--- title: "Control Isolate Module: isolate network zones | Firevault" url: https://fire-vault.com/control-module/isolate description: "Isolate enforces physical separation between network zones so a compromised segment cannot reach critical systems while investigations run." lang: en-GB --- **FV-02 Isolate**Control module · Control the path # Keep a problem in one zone. Not across the whole estate. Isolate holds your networks and critical systems apart as separate zones, enforced at Layer 1. A compromise in one zone stays where it started, because the paths that would carry it elsewhere are closed by design, and only the crossings you approve exist. Book a Control demo: https://fire-vault.com/demo See it in action Image: Isolate module icon (https://fire-vault.com/__l5e/assets-v1/c5015e76-638b-4190-b9d5-d35e95f68c41/isolate-icon.png) **Isolate**Control the path Module FV-02 Isolate Family Control the path The question it answers Which zones should never share a path? Enforced by Firebreak® at Layer 1 Commanded Through Execute, out of band What happens when ## One laptop is compromised. Everything on the same network is next. Most networks grew one connection at a time. Systems that never needed to talk to each other can, simply because they share a network. 1. Monday**A laptop is compromised.** A reused password on a corporate account. It looks like an ordinary login. 2. Tuesday**The network is flat.** Operations, finance and records sit one step away, reachable because they share a subnet, not because anyone chose it. 3. Wednesday**The incident is everywhere.** Recovery now covers the whole estate instead of one room. Segmentation in software can drift. Isolate keeps the boundary physical. See it in action ## Three zones. Switch between a flat network and an isolated one. The same compromised laptop, in two networks. Choose a state to see how far it can reach. Corporate, operations and records share one network. A compromise in corporate can reach both of the others. Each zone is held apart at Layer 1. The compromise stays in corporate; operations and records keep running; one approved crossing remains for the work that needs it. Step by step 1. Step 1**Map the zones** Agree which systems belong together and which must never share a path. 2. Step 2**Agree the crossings** Name the few connections that may exist between zones, and who approves them. 3. Step 3**Hold the boundary** Firebreak® keeps every other path between zones closed at Layer 1. 4. Step 4**Prove it** Each boundary state and each crossing change is recorded. What Isolate is ## Separation by design, not by the way switches were wired. Isolate decides where boundaries sit and keeps them physical, so trust does not extend across a zone unless you open a crossing on purpose. - **Explicit zones** Zones are designed around how the business actually runs, not inherited from old cabling. - **Physical boundaries** Paths between zones are closed in hardware, so a changed rule cannot quietly reopen them. - **Approved crossings only** The few connections that must exist are named, owned and recorded. What it changes ## An incident in one room, not the whole building. Isolate does not stop every compromise. It limits how far one can travel, and gives responders a smaller problem. ### Smaller blast radius. Clearer recovery. - A compromise is limited to what its zone can reach - Responders work in one zone while the others keep running - Boundaries do not drift as services are added - Auditors see the recorded state of each boundary Where it fits ## Fracture, Isolate and Relay answer different questions. The three FIRE modules work on connections. Each one is chosen for a different moment, and most Plans use more than one. | Module | Fracture | Isolate | Relay | | --- | --- | --- | --- | | The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path, and where is the one permitted crossing? | Should this path exist right now, for this work, and when does it close? | | Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Closed, opened only inside an approved window | | When it acts | When a connection becomes dangerous | By design, before anything goes wrong | On a schedule or approved request | | What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Standing access left open after the work is done | | Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-03, CP-13, CP-17 | Control Plans and Blueprints ## Where Isolate does the work. Isolate is the backbone of segmentation and critical asset Plans. Plans marked Proposed are awaiting technical approval. - CP-04**Physical Network Segmentation**_Zones separated at Layer 1, so a boundary holds even when software controls are compromised._: https://fire-vault.com/control-plan/enforce-physical-segmentation - CP-05**Critical Asset Protection**_Separate business access from essential systems, with planned isolation boundaries._: https://fire-vault.com/control-plan/protect-critical-infrastructure - CP-14**Compromised Device Isolation**_Physically isolate one affected device from the network._: https://fire-vault.com/control-plan/compromised-device-isolation - CP-16**Remote Site Isolation**_Disconnect the communications link to a remote