--- title: "CP-03 Third-Party Access Control | Control by Firevault" url: https://fire-vault.com/control-plan/control-third-party-access description: "CP-03 gives suppliers a defined route for approved work, then physically withdraws that route when the work window ends or the sponsor withdraws approval." lang: en-GB --- Control Plan **CP-03**Third-Party Access Control # The supplier finished on Tuesday. Their connection is still open on Friday. Image: CP-03 Third-Party Access Control Control Plan icon (https://fire-vault.com/__l5e/assets-v1/70ec8e2f-238e-4a06-918b-afb30b4d09a1/CP-03_third-party-access-control.png) CP-03 gives suppliers a defined route for approved work, then physically withdraws that route when the work window ends or the sponsor withdraws approval. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-03 Purpose Third-Party Access Control Selected connections 4 Modules Validate · Relay · Lock · Execute · Fracture Scope Supplier gateways, access broker connections and discovered secondary supplier routes recorded in the register. What is at stake ## Why third-party access control matters. Nobody leaves supplier access open on purpose. The engineer finishes, the ticket closes and the remote connection remains ready for the next visit. **Standing supplier access**A support route can remain available long after the approved job has finished. **Too much reach**A supplier needing one system may be able to reach far more of the environment. **Unclear sponsorship**Without a named internal sponsor, it is hard to show why access existed and who approved it. **Overlooked routes**Supplier modems, cellular routers or alternate VPNs can bypass the controlled route. The problem today ## Where you are IP connected today. CP-03 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **4**IP-connected paths reviewed **4**Risks to agree with owners **5**Control modules applied 1. _Risk 1_**Supplier access gateway** The route from the supplier access service to the approved access broker. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved windows 2. _Risk 2_**Access broker to approved target** The selected connection from the access broker to the system covered by the job. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved windows 3. _Risk 3_**Urgent support route** A pre-agreed route for urgent support with a named approver. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 4. _Risk 4_**Supplier secondary route** Any modem, cellular router or alternate connection discovered during assessment. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected or removed after review Matching industry Blueprints BP-01 · utilities water (https://fire-vault.com/control-blueprint/utilities-water)BP-02 · energy (https://fire-vault.com/control-blueprint/energy)BP-03 · oil and gas (https://fire-vault.com/control-blueprint/oil-and-gas)BP-04 · rail (https://fire-vault.com/control-blueprint/rail)BP-05 · aviation (https://fire-vault.com/control-blueprint/aviation)BP-06 · telecommunications (https://fire-vault.com/control-blueprint/telecommunications)BP-07 · banking (https://fire-vault.com/control-blueprint/banking)BP-08 · healthcare (https://fire-vault.com/control-blueprint/healthcare)BP-10 · colocations (https://fire-vault.com/control-blueprint/colocations)BP-11 · maritime (https://fire-vault.com/control-blueprint/maritime)BP-12 · motorsport (https://fire-vault.com/control-blueprint/motorsport)BP-13 · construction (https://fire-vault.com/control-blueprint/construction)BP-15 · education (https://fire-vault.com/control-blueprint/education)BP-16 · public sector (https://fire-vault.com/control-blueprint/public-sector)BP-17 · retail (https://fire-vault.com/control-blueprint/retail)BP-18 · utilities (https://fire-vault.com/control-blueprint/utilities)BP-19 · utilities gas (https://fire-vault.com/control-blueprint/utilities-gas)BP-20 · utilities renewables (https://fire-vault.com/control-blueprint/utilities-renewables) What Firevault changes ## What changes with this Plan. Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Supplier access gateway | Disconnected outside approved windows | Validate checks the booking. Relay opens the window. Execute closes it and Fracture withdraws the route. | | Access broker to approved target | Disconnected outside approved windows | Validate checks the target. Lock restricts the session through supporting controls. Relay opens the selected connection. | | Urgent support route | Disconnected by default | Validate checks both approvals. Relay opens a short window. Execute closes it. | | Supplier secondary route | Disconnected or removed after review | Fracture withdraws the selected physical route where it is placed under Control. | CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools. Control in Action ## Third-Party Access Control: see the selected path change. Control in Action Stage Before agreed physical control Nobody leaves supplier access open on purpose. The engineer finishes, the ticket closes and the remote connection remains ready for the next visit.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Supplier access gateway _Always connected_ - Access broker to approved target _Always connected_ - Urgent support route _Always connected_ - Supplier secondary route _Always connected_ - Recovery access (OSS) _Not in place_ 1. _VA_**Validate** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. Checks the supplier, sponsor, purpose and approved window before access is opened. Provides the time-bound connection for the approved job. Keeps access restricted to the named supplier identities and approved target, using supporting access controls. Initiates opening and closing actions from the approved schedule or sponsor decision. Physically withdraws the supplier connection when the window ends or approval is withdrawn. ### CP-03Third-Party Access Control Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends. Primary modules: Fracture, Relay, Execute, Validate and Lock. