--- title: "CP-17 Change Window Enforcement | Control by Firevault" url: https://fire-vault.com/control-plan/change-window-enforcement description: "Approved changes made through a timed physical connection." lang: en-GB --- Control Plan **CP-17**Change Window Enforcement Proposed Control Plan. Subject to technical and publication approval. # Does an approved change still have a route after its window ends? Image: CP-17 Change Window Enforcement Control Plan icon (https://fire-vault.com/__l5e/assets-v1/b21fcbf4-6f2d-4ce1-a839-0eb67273689b/CP-17_change-window-enforcement.png) Approved changes made through a timed physical connection. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-17 Purpose Change Window Enforcement Selected connections 6 Modules Relay · Validate · Transfer Scope The physical crossings listed below and their parallel members. What is at stake ## Why change window enforcement matters. A change ticket can expire while the deployment connection remains available. A failed release can also leave target systems in a partial state. **Extended deployment access**The deployment connection can remain available beyond the approved need. **Incomplete deployment**Closing the route can leave a deployment incomplete. Rollback remains a separate procedure. **Change ownership**Name the change owner and the conditions for a connection change. **Deployment route checks**Check the observed state of the deployment connection, including parallel routes. The problem today ## Where you are IP connected today. CP-17 reviews six IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **6**IP-connected paths reviewed **6**Risks to agree with owners **3**Control modules applied 1. _Risk 1_**Release workstation to change entry gateway** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 2. _Risk 2_**Remote release gateway to deployment network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 3. _Risk 3_**Privileged workstation to target management network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 4. _Risk 4_**Deployment controller to production target network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 5. _Risk 5_**Release artefact staging to deployment repository** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 6. _Risk 6_**Release controller to remote site gateway** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected Matching industry Blueprints What Firevault changes ## What changes with this Plan. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Release workstation to change entry gateway | Disconnected | Relay limits change access; Execute closes the entry crossing. | | Remote release gateway to deployment network | Disconnected | Validate checks release approval; Relay opens remote deployment access. | | Privileged workstation to target management network | Disconnected | Execute closes the privileged change path. | | Deployment controller to production target network | Disconnected | Validate checks target approval; Relay opens the deployment connection. | | Release artefact staging to deployment repository | Disconnected | Transfer governs release artefacts; Execute closes the transfer path. | | Release controller to remote site gateway | Disconnected | Relay opens the approved site path; Execute applies authorised closure. | Content inspection, cloud identity, uncontrolled routes and activity already completed. Control in Action ## Change Window Enforcement: see the selected path change. Control in Action Stage Before agreed physical control A change ticket can expire while the deployment connection remains available. A failed release can also leave target systems in a partial state.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Release workstation to change entry gateway _Always connected_ - Remote release gateway to deployment network _Always connected_ - Privileged workstation to target management network _Always connected_ - Deployment controller to production target network _Always connected_ - Recovery access (OSS) _Not in place_ 1. _RE_**Relay** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-17: supports the approved boundary and purpose in the register. ### CP-17Change Window Enforcement Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Approved changes made through a timed physical connection. Primary modules: Relay, Validate and Transfer. Read the operational detail Module in this plan Image: Relay module icon (https://fire-vault.com/__l5e/assets-v1/bc644d30-1db5-42e6-b88a-647a62245447/relay-icon.png) #### Relay Controls the path Establishes connectivity only when authorised, for a defined purpose and a limited time, before removing the network path again. Explore the Relay module (https://fire-vault.com/control/modules/relay) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-17 **CP-16 · Proposed****Remote Site Isolation**Disconnect the communications link to a remote facility. _Open CP-16_: https://fire-vault.com/control-plan/remote-site-isolation **CP-18 · Proposed****Data Exfiltration Interruption**Interrupt outbound paths at a physical boundary. _Open CP-18_: https://fire-vault.com/control-plan/data-exfiltration-interruption **CP-15 · Proposed****Operational Technology Protection**Industrial controllers behind a physical network boundary. _Open CP-15_: https://fire-vault.com/control-plan/operational-technology-protection See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Release workstation to change entry gateway_Disconnected_ Normal state Disconnected Authorisation 1 · Approved change window ends or change authority is withdrawn Module action Relay limits change access; Execute closes the entry crossing. Business effect New release commands cannot reach the change network. Failure behaviour Disconnected on fault; reconcile any change already in progress. Remote release gateway to deployment network_Disconnected_ Normal state Disconnected Authorisation 2 · Release owner approves the named remote deployment Module action Validate checks release approval; Relay opens remote deployment access. Business effect Remote release sessions lose access to deployment services. Failure behaviour Disconnected on power loss; remote release requires renewed approval. Privileged workstation to target management network_Disconnected_ Normal state Disconnected Authorisation 1 · Approved privileged change task completes Module action Execute closes the privileged change path. Business effect Privileged target configuration stops. Failure behaviour Disconnected on fault; use the approved local recovery procedure. Deployment controller to production target network_Disconnected_ Normal state Disconnected Authorisation 2 · Target service owner approves deployment and interruption conditions Module action Validate checks target approval; Relay opens the deployment connection. Business effect Deployment delivery stops; partially applied changes require recovery assessment. Failure behaviour Disconnected on power loss; assess target consistency before reconnection. Release artefact staging to deployment repository_Disconnected_ Normal state Disconnected Authorisation 1 · Approved artefact delivery completes or release approval is revoked Module action Transfer governs release artefacts; Execute closes the transfer path. Business effect New artefact delivery stops; staged copies remain. Failure behaviour Disconnected on fault; verify artefact integrity before retrying transfer. Release controller to remote site gateway_Disconnected_ Normal state Disconnected Authorisation 2 · Remote site owner approves the site release Module action Relay opens the approved site path; Execute applies authorised closure. Business effect Remote site deployment stops; local site services remain separately assessed. Failure behaviour Disconnected on power loss; reconcile site release status before resuming. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Approved changes made through a timed physical connection. Each selected connection sits at its agreed normal state.Transfer Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Relay limits change access; Execute closes the entry crossing.Relay Validate The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack. Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Closure does not validate the systems or data on either side. Investigate the event and obtain the named owner approval before reopening. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Approved changes made through a timed physical connection. **What it does not replace**Content inspection, cloud identity, uncontrolled routes and activity already completed. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification. Questions worth asking ## Before you rely on CP-17. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with change window enforcement. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/change-window-enforcement#webpage", "url": "https://fire-vault.com/control-plan/change-window-enforcement", "name": "CP-17 Change Window Enforcement", "description": "Approved changes made through a timed physical connection.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/change-window-enforcement#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/change-window-enforcement#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-17 Change Window Enforcement", "item": "https://fire-vault.com/control-plan/change-window-enforcement" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-17 Change Window Enforcement", "description": "Approved changes made through a timed physical connection.", "url": "https://fire-vault.com/control-plan/change-window-enforcement" } ] ```