--- title: "Protect Critical Infrastructure by Firevault - Control Blue…" description: "Keep critical systems available, controlled and disconnected from unnecessary exposure." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-05#webpage", "url": "https://fire-vault.com/control-blueprints/cp-05", "name": "Protect Critical Infrastructure by Firevault - Control Blue…", "description": "Keep critical systems available, controlled and disconnected from unnecessary exposure.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/43ece632-a099-4e7a-bc2d-64e687b31877/og-blueprint-cp-05.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-05#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-05#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Protect Critical Infrastructure by Firevault - Control Blue…", "item": "https://fire-vault.com/control-blueprints/cp-05" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Protect Critical Infrastructure - Control Blueprint CP-05", "description": "Keep critical systems available, controlled and disconnected from unnecessary exposure.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-05", "about": { "@type": "Thing", "name": "Control Blueprint CP-05" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) FIRE + VAULT · CP-05 # Protect Critical Infrastructure Keep critical systems available, controlled and disconnected from unnecessary exposure. - CP-05 - Path and asset together Discuss this Blueprint [Read the guide](/learn/guides/protecting-critical-infrastructure-control-blueprint) [All Blueprints](/control-blueprints) ![Control Blueprint CP-05, Protect Critical Infrastructure: an isometric diagram of an industrial site with a single controlled entry gate](/__l5e/assets-v1/504e7d61-228d-469e-aa2f-86ebe3981f88/blueprint-cp-05-hero.webp) 01 At a glance ## What this Blueprint does. OT and CNI connectivity with maintenance windows What it does Keep critical systems available, controlled and disconnected from unnecessary exposure. Where it fits OT and CNI connectivity with maintenance windows Who uses it Energy, Critical infrastructure, Defence, Manufacturing CP-05 topology ## How CP-05 protects critical infrastructure. A FIRE+VAULT pattern for OT and CNI. Process zones run normally; maintenance and supervisory reach exist only through governed, time-bound conduits. Grounded in IEC 62443-3-3 (FR 5, FR 7), NIS2 Annex I and the NCSC Cyber Assessment Framework B4. Z0 Enterprise IT Office, mail, Enterprise IT zone Office, mail, ERP, identity ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock IT-to-OT conduit is severed by default and opened as a named window. Z1 Supervisory and engineering SCADA, historian, Supervisory and engineering zone SCADA, historian, engineering workstations ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate Engineering reach is scoped, approved and verified. Z2 Process control and field PLCs, RTUs, Process control and field zone PLCs, RTUs, HMIs, sensors and actuators OSS Crown jewels · detail callout Operational evidence and golden image vault Operational records and golden PLC images sealed offline for safe recovery and audit. Modules & symbols ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak Physical sever ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay Time-bound path ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named access ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate Zone boundary ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute Approved action ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate Integrity check Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-05 pattern composes. How the primary modules compose 1. [1 ![Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png) Firebreak FIRE Physically breaks the connection path so the attack cannot continue. ](/control/modules/firebreak) 2. [2 ![Isolate module icon](/assets/isolate-icon-B9t8fl3o.png) Isolate FIRE Separates the affected environment into a controlled zone. ](/control/modules/isolate) 3. [3 ![Relay module icon](/assets/relay-icon-CVhJDRO7.png) Relay FIRE Opens a temporary, time-bound window for an approved purpose. ](/control/modules/relay) 4. [4 ![Execute module icon](/assets/execute-icon-kJl5Gtmk.png) Execute FIRE Fires the control action the moment a signal demands it. ](/control/modules/execute) Supporting modules - [![Transfer module icon](/assets/transfer-icon-DqGa0PQI.png) Transfer VAULT Governs what moves between protected environments. ](/control/modules/transfer) - [![Archive module icon](/assets/archive-icon-B3rc85NY.png) Archive VAULT Preserves the records, logs and evidence the control produced. ](/control/modules/archive) - [![Lock module icon](/assets/lock-icon-UU3vOaKE.png) Lock VAULT Holds the asset behind identity, role and policy controls. ](/control/modules/lock) 03 How it reads end to end ## The Blueprint in full. Firebreak controls connectivity at the physical layer. Isolate separates operational systems. Relay opens approved maintenance, patching or supervisory windows. Execute can revoke access instantly. Transfer governs data movement, Archive preserves operational evidence and Lock holds access tight. 04 Sector relevance ## Where CP-05 applies. Energy Critical infrastructure Defence Manufacturing 05 Related Blueprints ## Compose alongside. [See all](/control-blueprints) [ CP-03 FIRE + VAULT ### Control Third-Party Access Give third parties access without giving them a permanent doorway. View Blueprint ](/control-blueprints/cp-03)[ CP-01 FIRE-led ### Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. View Blueprint ](/control-blueprints/cp-01)[ CP-02 FIRE-led ### Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. View Blueprint ](/control-blueprints/cp-02) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Build control around your environment Talk to our team about composing this Blueprint for your estate. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up