--- title: "Control Third-Party Access by Firevault - Control Blueprint…" description: "Give third parties access without giving them a permanent doorway." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-03#webpage", "url": "https://fire-vault.com/control-blueprints/cp-03", "name": "Control Third-Party Access by Firevault - Control Blueprint…", "description": "Give third parties access without giving them a permanent doorway.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/fce21b03-fb5e-4021-b3b9-df9a64549452/og-blueprint-cp-03.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-03#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-03#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Control Third-Party Access by Firevault - Control Blueprint…", "item": "https://fire-vault.com/control-blueprints/cp-03" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Control Third-Party Access - Control Blueprint CP-03", "description": "Give third parties access without giving them a permanent doorway.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-03", "about": { "@type": "Thing", "name": "Control Blueprint CP-03" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) FIRE + VAULT · CP-03 # Control Third-Party Access Give third parties access without giving them a permanent doorway. - CP-03 - Path and asset together Discuss this Blueprint [Read the guide](/learn/guides/controlling-third-party-access-control-blueprint) [All Blueprints](/control-blueprints) ![Control Blueprint CP-03, Control Third-Party Access: an isometric diagram of a time-bound access door granting one hour of supplier entry](/__l5e/assets-v1/74e3125a-2c95-47f7-8f5b-266d8dee7c2f/blueprint-cp-03-hero.webp) 01 At a glance ## What this Blueprint does. Time-bounded vendor and supplier access What it does Give third parties access without giving them a permanent doorway. Where it fits Time-bounded vendor and supplier access Who uses it Financial services, Healthcare, Energy, Public sector CP-03 topology ## How CP-03 controls third-party access. A FIRE+VAULT pattern. The vendor path is severed by default and exists only as a validated, time-bound Relay session, with every artefact preserved. Grounded in NIS2 Art. 21(2)(d), DORA Art. 28-30 and ISO 27001 A.5.15, A.5.19. Z0 Vendor or supplier External party Vendor or supplier zone External party seeking a maintenance window ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Request validated. Window opened for the engagement only. Z1 Maintenance edge The only Maintenance edge zone The only place a vendor session ever lands ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute ![FV-Transfer module icon](/assets/transfer-icon-DqGa0PQI.png)Transfer ![FV-Archive module icon](/assets/archive-icon-B3rc85NY.png)Archive Changes scoped, recorded and revocable on signal. Z2 Managed estate The systems Managed estate zone The systems the vendor is allowed to touch OSS Crown jewels · detail callout Session evidence archive Every vendor session, command and artefact preserved offline for audit and dispute. Modules & symbols ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate Integrity check ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay Time-bound path ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named access ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute Approved action ![FV-Transfer module icon](/assets/transfer-icon-DqGa0PQI.png)Transfer Controlled move ![FV-Archive module icon](/assets/archive-icon-B3rc85NY.png)Archive Disconnected copy Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-03 pattern composes. How the primary modules compose 1. [1 ![Validate module icon](/assets/vault-icon-CD3Pv4ri.png) Validate VAULT Checks the request, command or approval before anything proceeds. ](/control/modules/validate) 2. [2 ![Relay module icon](/assets/relay-icon-CVhJDRO7.png) Relay FIRE Opens a temporary, time-bound window for an approved purpose. ](/control/modules/relay) 3. [3 ![Lock module icon](/assets/lock-icon-UU3vOaKE.png) Lock VAULT Holds the asset behind identity, role and policy controls. ](/control/modules/lock) Supporting modules - [![Transfer module icon](/assets/transfer-icon-DqGa0PQI.png) Transfer VAULT Governs what moves between protected environments. ](/control/modules/transfer) - [![Archive module icon](/assets/archive-icon-B3rc85NY.png) Archive VAULT Preserves the records, logs and evidence the control produced. ](/control/modules/archive) - [![Execute module icon](/assets/execute-icon-kJl5Gtmk.png) Execute FIRE Fires the control action the moment a signal demands it. ](/control/modules/execute) 03 How it reads end to end ## The Blueprint in full. Validate checks the request before any door opens. Relay creates a controlled, time-bound access window. Lock ensures only approved users, roles or conditions can use it. Transfer governs what moves between environments, Archive preserves the activity for audit and Execute can revoke the path on signal. 04 Sector relevance ## Where CP-03 applies. Financial services Healthcare Energy Public sector 05 Related Blueprints ## Compose alongside. [See all](/control-blueprints) [ CP-05 FIRE + VAULT ### Protect Critical Infrastructure Keep critical systems available, controlled and disconnected from unnecessary exposure. View Blueprint ](/control-blueprints/cp-05)[ CP-01 FIRE-led ### Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. View Blueprint ](/control-blueprints/cp-01)[ CP-02 FIRE-led ### Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. View Blueprint ](/control-blueprints/cp-02) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Build control around your environment Talk to our team about composing this Blueprint for your estate. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up