Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control BlueprintCP-05

Protect Critical Infrastructure

Keep the process running while making maintenance and enterprise access deliberate. Critical infrastructure needs boundaries that respect operational safety.

Blueprint
CP-05
Primary modules
  • Firebreak
  • Isolate
  • Relay
  • Execute
Supporting
  • Transfer
  • Archive
  • Lock
Where it fits
OT and CNI connectivity with maintenance windows
CP-05 Protect Critical Infrastructure, as drawnIllustration
Zone 0Enterprise ITOffice, mail, ERP, identity
Boundary 1
  • Firebreak
  • Relay
  • Lock
Severed
IT-to-OT conduit is severed by default and opened as a named window.
Zone 1Supervisory and engineeringSCADA, historian, engineering workstations
Boundary 2
  • Isolate
  • Execute
  • Validate
Scoped
Engineering reach is scoped, approved and verified.
Zone 2Process control and fieldPLCs, RTUs, HMIs, sensors and actuators
Held offlineOperational evidence and golden image vaultOperational records and golden PLC images sealed offline for safe recovery and audit.Offline

Out-of-band command pathManagement Ethernet, cellular SMS or an authenticated API, off the production network.

The sequenceStep through how the modules work together, as the Blueprint sets them out.

The pattern

Protect the process without treating it like office IT.

What it does

CP-05 separates enterprise IT, supervisory engineering and field control. The process zone continues its work; maintenance and supervisory reach are governed crossings, not an assumption that every connected business system may reach industrial equipment.

A useful control is one the operational owner can safely invoke. Agree the allowed state of each crossing and validate its impact before authorising Execute. The local enforcement point carries out that agreed action; it does not replace process protection, safety engineering or the plant’s own control logic.

Where it fits

For energy, manufacturing and other critical infrastructure using SCADA, historians, engineering workstations, PLCs and RTUs. Start with how the plant operates, which support activities need access and what a disconnect would mean for the process.

Who uses it
Grounded in

IEC 62443-3-3 (FR 5, FR 7), NIS2 Annex I and the NCSC Cyber Assessment Framework B4. Control can help support the controls they describe.

Control for data centres

Zone by zone

How CP-05 protects critical infrastructure.

Trace access from business IT into engineering and then to the equipment controlling the process. Treat each transition differently.

  1. Zone 0

    Enterprise IT

    Office, email, ERP and identity services belong to the enterprise side, not to the process control boundary by default.

  2. Boundary 1

    Severed

    Keep IT-to-OT reach disconnected except for a named maintenance or supervisory window approved for the plant.

    • FirebreakPhysical sever. Primary in CP-05
    • RelayTime-bound path. Primary in CP-05
    • LockNamed access. Supporting in CP-05
  3. Zone 1

    Supervisory and engineering

    SCADA, historians and engineering workstations require controlled access for real operational tasks, not unrestricted enterprise reach.

  4. Boundary 2

    Scoped

    Scope engineering access to the equipment and work approved by the operational owner, with the consequences of closure assessed first.

    • IsolateZone boundary. Primary in CP-05
    • ExecuteTrigger, act, terminate. Primary in CP-05
    • ValidateIntegrity check. On the path in CP-05
  5. Zone 2

    Process control and field

    PLCs, RTUs, HMIs, sensors and actuators support the physical process. Their required local operation must shape the boundary design.

  6. Offline

    Operational evidence and golden image vault

    Protect operational records and approved PLC recovery images separately offline. Restoration still needs engineering checks and a safe commissioning process.

    Offline Secure Storage®

Bill of modules

Firebreak, Isolate, Relay and Execute lead. Transfer, Archive and Lock support.

The path modules govern industrial reach. Validation, transfers and protected records support maintenance and safe recovery preparation.

Module Layer In CP-05 Where it sits What it does here
Firebreak Control the path Primary Boundary 1 Disconnects the enterprise-to-OT crossing identified in the plant’s approved access design.
Isolate Control the path Primary Boundary 2 Separates process and field environments from supervisory reach at the selected boundary.
Relay Control the path Primary Boundary 1 Opens a maintenance window for the industrial task and duration approved by the owner.
Execute Control the path Primary Boundary 2 Applies the locally agreed operational response rather than imposing a generic office-IT shutdown.
Transfer Protect the asset Supporting Across the Blueprint Governs the engineering files, updates and recovery artefacts allowed across the industrial boundary.
Archive Protect the asset Supporting Across the Blueprint Preserves operational records and control evidence needed for investigation and recovery review.
Lock Protect the asset Supporting Boundary 1 Restricts industrial access to the roles authorised for the plant and task.
Validate Protect the asset On the path Boundary 2 Checks the maintenance authority and conditions before engineering reach proceeds.

At the approved industrial crossing, Firebreak® is supplied by Firevault within Control. Its use must follow the plant’s dependency assessment and safety-validated response plan.Explore Firebreak®

All nine modules

Versus the alternatives

Industrial containment has to respect the process.

Neither an alert nor a disconnected cable establishes that a plant is in a safe state. Compare the authority and scope around the action.

Question Detect and respond Manual shutdown CP-05
Operating context Monitoring reports activity in the industrial estate Staff need plant knowledge before disconnecting The boundary is designed around operational responsibilities
Enterprise reach Network policies govern IT-to-OT traffic A cable break closes one identified link Firebreak controls the approved enterprise crossing
Maintenance work Remote access needs separate approval controls Staff connect and disconnect for support Relay creates a governed industrial maintenance window
Process safety Detection does not determine a safe process state Physical removal can affect dependencies Execute is limited to the response validated for that crossing
Engineering material File controls depend on the existing tooling Cabling alone does not govern updates Validate and Transfer govern the approved engineering exchange
Recovery preparation Monitoring does not preserve a PLC baseline Disconnection alone creates no golden image Operational records and recovery assets are protected separately

Questions

Questions from engineering and operations.

The design should preserve required process operation and control unnecessary external reach. Whether a crossing can safely close depends on the plant’s dependencies and the response validated by its operational owners.

The pattern controls selected connections rather than assuming every PLC or RTU can run a security agent. Equipment constraints and operational dependencies still need a site-specific assessment.

The person responsible for the affected process or engineering task, with the required access authority. Approval needs to cover purpose, equipment, duration and the permitted end state.

The control model supports pre-agreed local enforcement. Decide which authorised signals and out-of-band channels the site will use, including when remote orchestration is unavailable.

No. They provide a separately protected recovery asset. Engineers still need to verify the image, its suitability for the equipment and the safe process for restoring it.

No. It can support the relevant controls referenced on the sheet, but certification and compliance depend on the whole organisation, implementation and evidence.

All questions

Disconnect to Protect®

Start with the process, then define its reach.

Talk to us with your engineering and security owners. We will discuss maintenance boundaries and the actions the plant can safely permit.