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-03 **CP-02****Live Incident Containment**Physically disconnect the affected path during a live incident while the rest of the operation keeps running. _Open CP-02_: https://fire-vault.com/control-plan/contain-active-breaches **CP-04****Physical Network Segmentation**Zones separated at Layer 1, so a boundary holds even when software controls are compromised. _Open CP-04_: https://fire-vault.com/control-plan/enforce-physical-segmentation **CP-01****Ransomware Containment**Cut the paths ransomware uses to spread before encryption reaches critical systems. _Open CP-01_: https://fire-vault.com/control-plan/stop-kill-chain-ransomware See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Supplier access gatewayThe route from the supplier access service to the approved access broker._Disconnected outside approved windows_ Normal state Disconnected outside approved windows Authorisation Approved booking with a named supplier and internal sponsor Module action Validate checks the booking. Relay opens the window. Execute closes it and Fracture withdraws the route. Business effect Supplier access is available only during the approved window. Failure behaviour Remains disconnected unless an approved recovery procedure is followed. Access broker to approved targetThe selected connection from the access broker to the system covered by the job._Disconnected outside approved windows_ Normal state Disconnected outside approved windows Authorisation Sponsor approval for the named target and purpose Module action Validate checks the target. Lock restricts the session through supporting controls. Relay opens the selected connection. Business effect The supplier reaches the approved target, not every system behind the broker. Failure behaviour Urgent support routeA pre-agreed route for urgent support with a named approver._Disconnected by default_ Normal state Disconnected by default Authorisation Urgent approval from the sponsor and service owner Module action Validate checks both approvals. Relay opens a short window. Execute closes it. Business effect Urgent support remains possible without leaving the route permanently available. Failure behaviour Use the documented alternative support procedure. Supplier secondary routeAny modem, cellular router or alternate connection discovered during assessment._Disconnected or removed after review_ Normal state Disconnected or removed after review Authorisation Assessment confirms that the route is not operationally required Module action Fracture withdraws the selected physical route where it is placed under Control. Business effect Reduces bypass routes. Routes outside the controlled hardware need separate action. Failure behaviour Confirm with the operational owner before implementation. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends. Each selected connection sits at its agreed normal state. Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Validate checks the booking. Relay opens the window. Execute closes it and Fracture withdraws the route.Validate Relay Lock The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends.Fracture Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** If a session is suspected, withdraw the supplier route, confirm its observed state and review the supporting session records before approving another window. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Supplier connections exist for approved work, in a defined window, and are withdrawn when the work ends. **What it does not replace**CP-03 does not assess the supplier device, inspect session content or replace identity, privileged access and contract controls. Session records depend on the configured access and logging tools. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Start with one supplier route. Name its sponsor, approved target and normal working window. Questions worth asking ## Before you rely on CP-03. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with third-party access control. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/control-third-party-access#webpage", "url": "https://fire-vault.com/control-plan/control-third-party-access", "name": "CP-03 Third-Party Access Control", "description": "CP-03 gives suppliers a defined route for approved work, then physically withdraws that route when the work window ends or the sponsor withdraws approval.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/control-third-party-access#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/control-third-party-access#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-03 Third-Party Access Control", "item": "https://fire-vault.com/control-plan/control-third-party-access" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-03 Third-Party Access Control", "description": "CP-03 gives suppliers a defined route for approved work, then physically withdraws that route when the work window ends or the sponsor withdraws approval.", "url": "https://fire-vault.com/control-plan/control-third-party-access" } ] ```