--- title: "CP-02 Live Incident Containment | Control by Firevault" url: https://fire-vault.com/control-plan/contain-active-breaches description: "During a live incident, the response team needs a prepared way to withdraw selected connections from an affected segment, site or service. CP-02 defines those…" lang: en-GB --- Control Plan **CP-02**Live Incident Containment # A breach is live. Which path can you disconnect without stopping everything? Image: CP-02 Live Incident Containment Control Plan icon (https://fire-vault.com/__l5e/assets-v1/744125a7-a336-4080-b3c1-90918daa5a00/CP-02_live-incident-containment.png) During a live incident, the response team needs a prepared way to withdraw selected connections from an affected segment, site or service. CP-02 defines those connections, who may authorise the action and what must keep working. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-02 Purpose Live Incident Containment Selected connections 4 Modules Fracture · Isolate · Execute · Validate Scope Selected user segments, remote access, privileged management paths and site links recorded in the connection register. What is at stake ## Why live incident containment matters. A broad shutdown can turn a local incident into an operational crisis, while waiting can leave the affected route available. The decision is easier when the boundary and its consequences are agreed before the incident. **The affected route remains available**A compromised segment may still reach core systems, management tools or backups while the response team investigates. **The response is too broad**Disconnecting a whole site or estate can stop services that were never affected. **Nobody owns the decision**Without a named incident owner and agreed thresholds, the action can be delayed or taken without understanding its impact. **Parallel routes are missed**Redundant links, wireless and cellular failover can keep a route available after the planned link is withdrawn. The problem today ## Where you are IP connected today. CP-02 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **4**IP-connected paths reviewed **4**Risks to agree with owners **4**Control modules applied 1. _Risk 1_**Affected user segment uplinks** All agreed physical uplinks between one user segment and the core network. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected for normal service 2. _Risk 2_**Remote access inside interface** The connection from the remote access service into internal networks. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected for approved users 3. _Risk 3_**Privileged management path** Administrator access from approved workstations to server, storage and network management. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved windows 4. _Risk 4_**Site to site link** Selected links between offices, sites or plants, including agreed failover routes. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected for normal service Matching industry Blueprints BP-02 · energy (https://fire-vault.com/control-blueprint/energy)BP-07 · banking (https://fire-vault.com/control-blueprint/banking) What Firevault changes ## What changes with this Plan. Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Affected user segment uplinks | Connected for normal service | Validate checks the rule or authority. Execute initiates the action. Isolate groups the uplinks and Fracture withdraws them. | | Remote access inside interface | Connected for approved users | Validate checks authority. Execute initiates the action. Fracture withdraws the inside connection. | | Privileged management path | Disconnected outside approved windows | Validate checks the request. Execute opens or closes the path. Fracture withdraws it at the end of the window. | | Site to site link | Connected for normal service | Validate checks authority. Execute initiates the action. Isolate groups agreed links and Fracture withdraws them. | CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures. Control in Action ## Live Incident Containment: see the selected path change. Control in Action Stage Before agreed physical control A broad shutdown can turn a local incident into an operational crisis, while waiting can leave the affected route available. The decision is easier when the boundary and its consequences are agreed before the incident.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Affected user segment uplinks _Always connected_ - Remote access inside interface _Always connected_ - Privileged management path _Always connected_ - Site to site link _Always connected_ - Recovery access (OSS) _Not in place_ 1. _FB_**Fracture** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. Confirms that the request comes from an authorised incident owner or an agreed high-confidence response rule. Initiates the approved action on the designated connection. Physically withdraws the selected connection. Treats the defined uplinks for a segment, site or zone as one controlled boundary. ### CP-02Live Incident Containment Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow. Primary modules: Fracture, Isolate, Execute and Validate. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-02 **CP-01****Ransomware Containment**Cut the paths ransomware uses to spread before encryption reaches critical systems. _Open CP-01_: https://fire-vault.com/control-plan/stop-kill-chain-ransomware **CP-03****Third-Party Access Control**Supplier and vendor paths that exist only for approved work, in a defined window. _Open CP-03_: https://fire-vault.com/control-plan/control-third-party-access **CP-04****Physical Network Segmentation**Zones separated at Layer 1, so a boundary holds even when software controls are compromised. _Open CP-04_: https://fire-vault.com/control-plan/enforce-physical-segmentation See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Affected user segment uplinksAll agreed physical uplinks between one user segment and the core network._Connected for normal service_ Normal state Connected for normal service Authorisation Tier 1: a high-confidence alert matching an agreed rule, or Tier 2: incident owner authorisation Module action Validate checks the rule or authority. Execute initiates the action. Isolate groups the uplinks and Fracture withdraws them. Business effect Devices on that segment lose the selected network access. Confirm telephony, wireless and shared service dependencies before approval. Failure behaviour Behaviour agreed and tested for loss of power or command route. Remote access inside interfaceThe connection from the remote access service into internal networks._Connected for approved users_ Normal state Connected for approved users Authorisation Tier 2: incident owner authorisation when session revocation is insufficient Module action Validate checks authority. Execute initiates the action. Fracture withdraws the inside connection. Business effect Remote users using this route are disconnected until reconnection is approved. Failure behaviour Privileged management pathAdministrator access from approved workstations to server, storage and network management._Disconnected outside approved windows_ Normal state Disconnected outside approved windows Authorisation Approved work opens the path. An active incident keeps it closed unless the incident owner approves recovery work. Module action Validate checks the request. Execute opens or closes the path. Fracture withdraws it at the end of the window. Business effect Administrators use approved windows rather than a standing route. Failure behaviour Remains disconnected unless an agreed recovery procedure is followed. Site to site linkSelected links between offices, sites or plants, including agreed failover routes._Connected for normal service_ Normal state Connected for normal service Authorisation Tier 2: incident owner authorisation when activity involves more than one site Module action Validate checks authority. Execute initiates the action. Isolate groups agreed links and Fracture withdraws them. Business effect Shared services between sites pause. Each site continues only where local operation has been designed and tested. Failure behaviour Behaviour agreed with site operations and tested. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow. Each selected connection sits at its agreed normal state. Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Validate checks the rule or authority. Execute initiates the action. Isolate groups the uplinks and Fracture withdraws them.Validate The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow.Fracture Isolate Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Confirm the observed connection state, complete the agreed security and operational checks, then reconnect one approved route at a time. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Withdraw selected connections from an affected area on an authorised decision, while keeping unaffected services available where their dependencies allow. **What it does not replace**CP-02 does not detect incidents, remove malware, recover systems or control activity that never crosses a registered connection. Cloud identity, SaaS and independent cellular devices need their own response measures. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Choose one segment or site link, name the incident owner and agree which dependencies must be checked before it is disconnected. Questions worth asking ## Before you rely on CP-02. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with live incident containment. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/contain-active-breaches#webpage", "url": "https://fire-vault.com/control-plan/contain-active-breaches", "name": "CP-02 Live Incident Containment", "description": "During a live incident, the response team needs a prepared way to withdraw selected connections from an affected segment, site or service. CP-02 defines those…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/contain-active-breaches#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/contain-active-breaches#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-02 Live Incident Containment", "item": "https://fire-vault.com/control-plan/contain-active-breaches" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-02 Live Incident Containment", "description": "During a live incident, the response team needs a prepared way to withdraw selected connections from an affected segment, site or service. CP-02 defines those connections, who may authorise the action and what must keep working.", "url": "https://fire-vault.com/control-plan/contain-active-breaches" } ] ```