Anchor keeps critical assets within defined physical connection boundaries. It defines permitted physical paths and the conditions for changing them. The boundary must cover the relevant routes; Anchor does not establish that an asset has no other route or that a compromise is impossible.

Is Anchor a backup or archive system?

No. Anchor is a connectivity module within Control by Firevault. Offline Secure Storage separately protects stored data and recovery copies. Backup creation, retention and recovery remain separate responsibilities; Anchor does not provide them.

How does Anchor work with the other Control modules?

Anchor defines the boundary. The selected Control Plan assigns the supporting roles: Lock governs authority, Validate supports checks, Relay provides an approved connection window where specified and Fracture cuts a physical path. Firebreak is the hardware, not another name for Anchor.

What must be checked before deployment?

Review critical assets, dependencies, permitted connections, alternative and management routes, exception authority and operational consequences. Pilot the agreed behaviour and define how the resulting state is checked. Timing depends on command delivery, processing, switching and service readiness; out-of-band delivery can also be affected by roaming and handshakes. Logging, evidence retention and compliance depend on the wider implementation, not Anchor alone.

FV-06 AnchorControl module · Protect the asset

Keep critical assets within defined physical connection boundaries.

Anchor defines which physical paths may reach a critical asset, who may authorise a change and which connections must remain unavailable. The protection depends on the agreed boundary covering the relevant paths, including alternative and management connections.

Book a Control demo See it in action

AnchorProtect the asset

Module: FV-06 Anchor
Family: Protect the asset
The question it answers: Which paths may reach this asset?
Covers: Primary, alternative and management paths
Changes: Named authority only

What happens when

The asset was in a restricted zone. It was still reachable.

A critical asset can sit behind every control you have, and still be reached through a shared service or a maintenance route nobody counted.

Year oneThe asset is placed carefully.
A critical system sits in its own restricted zone.
Year twoA maintenance route is added.
A supplier needs access. The route stays after the work ends.
Year threeThe boundary has drifted.
The asset now has three routes, and the drawing still shows one.

A boundary only works when the paths respect it. Anchor starts from the physical connections.

See it in action

One critical asset. Switch between uncounted routes and Anchor.

The same asset and the same three routes, handled two ways.

Routes nobody countedWith Anchor

Primary, maintenance and management routes all reach the asset.

Only the agreed route inside the boundary remains. Maintenance and management routes are unavailable until a named authority changes that.

Step by step

Step 1Identify the asset
Agree which asset matters and who owns it.
Step 2Count the paths
Map every physical connection that could reach it, including alternatives.
Step 3Set the boundary
Decide which paths stay inside and which must remain unavailable.
Step 4Review
Reassess the boundary when systems, suppliers or requirements change.

What Anchor is

A boundary drawn around the asset, not the network.

Anchor starts with the physical connection boundary, not an assumption that the asset is already separate.

Defined physical boundaries
The asset and the connections that may reach it, agreed and recorded.
Controlled exceptions
Maintenance access with a named authority, a purpose and an end.
Boundary review
The boundary is tested, not taken from an old drawing.

What it changes

Critical assets reachable only by agreed paths.

Anchor does not make an asset invulnerable. It makes sure the paths that reach it are the ones you chose.

Fewer routes. Known routes.

Every path to a critical asset is counted
Maintenance exceptions end when the work ends
Changes need a named authority
Boundaries are reviewed when things change

Where it fits

Fracture, Isolate and Anchor answer different questions.

Fracture and Isolate decide whether connections exist. Anchor does a different job, and most Plans use more than one module.

Module	Fracture	Isolate	Anchor
The question it answers	Must this connection be physically disconnected now?	Which zones should never share a path?	Which physical paths may reach this critical asset?
Normal state	Connected, with a crossing ready to be disconnected	Zones held apart, crossings closed by default	Boundary held, only agreed paths available
When it acts	When a connection becomes dangerous	By design, before anything goes wrong	By design, and when exceptions are approved
What it ends	An incident travelling along a live path	Trust that exists only because systems share a network	Routes to critical assets that nobody counted
Typical Plans	CP-01, CP-02	CP-04, CP-05, CP-14	CP-05, CP-15, CP-16

Control Plans and Blueprints

Where Anchor does the work.

Anchor protects the assets at the centre of critical asset and OT Plans. Plans marked Proposed are awaiting technical approval.

Control PlansTwenty Plans, each solving one problem.All Control Plans
Control BlueprintsIndustry solutions that combine Plans.All Control Blueprints
FracturePhysically disconnect a connection.See Fracture
IsolateHold zones apart by design.See Isolate

Questions

What network and security teams ask.

Want to see it on real hardware? We will show you.

Book a Control demo

How is Anchor different from Isolate?

Isolate keeps zones apart. Anchor starts with one critical asset and agrees every physical path that may reach it, wherever those paths come from.

Does Anchor cover management connections?

It should. The protection depends on the agreed boundary covering the relevant paths, including alternative and management connections.

Can maintenance still happen?

Yes, as a controlled exception with a named authority, a purpose and an end.

Is Anchor the same as archiving?

No. Anchor is about connection boundaries around critical assets. Recovery copies are held separately in Offline Secure Storage®.

Your next step

Map the boundary around one critical asset.

We will count the paths to one of your critical assets and show the boundary held.

Book a Control demo