--- title: "Anchor: physical connection boundaries | Firevault" url: https://fire-vault.com/control-module/anchor description: "Anchor keeps critical assets within defined physical connection boundaries. Define permitted paths, authorise exceptions and review changes with Control by…" lang: en-GB --- **FV-06 Anchor**Control module · Protect the asset # Keep critical assets within defined physical connection boundaries. Anchor defines which physical paths may reach a critical asset, who may authorise a change and which connections must remain unavailable. The protection depends on the agreed boundary covering the relevant paths, including alternative and management connections. Book a Control demo: https://fire-vault.com/demo See it in action Image: Anchor module icon (https://fire-vault.com/__l5e/assets-v1/d5abff2a-3f4d-41a0-8454-b76f483c1009/archive-icon.png) **Anchor**Protect the asset Module FV-06 Anchor Family Protect the asset The question it answers Which paths may reach this asset? Covers Primary, alternative and management paths Changes Named authority only What happens when ## The asset was in a restricted zone. It was still reachable. A critical asset can sit behind every control you have, and still be reached through a shared service or a maintenance route nobody counted. 1. Year one**The asset is placed carefully.** A critical system sits in its own restricted zone. 2. Year two**A maintenance route is added.** A supplier needs access. The route stays after the work ends. 3. Year three**The boundary has drifted.** The asset now has three routes, and the drawing still shows one. A boundary only works when the paths respect it. Anchor starts from the physical connections. See it in action ## One critical asset. Switch between uncounted routes and Anchor. The same asset and the same three routes, handled two ways. Primary, maintenance and management routes all reach the asset. Only the agreed route inside the boundary remains. Maintenance and management routes are unavailable until a named authority changes that. Step by step 1. Step 1**Identify the asset** Agree which asset matters and who owns it. 2. Step 2**Count the paths** Map every physical connection that could reach it, including alternatives. 3. Step 3**Set the boundary** Decide which paths stay inside and which must remain unavailable. 4. Step 4**Review** Reassess the boundary when systems, suppliers or requirements change. What Anchor is ## A boundary drawn around the asset, not the network. Anchor starts with the physical connection boundary, not an assumption that the asset is already separate. - **Defined physical boundaries** The asset and the connections that may reach it, agreed and recorded. - **Controlled exceptions** Maintenance access with a named authority, a purpose and an end. - **Boundary review** The boundary is tested, not taken from an old drawing. What it changes ## Critical assets reachable only by agreed paths. Anchor does not make an asset invulnerable. It makes sure the paths that reach it are the ones you chose. ### Fewer routes. Known routes. - Every path to a critical asset is counted - Maintenance exceptions end when the work ends - Changes need a named authority - Boundaries are reviewed when things change Where it fits ## Fracture, Isolate and Anchor answer different questions. Fracture and Isolate decide whether connections exist. Anchor does a different job, and most Plans use more than one module. | Module | Fracture | Isolate | Anchor | | --- | --- | --- | --- | | The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path? | Which physical paths may reach this critical asset? | | Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Boundary held, only agreed paths available | | When it acts | When a connection becomes dangerous | By design, before anything goes wrong | By design, and when exceptions are approved | | What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Routes to critical assets that nobody counted | | Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-05, CP-15, CP-16 | Control Plans and Blueprints ## Where Anchor does the work. Anchor protects the assets at the centre of critical asset and OT Plans. Plans marked Proposed are awaiting technical approval. - CP-05**Critical Asset Protection**_Separate business access from essential systems, with planned isolation boundaries._: https://fire-vault.com/control-plan/protect-critical-infrastructure - CP-15**Operational Technology Protection**_Industrial controllers behind a physical network boundary._: https://fire-vault.com/control-plan/operational-technology-protection - CP-16**Remote Site Isolation**_Disconnect the communications link to a remote facility._: https://fire-vault.com/control-plan/remote-site-isolation - **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans) - **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints) - **Fracture**Physically disconnect a connection. See Fracture (https://fire-vault.com/control-module/fracture) - **Isolate**Hold zones apart by design. See Isolate (https://fire-vault.com/control-module/isolate) Questions ## What network and security teams ask. Want to see it on real hardware? We will show you. Book a Control demo: https://fire-vault.com/demo How is Anchor different from Isolate? Isolate keeps zones apart. Anchor starts with one critical asset and agrees every physical path that may reach it, wherever those paths come from. Does Anchor cover management connections? It should. The protection depends on the agreed boundary covering the relevant paths, including alternative and management connections. Can maintenance still happen? Yes, as a controlled exception with a named authority, a purpose and an end. Is Anchor the same as archiving? No. Anchor is about connection boundaries around critical assets. Recovery copies are held separately in Offline Secure Storage®. Your next step ## Map the boundary around one critical asset. We will count the paths to one of your critical assets and show the boundary held. Firevault home (https://fire-vault.com/) Offline Secure Storage® and Control. A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control. Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited Firevault on Facebook: https://www.facebook.com/Firevaultltd/ Firevault on YouTube: https://www.youtube.com/@Firevault-ltd Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/ © 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-module/anchor#webpage", "url": "https://fire-vault.com/control-module/anchor", "name": "Anchor: physical connection boundaries", "description": "Anchor keeps critical assets within defined physical connection boundaries. Define permitted paths, authorise exceptions and review changes with Control by…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/942b1a6c-0079-4d91-87ac-bde8eaa75762/og-control-archive.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-module/anchor#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-module/anchor#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Module", "item": "https://fire-vault.com/control-module" }, { "@type": "ListItem", "position": 3, "name": "Anchor: physical connection boundaries", "item": "https://fire-vault.com/control-module/anchor" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://fire-vault.com/#org", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com/", "identifier": "16320803", "sameAs": [ "https://www.linkedin.com/company/firevault-limited", "https://www.facebook.com/Firevaultltd/", "https://www.youtube.com/@Firevault-ltd" ] }, { "@type": "WebPage", "name": "Anchor: physical connection boundaries | Firevault", "url": "https://fire-vault.com/control-module/anchor", "description": "Anchor keeps critical assets within defined physical connection boundaries. Define permitted paths, authorise exceptions and review changes with Control by Firevault.", "publisher": { "@id": "https://fire-vault.com/#org" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 2, "name": "FV-Anchor", "item": "https://fire-vault.com/control-module/anchor" } ] }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What does Anchor do?", "acceptedAnswer": { "@type": "Answer", "text": "Anchor keeps critical assets within defined physical connection boundaries. It defines permitted physical paths and the conditions for changing them. The boundary must cover the relevant routes; Anchor does not establish that an asset has no other route or that a compromise is impossible." } }, { "@type": "Question", "name": "Is Anchor a backup or archive system?", "acceptedAnswer": { "@type": "Answer", "text": "No. Anchor is a connectivity module within Control by Firevault. Offline Secure Storage separately protects stored data and recovery copies. Backup creation, retention and recovery remain separate responsibilities; Anchor does not provide them." } }, { "@type": "Question", "name": "How does Anchor work with the other Control modules?", "acceptedAnswer": { "@type": "Answer", "text": "Anchor defines the boundary. The selected Control Plan assigns the supporting roles: Lock governs authority, Validate supports checks, Relay provides an approved connection window where specified and Fracture cuts a physical path. Firebreak is the hardware, not another name for Anchor." } }, { "@type": "Question", "name": "What must be checked before deployment?", "acceptedAnswer": { "@type": "Answer", "text": "Review critical assets, dependencies, permitted connections, alternative and management routes, exception authority and operational consequences. Pilot the agreed behaviour and define how the resulting state is checked. Timing depends on command delivery, processing, switching and service readiness; out-of-band delivery can also be affected by roaming and handshakes. Logging, evidence retention and compliance depend on the wider implementation, not Anchor alone." } } ] } ] } ] ```