--- title: "CP-14 Compromised Device Isolation | Control by Firevault" url: https://fire-vault.com/control-plan/compromised-device-isolation description: "Physically isolate one affected device from the network." lang: en-GB --- Control Plan **CP-14**Compromised Device Isolation Proposed Control Plan. Subject to technical and publication approval. # One affected device. A defined physical boundary. Image: CP-14 Compromised Device Isolation Control Plan icon (https://fire-vault.com/__l5e/assets-v1/aadc8067-095b-4a19-ab1b-73d917838bc8/CP-14_compromised-device-isolation.png) Physically isolate one affected device from the network. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-14 Purpose Compromised Device Isolation Selected connections 6 Modules Fracture · Isolate · Execute · Validate · Unlink · Lock Scope One identified endpoint or appliance and its mapped physical connections. Segment-wide effects require explicit approval. What is at stake ## Why compromised device isolation matters. A compromised endpoint can retain network reach while responders investigate. **Persistent device connectivity**The device network connections can remain available beyond the approved need. **Device service loss**The device loses the services carried by those connections. Other routes need separate treatment. **Incident ownership**Name the incident owner and the conditions for a connection change. **Device connection checks**Check the observed state of the device network connections, including parallel routes. The problem today ## Where you are IP connected today. CP-14 reviews six IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **6**IP-connected paths reviewed **6**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**Device primary Ethernet interface to access switch** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 2. _Risk 2_**Device secondary Ethernet interface to network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 3. _Risk 3_**Admin gateway to device management interface** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 4. _Risk 4_**Shared device gateway to business service network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 5. _Risk 5_**Responder staging network to evidence workstation** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 6. _Risk 6_**Device dock Ethernet interface to access switch** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected Matching industry Blueprints BP-08 · healthcare (https://fire-vault.com/control-blueprint/healthcare) What Firevault changes ## What changes with this Plan. Physically isolate one affected device from the network at its identified boundaries. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Device primary Ethernet interface to access switch | Connected | Fracture withdraws the affected device connection. | | Device secondary Ethernet interface to network | Connected | Isolate operates the registered device interfaces as one group. | | Admin gateway to device management interface | Disconnected | Execute closes the device management connection. | | Shared device gateway to business service network | Connected | Fracture withdraws the shared device service boundary. | | Responder staging network to evidence workstation | Disconnected | Transfer governs responder artefacts; Execute closes the evidence crossing. | | Device dock Ethernet interface to access switch | Connected | Isolate withdraws the dock path with other registered device conduits. | Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed. Control in Action ## Compromised Device Isolation: see the selected path change. Control in Action Stage Before agreed physical control A compromised endpoint can retain network reach while responders investigate.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Device primary Ethernet interface to access switch _Always connected_ - Device secondary Ethernet interface to network _Always connected_ - Admin gateway to device management interface _Always connected_ - Shared device gateway to business service network _Always connected_ - Recovery access (OSS) _Not in place_ 1. _FB_**Fracture** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-14: withdraws the identified device crossing. In CP-14: groups the affected device boundaries where the design requires it. In CP-14: applies the approved device containment or return action. ### CP-14Compromised Device Isolation Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Physically isolate one affected device from the network at its identified boundaries. Primary modules: Fracture, Isolate, Execute, Validate, Unlink and Lock. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-14 **CP-13 · Proposed****Maintenance Window Control**Connections that exist only for a scheduled maintenance window. _Open CP-13_: https://fire-vault.com/control-plan/maintenance-window-control **CP-15 · Proposed****Operational Technology Protection**Industrial controllers behind a physical network boundary. _Open CP-15_: https://fire-vault.com/control-plan/operational-technology-protection **CP-12 · Proposed****Privileged Access Control**Administrator access through a controlled network entry point. _Open CP-12_: https://fire-vault.com/control-plan/privileged-access-control See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Device primary Ethernet interface to access switch_Connected_ Normal state Connected Authorisation 1 · Approved endpoint alert identifies this device as compromised Module action Fracture withdraws the affected device connection. Business effect Device access to shared applications and network storage stops. Failure behaviour Disconnected on fault; the device remains without its primary network path. Device secondary Ethernet interface to network_Connected_ Normal state Connected Authorisation 1 · The same validated device alert requires all wired paths withdrawn Module action Isolate operates the registered device interfaces as one group. Business effect Secondary wired access stops, preventing this route from retaining connectivity. Failure behaviour Disconnected on power loss; verify secondary port state independently. Admin gateway to device management interface_Disconnected_ Normal state Disconnected Authorisation 1 · Device compromise alert invalidates the approved management session Module action Execute closes the device management connection. Business effect Remote administration stops; local responder access remains separately scoped. Failure behaviour Disconnected on fault; use the approved local response procedure. Shared device gateway to business service network_Connected_ Normal state Connected Authorisation 2 · Incident owner accepts shared service impact after device compromise Module action Fracture withdraws the shared device service boundary. Business effect All users lose the shared device service, not just the affected session. Failure behaviour Designed to stay connected on fault; shared service availability leaves residual exposure. Responder staging network to evidence workstation_Disconnected_ Normal state Disconnected Authorisation 1 · Approved evidence collection completes or collection authority is withdrawn Module action Transfer governs responder artefacts; Execute closes the evidence crossing. Business effect Remote evidence collection stops; already collected artefacts remain. Failure behaviour Disconnected on fault; verify evidence completeness before resuming collection. Device dock Ethernet interface to access switch_Connected_ Normal state Connected Authorisation 1 · Validated device alert includes the registered dock interface Module action Isolate withdraws the dock path with other registered device conduits. Business effect Dock network services stop; unrelated dock peripherals are outside scope. Failure behaviour Disconnected on power loss; check other adapters before declaring isolation. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Physically isolate one affected device from the network at its identified boundaries. Each selected connection sits at its agreed normal state. Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Fracture withdraws the affected device connection.Validate Unlink Lock The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Physically isolate one affected device from the network at its identified boundaries.Fracture Isolate Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** A physical boundary does not prove task completion or device remediation. Apply the agreed evidence and owner checks. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Physically isolate one affected device from the network at its identified boundaries. **What it does not replace**Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions. Questions worth asking ## Before you rely on CP-14. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with compromised device isolation. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/compromised-device-isolation#webpage", "url": "https://fire-vault.com/control-plan/compromised-device-isolation", "name": "CP-14 Compromised Device Isolation", "description": "Physically isolate one affected device from the network.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/compromised-device-isolation#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/compromised-device-isolation#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-14 Compromised Device Isolation", "item": "https://fire-vault.com/control-plan/compromised-device-isolation" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-14 Compromised Device Isolation", "description": "Physically isolate one affected device from the network.", "url": "https://fire-vault.com/control-plan/compromised-device-isolation" } ] ```