Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control BlueprintCP-04

Enforce Physical Segmentation

When two environments have different trust levels, their separation should not depend only on the settings of a live network.

Blueprint
CP-04
Primary modules
  • Firebreak
  • Isolate
  • Unlink
Supporting
  • Lock
  • Relay
Where it fits
Trust boundary enforcement between zones
CP-04 Enforce Physical Segmentation, as drawnIllustration
Zone 0Zone AFirst trust domain. For example IT enterprise
Boundary 1
  • Firebreak
  • Isolate
  • Unlink
Severed
Default-severed boundary with no inherited trust.
Zone 1Zone BSecond trust domain. For example OT supervisory
Boundary 2
  • Firebreak
  • Lock
  • Relay
Window only
Crossing exists only as a named, time-bound Relay session.
Zone 2Zone CThird trust domain. For example field or process
Held offlineAuthoritative configuration vaultZone and conduit definitions held offline, away from the admin tier that could otherwise re-draw them.Offline

Out-of-band command pathManagement Ethernet, cellular SMS or an authenticated API, off the production network.

The sequenceStep through how the modules work together, as the Blueprint sets them out.

The pattern

Make the trust boundary a physical decision.

What it does

CP-04 separates trust domains and removes the standing dependencies that can tunnel between them. A crossing is not inherited because two systems share an administrator or a convenient network route. It exists only for a named purpose and an authorised window.

A firewall rule does not reveal every inherited relationship. Before deployment, identify the services, identities and support routes each zone relies on. Firebreak and Isolate enforce the selected boundaries; Unlink addresses the dependencies that would otherwise bypass the intended separation.

Where it fits

Use it between enterprise IT, supervisory systems and field or process environments, or wherever different teams own different levels of trust. Defence, critical infrastructure and manufacturing need boundaries that reflect operational responsibility as well as logical policy.

Who uses it
Grounded in

IEC 62443-3-3 SR 5.1 to SR 5.3 and the Purdue Enterprise Reference Architecture. Control can help support the controls they describe.

Control for critical systemsRead the CP-04 guide

Zone by zone

How CP-04 enforces physical segmentation.

Read the three trust domains as separate responsibilities. Each crossing needs its own purpose, owner and allowed duration.

  1. Zone 0

    Zone A

    The first trust domain may be enterprise IT. Its business services do not automatically have authority over the next environment.

  2. Boundary 1

    Severed

    Keep this crossing physically disconnected by default and remove inherited dependencies that could undermine the separation.

    • FirebreakPhysical sever. Primary in CP-04
    • IsolateZone boundary. Primary in CP-04
    • UnlinkRemove trust. Primary in CP-04
  3. Zone 1

    Zone B

    The second domain may be supervisory OT, with a different owner and different consequences of change.

  4. Boundary 2

    Window only

    A required crossing is an approved Relay window, governed by identity and purpose rather than permanent mutual trust.

    • FirebreakPhysical sever. Primary in CP-04
    • LockNamed access. Supporting in CP-04
    • RelayTime-bound path. Supporting in CP-04
  5. Zone 2

    Zone C

    The field or process domain needs a boundary aligned to the equipment and operational tasks it supports.

  6. Offline

    Authoritative configuration vault

    Keep authoritative zone and conduit definitions separately offline, so a compromised administration tier is not the sole source of the approved configuration.

    Offline Secure Storage®

Bill of modules

Firebreak, Isolate and Unlink lead. Lock and Relay support.

Firebreak and Isolate establish physical boundaries. Unlink tackles persistent relationships; Lock and Relay govern permitted exceptions.

Module Layer In CP-04 Where it sits What it does here
Firebreak Control the path Primary Boundary 1 and Boundary 2 Disconnects the defined crossings between trust domains, making the boundary more than a logical network rule.
Isolate Control the path Primary Boundary 1 Separates the environments that have different owners, risks and permitted uses.
Unlink Protect the asset Primary Boundary 1 Removes standing connections and inherited dependencies that could circumvent the agreed segmentation.
Lock Protect the asset Supporting Boundary 2 Checks the identity and authority used for an exception at the second boundary.
Relay Control the path Supporting Boundary 2 Provides a time-bound crossing for a named operational task rather than restoring permanent trust.

Firebreak® is supplied by Firevault within Control at the crossings that require physical separation. The segmentation design must also account for other routes and operational dependencies.Explore Firebreak®

All nine modules

Versus the alternatives

A zone on a diagram needs an enforceable crossing.

Logical controls remain useful. CP-04 adds a physical decision at selected boundaries instead of claiming that software segmentation has no value.

Question Detect and respond Manual shutdown CP-04
Zone definition VLANs and firewall rules express logical separation Staff identify cables between environments Isolate reflects the agreed trust domains
Default crossing A network path remains governed by policy The selected cable is physically absent Firebreak keeps the selected crossing disconnected
Hidden relationships Dependencies need discovery beyond the rule set Other links can remain after one cable is removed Unlink addresses identified persistent dependencies
Temporary exception A policy change permits access Staff reconnect for the task Lock and Relay govern a named crossing window
Configuration authority Depends on administration and change controls Cable state alone is not a zone definition Approved zone definitions can be held separately offline
Operational review Rules need dependency and service testing Cable removal also needs impact assessment Validate boundary changes with the operational owners

Questions

Questions about separating trust domains.

No. Those controls still manage traffic and logical policy. CP-04 adds hardware-enforced separation at the crossings chosen for physical control.

A standing support route or inherited trust relationship can defeat the intended separation. Unlink addresses those dependencies so the zone boundary matches the real access model.

Yes, through a named, approved crossing. Relay governs the temporary window and Lock checks the authority that is allowed to use it.

Use differences in trust, ownership, operational function and the consequences of compromise. Then map required crossings and dependencies with the people responsible for each environment.

That must be established for the specific process. Safety-critical dependencies require operational review and validation before any automatic action is authorised.

Maintain an authoritative copy separately from the live administration tier. The sheet includes an offline configuration position so recovery does not rely only on settings from a compromised environment.

All questions

Disconnect to Protect®

Turn the trust boundary into a controlled crossing.

Bring the zones you need to separate and the dependencies between them. We will discuss the physical boundaries and permitted exceptions.