose and authority; Relay opens only the approved session rather than leaving the supplier route standing.

    • ValidateIntegrity check. Primary in CP-03
    • RelayTime-bound path. Primary in CP-03
    • LockNamed access. Primary in CP-03
  3. Zone 1

    Maintenance edge

    The maintenance edge is the controlled landing point. It is not unrestricted admission to the wider estate.

  4. Boundary 2

    Scoped

    Scope changes and transfers to the approved systems, record the engagement and end reach when the work or authority ends.

    • ExecuteTrigger, act, terminate. Supporting in CP-03
    • TransferControlled move. Supporting in CP-03
    • ArchivePreserve, freeze, access. Supporting in CP-03
  5. Zone 2

    Managed estate

    These are the assets named in the engagement, not every service visible from the supplier account.

  6. Offline

    Session evidence archive

    Preserve session records and approved artefacts for later audit, supplier review or a dispute over a change.

    Offline Secure Storage®

Bill of modules

Validate, Relay and Lock lead. Transfer, Archive and Execute support.

The primary modules govern admission and duration. Supporting modules address transfers, the engagement record and termination.

Module Layer In CP-03 Where it sits What it does here
Validate Protect the asset Primary Boundary 1 Checks the supplier request, maintenance purpose and approving authority before the session proceeds.
Relay Control the path Primary Boundary 1 Makes the vendor connection available for the approved engagement and removes standing access afterwards.
Lock Protect the asset Primary Boundary 1 Binds the maintenance session to the permitted identity, role and conditions.
Transfer Protect the asset Supporting Boundary 2 Governs the updates, files or other artefacts allowed to cross into the managed estate.
Archive Protect the asset Supporting Boundary 2 Preserves the supplier engagement record and retained artefacts for review.
Execute Control the path Supporting Boundary 2 Ends or changes the session when the agreed signal requires the access to stop.

All nine modules

Versus the alternatives

A valid account does not justify a permanent connection.

Compare the maintenance engagement, rather than assuming that detection or physical cabling alone provides supplier governance.

Question Detect and respond Manual shutdown CP-03
Admission Identity and monitoring tools assess the account Staff connect the supplier route Validate checks the request and authority
Duration A standing connection needs separate expiry controls Staff must disconnect after the job Relay defines the approved engagement window
Permitted work Software policy scopes the user or host The connected cable does not define the task Lock and Transfer constrain access and material
Early termination The response platform can revoke software access Staff remove the connection Execute applies the agreed end-session action
Supplier record Retention depends on the session tooling Manual actions need a separate record Archive retains the engagement evidence
Physical closure Software access controls govern a live path The selected cable can be disconnected Add Firebreak where the design calls for a physical cut

Questions

Before you open a supplier session.

The account identifies a user; the window also defines when the connection exists and why it is needed. CP-03 adds request validation, scoped reach and a defined end to the engagement.

The named operator, intended task, target systems, required artefacts and duration. Your authorised owner checks those details before the maintenance path opens.

Only the reach approved in the design should be provided. Map the onward connections so the landing point does not quietly become a doorway to unrelated services.

Transfer governs the material permitted across the boundary. The organisation still needs its own checks for the provenance, safety and suitability of an update.

The agreed signal can end the session through Execute. Define the escalation, evidence retention and human authority alongside the ordinary expiry process.

No single pattern proves compliance. CP-03 can support access and supplier controls referenced in NIS2, DORA and ISO 27001, but obligations and evidence must be assessed for the organisation.

All questions

Disconnect to Protect®

Close the doorway after the job.

Tell us how suppliers reach your systems today. We will discuss a scoped engagement with clear approval, expiry and evidence.