Control Modules
Nine modules. Two families.
Every Control Plan and Control Blueprint is built from the same nine modules. FIRE modules act on the network path; VAULT modules govern the assets behind it.
How we got here
We started by taking one copy of your data offline. Then we did the same for connections.
Offline Secure Storage® keeps an important copy of your data physically disconnected, so an attacker on your network cannot reach it. Customers kept asking the same question: what about the systems that cannot simply go offline?
Control by Firevault is the answer. Instead of disconnecting everything, it controls each connection into your critical systems: on for approved work, off when it is not needed, and cut when something goes wrong. We broke that down into three layers.
- Step 1 · You are hereModulesNine building blocks. Each does one job, such as opening a connection for a set time or physically cutting it.Relay opens a supplier route for the approved job only.
Step 2PlansModules combined to answer one risk you recognise, such as ransomware or supplier access.CP-03 uses Relay, Validate and Execute to close supplier access when the job ends.
Step 3BlueprintsThe Plans an industry needs, applied to the systems that industry actually runs.BP-01 Water applies the right Plans to treatment sites, pumping stations and telemetry.
Offline Secure Storage® stays a separate product: Control manages connections, OSS® protects stored copies.
Why it matters to you
Every connection you cannot switch off is one you have to trust.
Your network has more ways in than you think
Supplier links, remote support, cloud services and connected equipment. Most stay on all the time.
Software can be talked round
Passwords, firewall rules and permissions all stay in place while a connection exists. A stolen login can still use them.
A physical gap cannot
When a module removes the connection, there is no route left to misuse. That is the one thing every module builds on.
FIRE modules act on the path
Opening, closing and cutting connections.
FV-FracturePhysically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.
FV-IsolateSeparates networks and critical systems into controlled zones, limiting exposure and preventing threats from moving freely between them.
FV-RelayEstablishes connectivity only when authorised, for a defined purpose and a limited time, before removing the network path again.
FV-ExecuteActivates defined control actions in response to approved commands, security events, scheduled operations or emergency intervention.VAULT modules govern what sits behind it
Identity, authority, boundaries and protected assets.
FV-ValidateVerifies identity, authority and purpose before access, actions or the movement of protected assets are permitted.
FV-AnchorKeep critical assets within defined physical connection boundaries.
FV-UnlinkRemoves persistent connections and dependencies that leave critical data and valuable assets unnecessarily exposed.
FV-LockRestricts access to protected assets through defined identities, permissions and policies, preventing unauthorised use or modification.
FV-TransferControls the movement of sensitive data and digital assets between environments through authorised, governed transfer paths.Fracture is the module. Firebreak® is the hardware.
Fracture is the Control module that physically cuts a path. Firebreak® is the hardware switch, supplied by Firevault within Control, that carries out the cut. Applied to AI systems, it is the AI Kill Switch.
Talk to us about your estate
We map the paths into your critical systems and show you which Plan or Blueprint fits.
Book a briefing