Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-17Change Window Enforcement

Proposed Control Plan. Subject to technical and publication approval.

Does an approved change still have a route after its window ends?

CP-17 Change Window Enforcement Control Plan icon

Approved changes made through a timed physical connection.

Plan
CP-17
Purpose
Change Window Enforcement
Selected connections
6
Modules
Relay · Validate · Transfer
Scope
The physical crossings listed below and their parallel members.

What is at stake

Why change window enforcement matters.

A change ticket can expire while the deployment connection remains available. A failed release can also leave target systems in a partial state.

Extended deployment accessThe deployment connection can remain available beyond the approved need.
Incomplete deploymentClosing the route can leave a deployment incomplete. Rollback remains a separate procedure.
Change ownershipName the change owner and the conditions for a connection change.
Deployment route checksCheck the observed state of the deployment connection, including parallel routes.

The problem today

Where you are IP connected today.

CP-17 reviews six IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

6IP-connected paths reviewed
6Risks to agree with owners
3Control modules applied
  1. Risk 1Release workstation to change entry gateway

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  2. Risk 2Remote release gateway to deployment network

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  3. Risk 3Privileged workstation to target management network

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  4. Risk 4Deployment controller to production target network

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  5. Risk 5Release artefact staging to deployment repository

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  6. Risk 6Release controller to remote site gateway

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

Matching industry Blueprints

What Firevault changes

What changes with this Plan.

Approved changes made through a timed physical connection.

Connection Agreed normal state Control action
Release workstation to change entry gateway Disconnected Relay limits change access; Execute closes the entry crossing.
Remote release gateway to deployment network Disconnected Validate checks release approval; Relay opens remote deployment access.
Privileged workstation to target management network Disconnected Execute closes the privileged change path.
Deployment controller to production target network Disconnected Validate checks target approval; Relay opens the deployment connection.
Release artefact staging to deployment repository Disconnected Transfer governs release artefacts; Execute closes the transfer path.
Release controller to remote site gateway Disconnected Relay opens the approved site path; Execute applies authorised closure.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Control in Action

Change Window Enforcement: see the selected path change.

Approved changes made through a timed physical connection.

Control in Action

Stage

Before agreed physical control

A change ticket can expire while the deployment connection remains available. A failed release can also leave target systems in a partial state.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Release workstation to change entry gatewayAlways connected
  • Remote release gateway to deployment networkAlways connected
  • Privileged workstation to target management networkAlways connected
  • Deployment controller to production target networkAlways connected
  • Recovery access (OSS)Not in place
  1. RERelay · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-17: supports the approved boundary and purpose in the register.

CP-17Change Window Enforcement

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Approved changes made through a timed physical connection.

Primary modules: Relay, Validate and Transfer.

Read the operational detail

Module in this plan

Relay module icon

Relay

Controls the path

Establishes connectivity only when authorised, for a defined purpose and a limited time, before removing the network path again.

Establishes connectivity only when authorised, for a defined purpose and a limited time, before removing the network path again.

Explore the Relay module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Approved changes made through a timed physical connection.

Release workstation to change entry gatewayDisconnected
Normal state
Disconnected
Authorisation
1 · Approved change window ends or change authority is withdrawn
Module action
Relay limits change access; Execute closes the entry crossing.
Business effect
New release commands cannot reach the change network.
Failure behaviour
Disconnected on fault; reconcile any change already in progress.
Remote release gateway to deployment networkDisconnected
Normal state
Disconnected
Authorisation
2 · Release owner approves the named remote deployment
Module action
Validate checks release approval; Relay opens remote deployment access.
Business effect
Remote release sessions lose access to deployment services.
Failure behaviour
Disconnected on power loss; remote release requires renewed approval.
Privileged workstation to target management networkDisconnected
Normal state
Disconnected
Authorisation
1 · Approved privileged change task completes
Module action
Execute closes the privileged change path.
Business effect
Privileged target configuration stops.
Failure behaviour
Disconnected on fault; use the approved local recovery procedure.
Deployment controller to production target networkDisconnected
Normal state
Disconnected
Authorisation
2 · Target service owner approves deployment and interruption conditions
Module action
Validate checks target approval; Relay opens the deployment connection.
Business effect
Deployment delivery stops; partially applied changes require recovery assessment.
Failure behaviour
Disconnected on power loss; assess target consistency before reconnection.
Release artefact staging to deployment repositoryDisconnected
Normal state
Disconnected
Authorisation
1 · Approved artefact delivery completes or release approval is revoked
Module action
Transfer governs release artefacts; Execute closes the transfer path.
Business effect
New artefact delivery stops; staged copies remain.
Failure behaviour
Disconnected on fault; verify artefact integrity before retrying transfer.
Release controller to remote site gatewayDisconnected
Normal state
Disconnected
Authorisation
2 · Remote site owner approves the site release
Module action
Relay opens the approved site path; Execute applies authorised closure.
Business effect
Remote site deployment stops; local site services remain separately assessed.
Failure behaviour
Disconnected on power loss; reconcile site release status before resuming.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Approved changes made through a timed physical connection. Each selected connection sits at its agreed normal state.Transfer

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Relay limits change access; Execute closes the entry crossing.RelayValidate

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Approved changes made through a timed physical connection.

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Closure does not validate the systems or data on either side. Investigate the event and obtain the named owner approval before reopening.

The operational owner authorises each reconnection.

Each check and each reconnection.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Engineering and integration

Fit the control around your existing environment.

The physical crossings listed below and their parallel members.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Closure does not validate the systems or data on either side. Investigate the event and obtain the named owner approval before reopening.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

What this addressesApproved changes made through a timed physical connection.
What it does not replaceContent inspection, cloud identity, uncontrolled routes and activity already completed.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification.

Questions worth asking

Before you rely on CP-17.

Practical questions for the people who own these connections.

Approved changes made through a timed physical connection.

The physical crossings listed below and their parallel members.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification.

Your next step

Take the next step with change window enforcement.

Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification.

Book a briefing

Prefer to talk first? Speak to the team