Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control for construction

Site network and BIM data path governance.

Construction projects involve dozens of contractors sharing temporary networks on active sites, while Building Information Models carry the structural, mechanical and security detail of what is being built.

  • BIM data exposure
  • Multi-contractor access
  • Temporary infrastructure

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The challenge

Construction sites present unique network risks.

A stolen BIM model is not only intellectual property loss. It can reveal how a building is secured.

  1. BIM data held in secured Firevault Bunkers.

  2. Each contractor gets isolated access paths with independent authorisation and logging.

  3. Automated logging that can help support ISO 19650 and government construction security standards.

Challenge 3

Temporary infrastructure.

Construction site networks are temporary by nature and often lack the security controls of permanent estates.

Answered byISO 19650 evidence

The scenario

Scenario: BIM data theft from a critical infrastructure project.

Design data for a sensitive building should not be one hop from site Wi-Fi. Step through it, or play it through.

Step 1 of 2

The attack path

A subcontractor’s laptop on site Wi-Fi is compromised through an unpatched flaw.

The attacker uses the site network to download BIM models for a government building, revealing camera, access control and structural details.

The path
Always there
What the attacker needs
A foothold and time

An illustrative scenario.

Layer 1
Separation of BIM from site networks
Per contractor
Isolated, logged access paths
Windowed
Supplier access
Logged
Evidence for ISO 19650

Where each module sits

Where each Control module is deployed across office, project, site and supply chain.

Control puts a real boundary at the places that matter: between the office and project systems, between design and site, and on every supply chain link.

  1. C0 to C1 and supply chain linksFirebreakA physical cut that takes the live path away during a supply chain incident.
  2. C0 to C1 and C1 to C2 linksValidateRequests entering project systems are checked for origin, integrity and authority.
  3. C1 to C2 linkIsolateOffice and project systems sit on separate fabrics, so an office compromise does not reach designs.
  4. C2 to C3 linkTransferWhen designs move to site, Transfer governs the route and the landing point.
  5. C2 to C3 linkLockSite access ties to named users with the correct role.
  6. Supply chain linkRelaySupplier access opens only for the window of work.
  7. Supply chain linkUnlinkWhen a supplier engagement ends, Unlink removes the persistent connection and inherited trust.

Explore the Control Blueprints

Capabilities

What you get with every deployment.

Six things Control gives the team, from the first boundary to the audit afterwards.

Construction

Project data in Firevault Bunkers

BIM data held in secured Firevault Bunkers.

Construction

Multi-contractor governance

Each contractor gets isolated access paths with independent authorisation and logging.

Construction

ISO 19650 evidence

Automated logging that can help support ISO 19650 and government construction security standards.

Construction

Site cellular management

Out-of-band cellular management works independently of temporary site networks.

Construction

Project audit trail

Tamper-evident logs of BIM and building system access persist beyond construction.

Construction

Project data archive

Verified configuration baselines support long-term preservation after handover.

Adoption guide

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

  1. 1

    Project security assessment

    Assess BIM sensitivity, contractor access needs and building management connectivity.

  2. 2

    Site zone architecture

    Design physically separated zones for general site access, BIM, building management and corporate systems.

  3. 3

    Single site pilot

    Deploy on a representative site with contractor access governance, BIM isolation and compliance logging.

  4. 4

    Estate-wide adoption

    Roll out a standard deployment across all sites, with central archives and cellular management.

Questions

What teams ask first

It moves with the project: zones are designed per site, with out-of-band cellular management that does not depend on the temporary site network.

Yes, each through its own isolated, time-windowed path with independent authorisation and logging.

The project archive and audit trail persist beyond construction, held offline as verified baselines.

It can help support them, with logging aligned to ISO 19650 and government construction security standards.

All questions

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.