Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-02Live Incident Containment

A breach is live. Which path can you disconnect without stopping everything?

CP-02 Live Incident Containment Control Plan icon

During a live incident, the response team needs a prepared way to withdraw selected connections from an affected segment, site or service. CP-02 defines those connections, who may authorise the action and what must keep working.

Plan
CP-02
Purpose
Live Incident Containment
Selected connections
4
Modules
Fracture · Isolate · Execute · Validate
Scope
Selected user segments, remote access, privileged management paths and site links recorded in the connection register.

What is at stake

Why live incident containment matters.

A broad shutdown can turn a local incident into an operational crisis, while waiting can leave the affected route available. The decision is easier when the boundary and its consequences are agreed before the incident.

The affected route remains availableA compromised segment may still reach core systems, management tools or backups while the response team investigates.
The response is too broadDisconnecting a whole site or estate can stop services that were never affected.
Nobody owns the decisionWithout a named incident owner and agreed thresholds, the action can be delayed or taken without understanding its impact.
Parallel routes are missedRedundant links, wireless and cellular failover can keep a route available after the planned link is withdrawn.

The problem today

Where you are IP connected today.

CP-02 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

4IP-connected paths reviewed
4Risks to agree with owners
4Control modules applied
  1. Risk 1Affected user segment uplinks

    All agreed physical uplinks between one user segment and the core network.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected for normal service

  2. Risk 2Remote access inside interface

    The connection from the remote access service into internal networks.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected for approved users

  3. Risk 3Privileged management path

    Administrator access from approved workstations to server, storage and network management.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected outside approved windows

  4. Risk 4Site to site link

    Selected links between offices, sites or plants, including agreed failover routes.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected for normal service

Matching industry Blueprints

BP-02 · energyBP-07 · banking

What Firevault changes

What changes with this Plan.

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.

Connection Agreed normal state Control action
Affected user segment uplinks Connected for normal service Validate checks the rule or authority. Execute initiates the action. Isolate groups the uplinks and Fracture withdraws them.
Remote access inside interface Connected for approved users Validate checks authority. Execute initiates the action. Fracture withdraws the inside connection.
Privileged management path Disconnected outside approved windows Validate checks the request. Execute opens or closes the path. Fracture withdraws it at the end of the window.
Site to site link Connected for normal service Validate checks authority. Execute initiates the action. Isolate groups agreed links and Fracture withdraws them.

CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures.

Control in Action

Live Incident Containment: see the selected path change.

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.

Control in Action

Stage

Before agreed physical control

A broad shutdown can turn a local incident into an operational crisis, while waiting can leave the affected route available. The decision is easier when the boundary and its consequences are agreed before the incident.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Affected user segment uplinksAlways connected
  • Remote access inside interfaceAlways connected
  • Privileged management pathAlways connected
  • Site to site linkAlways connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

Confirms that the request comes from an authorised incident owner or an agreed high-confidence response rule. Initiates the approved action on the designated connection. Physically withdraws the selected connection. Treats the defined uplinks for a segment, site or zone as one controlled boundary.

CP-02Live Incident Containment

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.

Primary modules: Fracture, Isolate, Execute and Validate.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.

Affected user segment uplinksAll agreed physical uplinks between one user segment and the core network.Connected for normal service
Normal state
Connected for normal service
Authorisation
Tier 1: a high-confidence alert matching an agreed rule, or Tier 2: incident owner authorisation
Module action
Validate checks the rule or authority. Execute initiates the action. Isolate groups the uplinks and Fracture withdraws them.
Business effect
Devices on that segment lose the selected network access. Confirm telephony, wireless and shared service dependencies before approval.
Failure behaviour
Behaviour agreed and tested for loss of power or command route.
Remote access inside interfaceThe connection from the remote access service into internal networks.Connected for approved users
Normal state
Connected for approved users
Authorisation
Tier 2: incident owner authorisation when session revocation is insufficient
Module action
Validate checks authority. Execute initiates the action. Fracture withdraws the inside connection.
Business effect
Remote users using this route are disconnected until reconnection is approved.
Failure behaviour
Behaviour agreed and tested for loss of power or command route.
Privileged management pathAdministrator access from approved workstations to server, storage and network management.Disconnected outside approved windows
Normal state
Disconnected outside approved windows
Authorisation
Approved work opens the path. An active incident keeps it closed unless the incident owner approves recovery work.
Module action
Validate checks the request. Execute opens or closes the path. Fracture withdraws it at the end of the window.
Business effect
Administrators use approved windows rather than a standing route.
Failure behaviour
Remains disconnected unless an agreed recovery procedure is followed.
Site to site linkSelected links between offices, sites or plants, including agreed failover routes.Connected for normal service
Normal state
Connected for normal service
Authorisation
Tier 2: incident owner authorisation when activity involves more than one site
Module action
Validate checks authority. Execute initiates the action. Isolate groups agreed links and Fracture withdraws them.
Business effect
Shared services between sites pause. Each site continues only where local operation has been designed and tested.
Failure behaviour
Behaviour agreed with site operations and tested.

CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks the rule or authority. Execute initiates the action. Isolate groups the uplinks and Fracture withdraws them.Validate

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Confirm the observed connection state, complete the agreed security and operational checks, then reconnect one approved route at a time.

The operational owner authorises each reconnection.

Each check and each reconnection.

CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures.

Engineering and integration

Fit the control around your existing environment.

Selected user segments, remote access, privileged management paths and site links recorded in the connection register.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Confirm the observed connection state, complete the agreed security and operational checks, then reconnect one approved route at a time.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures.

What this addressesWithdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.
What it does not replaceCP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Choose one segment or site link, name the incident owner and agree which dependencies must be checked before it is disconnected.

Questions worth asking

Before you rely on CP-02.

Practical questions for the people who own these connections.

Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.

Selected user segments, remote access, privileged management paths and site links recorded in the connection register.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Choose one segment or site link, name the incident owner and agree which dependencies must be checked before it is disconnected.

Your next step

Take the next step with live incident containment.

Choose one segment or site link, name the incident owner and agree which dependencies must be checked before it is disconnected.

Book a briefing

Prefer to talk first? Speak to the team