--- title: "Enforce Physical Segmentation by Firevault - Control Bluepr…" description: "Segmentation should not just be logical. It should be physically enforceable." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-04#webpage", "url": "https://fire-vault.com/control-blueprints/cp-04", "name": "Enforce Physical Segmentation by Firevault - Control Bluepr…", "description": "Segmentation should not just be logical. It should be physically enforceable.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/e7bae73d-cf05-42fe-8b6d-f2a095e51d38/og-blueprint-cp-04.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-04#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-04#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Enforce Physical Segmentation by Firevault - Control Bluepr…", "item": "https://fire-vault.com/control-blueprints/cp-04" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Enforce Physical Segmentation - Control Blueprint CP-04", "description": "Segmentation should not just be logical. It should be physically enforceable.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-04", "about": { "@type": "Thing", "name": "Control Blueprint CP-04" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) FIRE-led · CP-04 # Enforce Physical Segmentation Segmentation should not just be logical. It should be physically enforceable. - CP-04 - Controls the path Discuss this Blueprint [Read the guide](/learn/guides/enforcing-physical-segmentation-control-blueprint) [All Blueprints](/control-blueprints) ![Control Blueprint CP-04, Enforce Physical Segmentation: an isometric diagram of two environments divided by a physically enforced wall](/__l5e/assets-v1/4b36508e-42df-4d29-8d03-a62998e43604/blueprint-cp-04-hero.webp) 01 At a glance ## What this Blueprint does. Trust boundary enforcement between zones What it does Segmentation should not just be logical. It should be physically enforceable. Where it fits Trust boundary enforcement between zones Who uses it Defence, Critical infrastructure, Public sector, Manufacturing CP-04 topology ## How CP-04 enforces physical segmentation. A FIRE-led pattern. Zones are physically separated; always-on dependencies between them are removed; any temporary crossing is a named, time-bound event. Grounded in IEC 62443-3-3 SR 5.1 to SR 5.3 and the Purdue Enterprise Reference Architecture. Z0 Zone A First trust Zone A zone First trust domain (for example, IT enterprise) ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink Default-severed boundary with no inherited trust. Z1 Zone B Second trust Zone B zone Second trust domain (for example, OT supervisory) ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay Crossing exists only as a named, time-bound Relay session. Z2 Zone C Third trust Zone C zone Third trust domain (for example, field or process) OSS Crown jewels · detail callout Authoritative configuration vault Zone and conduit definitions held offline so they cannot be silently re-drawn from a compromised admin tier. Modules & symbols ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak Physical sever ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate Zone boundary ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink Remove trust ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named access ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay Time-bound path Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-04 pattern composes. How the primary modules compose 1. [1 ![Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png) Firebreak FIRE Physically breaks the connection path so the attack cannot continue. ](/control/modules/firebreak) 2. [2 ![Isolate module icon](/assets/isolate-icon-B9t8fl3o.png) Isolate FIRE Separates the affected environment into a controlled zone. ](/control/modules/isolate) 3. [3 ![Unlink module icon](/assets/unlink-icon-B8GFAVW1.png) Unlink VAULT Removes the persistent dependencies that quietly bypass the control. ](/control/modules/unlink) Supporting modules - [![Lock module icon](/assets/lock-icon-UU3vOaKE.png) Lock VAULT Holds the asset behind identity, role and policy controls. ](/control/modules/lock) - [![Relay module icon](/assets/relay-icon-CVhJDRO7.png) Relay FIRE Opens a temporary, time-bound window for an approved purpose. ](/control/modules/relay) 03 How it reads end to end ## The Blueprint in full. Firebreak controls the physical path between zones. Isolate separates environments at hardware level. Unlink removes always-on dependencies that quietly tunnel between them. Lock and Relay govern when and how a temporary crossing is ever allowed. 04 Sector relevance ## Where CP-04 applies. Defence Critical infrastructure Public sector Manufacturing 05 Related Blueprints ## Compose alongside. [See all](/control-blueprints) [ CP-01 FIRE-led ### Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. View Blueprint ](/control-blueprints/cp-01)[ CP-02 FIRE-led ### Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. View Blueprint ](/control-blueprints/cp-02)[ CP-07 FIRE-led ### Protect Aviation and Aerospace Networks Block incoming traffic by default. Open the air-lock only for verified, time-bound reach. View Blueprint ](/control-blueprints/cp-07) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Build control around your environment Talk to our team about composing this Blueprint for your estate. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up