---
title: "Control Lock Module: lock down access on demand | Firevault"
url: https://fire-vault.com/control-module/lock
description: "Lock hardens network access on demand, holding paths in a read-only or disconnected state until an authorised release. Read how the guardrails work."
lang: en-GB
---

**FV-08 Lock**Control module · Protect the asset

# Being on the network is not permission.

Lock restricts access to protected assets by defined identity, permission and policy. Being connected is not enough; only the people and systems you name can use or change the asset, and every use is recorded.

Book a Control demo: https://fire-vault.com/demo
See it in action

Image: Lock module icon (https://fire-vault.com/__l5e/assets-v1/a77117f1-af05-449b-8648-8e980a40ed2c/lock-icon.png)
**Lock**Protect the asset

Module

FV-08 Lock

Family

Protect the asset

The question it answers

Who may use or change this asset?

Based on

Identity, permission, policy

Records

Every use and change

What happens when

## Everyone on the network could see it. So could the attacker.

Protected assets are often reachable by anyone already inside. That includes anyone who got inside with a stolen login.

1. Morning**A contractor joins.**
   They are given network access for a project.
2. Afternoon**They can see the board records.**
   Nobody intended that. The records were simply reachable.
3. Weeks later**Their login is stolen.**
   Whoever has it can reach the records too.

Network access is not a reason. Lock makes permission explicit.

See it in action

## Four people, one asset. Switch between network access and Lock.

The same people and the same board records, handled two ways.

Anyone on the network can reach the board records.

Only the named owner, with the right permission, can reach them. The others are not refused one by one; they were never given a path.

Step by step

1. Step 1**Name the asset**
   Agree what is protected and who owns it.
2. Step 2**Name the people**
   Decide which identities may use or change it.
3. Step 3**Set the policy**
   Agree conditions such as time, location or approval.
4. Step 4**Record**
   Every use and change is recorded.

What Lock is

## Access by name, not by location.

Lock ties access to who someone is and what they are allowed to do, not to where they happen to be connected.

- **Defined identities**
  Only named people and systems.
- **Permissions**
  What each identity may do, and no more.
- **Policy**
  Conditions that must also be true.

What it changes

## Protected assets reachable only by the right people.

Lock does not replace your identity tools. It makes sure being connected is never the same as being allowed.

### Fewer people. Named people.

- Only named identities can reach the asset
- Permissions match the role, not the network
- Every use and change is recorded
- Stolen logins reach less

Where it fits

## Fracture, Isolate and Lock answer different questions.

Fracture and Isolate decide whether connections exist. Lock does a different job, and most Plans use more than one module.

| Module | Fracture | Isolate | Lock |
| --- | --- | --- | --- |
| The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path? | Who may use or change this protected asset? |
| Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Locked, available only to named identities |
| When it acts | When a connection becomes dangerous | By design, before anything goes wrong | Whenever an asset is used or changed |
| What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Access granted simply by being on the network |
| Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-12, CP-06, CP-20 |

Control Plans and Blueprints

## Where Lock does the work.

Lock sits behind privileged access, assurance and multi-party Plans. Plans marked Proposed are awaiting technical approval.

- CP-12**Privileged Access Control**_Administrator access through a controlled network entry point._: https://fire-vault.com/control-plan/privileged-access-control
- CP-06**Controlled Access & Assurance**_Connect approvals and observed control states to agreed record sources, with collection and retention defined for the actions in scope._: https://fire-vault.com/control-plan/prove-compliance-through-control
- CP-20**Multi-Party Authorisation**_Two independent approvals required before a connection opens._: https://fire-vault.com/control-plan/multi-party-authorisation
- **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans)
- **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints)
- **Fracture**Physically disconnect a connection. See Fracture (https://fire-vault.com/control-module/fracture)
- **Isolate**Hold zones apart by design. See Isolate (https://fire-vault.com/control-module/isolate)

Questions

## What network and security teams ask.

Want to see it on real hardware? We will show you.

Book a Control demo: https://fire-vault.com/demo

How is Lock different from Validate?

Validate checks a request before a change. Lock defines who may use or change a protected asset at all.

How is Lock different from Fracture and Isolate?

Fracture and Isolate decide whether connections exist. Lock decides who may use the asset at the end of a connection.

Does Lock replace our access management?

No. It uses your identity sources and applies them to the assets in scope.

Are refusals recorded?

Yes, along with every use and change.

Your next step

## See a protected asset locked in front of you.

We will show who can reach one of your assets today, and who could with Lock.

Firevault home (https://fire-vault.com/)

Offline Secure Storage® and Control.

A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control.

Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited
Firevault on Facebook: https://www.facebook.com/Firevaultltd/
Firevault on YouTube: https://www.youtube.com/@Firevault-ltd

Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/

© 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://fire-vault.com/#organization",
    "name": "Firevault",
    "legalName": "Firevault Limited",
    "url": "https://fire-vault.com",
    "logo": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/logo.png",
      "width": 200,
      "height": 60
    },
    "foundingDate": "2025-03",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "address": {
      "@type": "PostalAddress",
      "addressCountry": "GB",
      "addressLocality": "United Kingdom"
    },
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "customer service",
        "email": "hello@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "email": "sales@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      }
    ],
    "founder": [
      {
        "@type": "Person",
        "name": "Mark Fermor",
        "jobTitle": "Founder, CTO and CMO"
      },
      {
        "@type": "Person",
        "name": "David Bailey",
        "jobTitle": "Founder and CEO"
      }
    ],
    "areaServed": [
      "United Kingdom",
      "Europe",
      "United States",
      "Middle East"
    ],
    "sameAs": [
      "https://www.linkedin.com/company/firevault",
      "https://x.com/firevaultuk"
    ],
    "slogan": "Disconnect to Protect",
    "brand": [
      {
        "@type": "Brand",
        "name": "Offline Secure Storage"
      },
      {
        "@type": "Brand",
        "name": "Control by Firevault"
      },
      {
        "@type": "Brand",
        "name": "Firebreak"
      }
    ],
    "knowsAbout": [
      "Offline Secure Storage",
      "Physically disconnected data storage",
      "Physical Air Gap Data Protection",
      "Ransomware Protection",
      "Ransomware recovery",
      "3-2-1-1-0 backup rule",
      "AI kill switch",
      "Operational technology security",
      "Critical national infrastructure resilience",
      "Data Sovereignty",
      "GDPR Compliance",
      "NIS2 Compliance",
      "DORA Compliance",
      "NCSC Cyber Assessment Framework"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://fire-vault.com/#website",
    "name": "Firevault",
    "alternateName": [
      "Firevault",
      "Firevault UK",
      "Firevault Limited"
    ],
    "url": "https://fire-vault.com",
    "publisher": {
      "@id": "https://fire-vault.com/#organization"
    },
    "inLanguage": "en-GB",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}"
      },
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "@id": "https://fire-vault.com/control-module/lock#webpage",
    "url": "https://fire-vault.com/control-module/lock",
    "name": "Control Lock Module: lock down access on demand",
    "description": "Lock hardens network access on demand, holding paths in a read-only or disconnected state until an authorised release. Read how the guardrails work.",
    "isPartOf": {
      "@id": "https://fire-vault.com/#website"
    },
    "about": {
      "@id": "https://fire-vault.com/#organization"
    },
    "primaryImageOfPage": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/__l5e/assets-v1/16185ad5-5940-414a-9f76-80671f146f1d/og-control-lock.webp"
    },
    "inLanguage": "en-GB",
    "breadcrumb": {
      "@id": "https://fire-vault.com/control-module/lock#breadcrumb"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "@id": "https://fire-vault.com/control-module/lock#breadcrumb",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://fire-vault.com"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Control Module",
        "item": "https://fire-vault.com/control-module"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Control Lock Module: lock down access on demand",
        "item": "https://fire-vault.com/control-module/lock"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "Organization",
        "@id": "https://fire-vault.com/#org",
        "name": "Firevault",
        "legalName": "Firevault Limited",
        "url": "https://fire-vault.com/",
        "identifier": "16320803",
        "sameAs": [
          "https://www.linkedin.com/company/firevault-limited",
          "https://www.facebook.com/Firevaultltd/",
          "https://www.youtube.com/@Firevault-ltd"
        ]
      },
      {
        "@type": "WebPage",
        "name": "FV-Lock: Access governed as one coherent layer",
        "url": "https://fire-vault.com/control-module/lock",
        "description": "Lock restricts access through identity, authority, policy, permission and operational controls. It treats those five controls as one combined layer rather than five separate ones, and that combination is where its protection comes from.",
        "publisher": {
          "@id": "https://fire-vault.com/#org"
        }
      },
      {
        "@type": "BreadcrumbList",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://fire-vault.com/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "FV-Lock",
            "item": "https://fire-vault.com/control-module/lock"
          }
        ]
      },
      {
        "@type": "FAQPage",
        "mainEntity": [
          {
            "@type": "Question",
            "name": "Is Lock a replacement for the existing identity system?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Identity is Lock’s first clause, not the whole decision. Lock reads identity alongside authority, policy, permission and operational state, and answers as one coherent layer."
            }
          },
          {
            "@type": "Question",
            "name": "What about emergency access?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Emergency break-glass is a Lock event with quorum approval, full audit and a hard expiry."
            }
          },
          {
            "@type": "Question",
            "name": "How does Lock handle service accounts?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "The same way as people: reach is granted to a named actor, for a purpose, for a window, with scope narrower than the access path can technically allow, and a recorded purpose for each grant."
            }
          },
          {
            "@type": "Question",
            "name": "Where do decisions live for review?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Every outcome and its reasons are logged through Anchor on physically separate storage, and decision patterns are reviewed on a regular schedule."
            }
          }
        ]
      }
    ]
  }
]
```