Control PlanCP-03Third-Party Access Control

The supplier finished on Tuesday. Their connection is still open on Friday.

CP-03 Third-Party Access Control Control Plan icon

CP-03 gives suppliers a defined route for approved work, then physically withdraws that route when the work window ends or the sponsor withdraws approval.

Book a briefing See Control in Action

Plan: CP-03
Purpose: Third-Party Access Control
Selected connections: 4
Modules: Validate · Relay · Lock · Execute · Fracture
Scope: Supplier gateways, access broker connections and discovered secondary supplier routes recorded in the register.

What is at stake

Why third-party access control matters.

Nobody leaves supplier access open on purpose. The engineer finishes, the ticket closes and the remote connection remains ready for the next visit.

Standing supplier accessA support route can remain available long after the approved job has finished.

Too much reachA supplier needing one system may be able to reach far more of the environment.

Unclear sponsorshipWithout a named internal sponsor, it is hard to show why access existed and who approved it.

Overlooked routesSupplier modems, cellular routers or alternate VPNs can bypass the controlled route.

The problem today

Where you are IP connected today.

CP-03 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

4IP-connected paths reviewed

4Risks to agree with owners

5Control modules applied

Risk 1Supplier access gateway
The route from the supplier access service to the approved access broker.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected outside approved windows
Risk 2Access broker to approved target
The selected connection from the access broker to the system covered by the job.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected outside approved windows
Risk 3Urgent support route
A pre-agreed route for urgent support with a named approver.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected by default
Risk 4Supplier secondary route
Any modem, cellular router or alternate connection discovered during assessment.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected or removed after review

Matching industry Blueprints

BP-01 · utilities water BP-02 · energy BP-03 · oil and gas BP-04 · rail BP-05 · aviation BP-06 · telecommunications BP-07 · banking BP-08 · healthcare BP-10 · colocations BP-11 · maritime BP-12 · motorsport BP-13 · construction BP-15 · education BP-16 · public sector BP-17 · retail BP-18 · utilities BP-19 · utilities gas BP-20 · utilities renewables

What Firevault changes

What changes with this Plan.

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.

Connection	Agreed normal state	Control action
Supplier access gateway	Disconnected outside approved windows	Validate checks the booking. Relay opens the window. Execute closes it and Fracture withdraws the route.
Access broker to approved target	Disconnected outside approved windows	Validate checks the target. Lock restricts the session through supporting controls. Relay opens the selected connection.
Urgent support route	Disconnected by default	Validate checks both approvals. Relay opens a short window. Execute closes it.
Supplier secondary route	Disconnected or removed after review	Fracture withdraws the selected physical route where it is placed under Control.

CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools.

Control in Action

Third-Party Access Control: see the selected path change.

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.

Control in Action

Stage

Before agreed physical control

Nobody leaves supplier access open on purpose. The engineer finishes, the ticket closes and the remote connection remains ready for the next visit.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack

10still running

Physical crossings

Supplier access gatewayAlways connected
Access broker to approved targetAlways connected
Urgent support routeAlways connected
Supplier secondary routeAlways connected
Recovery access (OSS)Not in place

VAValidate · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

Checks the supplier, sponsor, purpose and approved window before access is opened. Provides the time-bound connection for the approved job. Keeps access restricted to the named supplier identities and approved target, using supporting access controls. Initiates opening and closing actions from the approved schedule or sponsor decision. Physically withdraws the supplier connection when the window ends or approval is withdrawn.

CP-03Third-Party Access Control

Z0Requesting environment

Z1Protected systems

Z2Related operations

Held in Offline Secure Storage®Selected recovery material, held separately

Out-of-band command path

This Control Plan

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.

Primary modules: Fracture, Relay, Execute, Validate and Lock.

Read the operational detail

Module in this plan

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-03

CP-02Live Incident ContainmentPhysically disconnect the affected path during a live incident while the rest of the operation keeps running.Open CP-02

CP-04Physical Network SegmentationZones separated at Layer 1, so a boundary holds even when software controls are compromised.Open CP-04

CP-01Ransomware ContainmentCut the paths ransomware uses to spread before encryption reaches critical systems.Open CP-01

See all Control Plans How Control works

As featured in

The Control Plan specification

Each selected connection, written down.

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.

Supplier access gatewayThe route from the supplier access service to the approved access broker.Disconnected outside approved windows

Normal state: Disconnected outside approved windows
Authorisation: Approved booking with a named supplier and internal sponsor
Module action: Validate checks the booking. Relay opens the window. Execute closes it and Fracture withdraws the route.
Business effect: Supplier access is available only during the approved window.
Failure behaviour: Remains disconnected unless an approved recovery procedure is followed.

Access broker to approved targetThe selected connection from the access broker to the system covered by the job.Disconnected outside approved windows

Normal state: Disconnected outside approved windows
Authorisation: Sponsor approval for the named target and purpose
Module action: Validate checks the target. Lock restricts the session through supporting controls. Relay opens the selected connection.
Business effect: The supplier reaches the approved target, not every system behind the broker.
Failure behaviour: Remains disconnected unless an approved recovery procedure is followed.

Urgent support routeA pre-agreed route for urgent support with a named approver.Disconnected by default

Normal state: Disconnected by default
Authorisation: Urgent approval from the sponsor and service owner
Module action: Validate checks both approvals. Relay opens a short window. Execute closes it.
Business effect: Urgent support remains possible without leaving the route permanently available.
Failure behaviour: Use the documented alternative support procedure.

Supplier secondary routeAny modem, cellular router or alternate connection discovered during assessment.Disconnected or removed after review

Normal state: Disconnected or removed after review
Authorisation: Assessment confirms that the route is not operationally required
Module action: Fracture withdraws the selected physical route where it is placed under Control.
Business effect: Reduces bypass routes. Routes outside the controlled hardware need separate action.
Failure behaviour: Confirm with the operational owner before implementation.

CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record

1Normal operationAgreed states held

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks the booking. Relay opens the window. Execute closes it and Fracture withdraws the route.ValidateRelayLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.Fracture

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

If a session is suspected, withdraw the supplier route, confirm its observed state and review the supporting session records before approving another window.

The operational owner authorises each reconnection.

Each check and each reconnection.

CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools.

Engineering and integration

Fit the control around your existing environment.

Supplier gateways, access broker connections and discovered secondary supplier routes recorded in the register.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.

Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.

Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.

Controlled changeVerify approved opening, closure and the operational impact.

Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

If a session is suspected, withdraw the supplier route, confirm its observed state and review the supporting session records before approving another window.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools.

What this addressesSupplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.

What it does not replaceCP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools.

Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Start with one supplier route. Name its sponsor, approved target and normal working window.

Questions worth asking

Before you rely on CP-03.

Practical questions for the people who own these connections.

Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.

Supplier gateways, access broker connections and discovered secondary supplier routes recorded in the register.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools.

Start with one supplier route. Name its sponsor, approved target and normal working window.

Your next step

Take the next step with third-party access control.

Start with one supplier route. Name its sponsor, approved target and normal working window.

Book a briefing

Prefer to talk first? Speak to the team

Book a briefing Speak to the team