facility._: https://fire-vault.com/control-plan/remote-site-isolation - **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans) - **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints) - **Firebreak®**The Layer 1 hardware that enforces the change. See Firebreak® (https://fire-vault.com/firebreak) - **The nine modules**How Isolate sits alongside the others. All modules (https://fire-vault.com/control-modules) Questions ## What network and security teams ask. Want to see a zone held apart on real hardware? We will show you. Book a Control demo: https://fire-vault.com/demo How is Isolate different from VLANs or firewall segmentation? VLANs and firewall rules separate traffic in software on connections that still exist. Isolate closes the paths between zones at Layer 1, so the boundary does not depend on the configuration of a device that could be reached. Does Isolate replace our firewalls? No. Firewalls still filter the crossings you allow. Isolate removes the paths you do not. How is Isolate different from Fracture? Isolate sets boundaries by design, before anything goes wrong. Fracture disconnects a live connection when it becomes dangerous. Many Plans use both. Can a crossing be opened temporarily? Yes, through Relay, for an approved purpose and a defined window. Isolate keeps the boundary; Relay manages the time-bound exception. Will isolating zones break dependencies? Dependencies are mapped during scoping, and each boundary is tested before it is enforced in production. Your next step ## See a zone held apart in front of you. We will map your zones, show a boundary held at Layer 1 and agree the crossings that should remain. Firevault home (https://fire-vault.com/) Offline Secure Storage® and Control. A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control. Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited Firevault on Facebook: https://www.facebook.com/Firevaultltd/ Firevault on YouTube: https://www.youtube.com/@Firevault-ltd Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/ © 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-module/isolate#webpage", "url": "https://fire-vault.com/control-module/isolate", "name": "Control Isolate Module: isolate network zones", "description": "Isolate enforces physical separation between network zones so a compromised segment cannot reach critical systems while investigations run.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/792240c2-c981-405a-85ce-7bbb109b2b4d/og-control-isolate.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-module/isolate#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-module/isolate#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Module", "item": "https://fire-vault.com/control-module" }, { "@type": "ListItem", "position": 3, "name": "Control Isolate Module: isolate network zones", "item": "https://fire-vault.com/control-module/isolate" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://fire-vault.com/#org", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com/", "identifier": "16320803", "sameAs": [ "https://www.linkedin.com/company/firevault-limited", "https://www.facebook.com/Firevaultltd/", "https://www.youtube.com/@Firevault-ltd" ] }, { "@type": "WebPage", "name": "FV-Isolate: Separate, contain and limit reach", "url": "https://fire-vault.com/control-module/isolate", "description": "Isolate divides systems and networks into controlled zones so a problem in one place cannot freely become a problem everywhere. Trust does not extend across a boundary unless the boundary is intentionally opened for a defined purpose.", "publisher": { "@id": "https://fire-vault.com/#org" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 2, "name": "FV-Isolate", "item": "https://fire-vault.com/control-module/isolate" } ] }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Isolate the same as network segmentation?", "acceptedAnswer": { "@type": "Answer", "text": "It goes further. Logical segmentation drifts as services, integrations and exceptions accumulate. Isolate holds an explicit zone and conduit model, where each protected zone is reachable only through a named conduit, and only when that conduit is authorised to be open." } }, { "@type": "Question", "name": "How do zones work with existing networks?", "acceptedAnswer": { "@type": "Answer", "text": "Zones are designed against operational reality, not inherited from the way switches happened to be wired. Adoption starts by mapping the systems, services, identities and data flows that should sit together and those that should not." } }, { "@type": "Question", "name": "What happens when work genuinely needs to cross a zone?", "acceptedAnswer": { "@type": "Answer", "text": "The crossing is requested, not assumed. Cross-zone traffic is allowed only when a specific path, purpose and approval exist, typically as a time-bound Relay session, and the approval is recorded through Anchor." } }, { "@type": "Question", "name": "How is drift prevented?", "acceptedAnswer": { "@type": "Answer", "text": "Isolate runs as part of normal change control, with continuous evidence that each boundary is intact, and crossings reviewed through Anchor on a regular cadence." } } ] } ] } ] ```