Control PlanCP-18Data Exfiltration Interruption

Proposed Control Plan. Subject to technical and publication approval.

Which physical crossing carries sensitive data out of your environment?

CP-18 Data Exfiltration Interruption Control Plan icon

Interrupt outbound paths at a physical boundary.

Plan: CP-18
Purpose: Data Exfiltration Interruption
Selected connections: 8
Modules: Fracture · Isolate · Execute
Scope: The physical crossings listed below and their parallel members.

What is at stake

Why data exfiltration interruption matters.

An outbound transfer can use legitimate services and credentials. Waiting to identify every file can leave the selected route available for further disclosure.

Persistent outbound pathsThe outbound transfer paths can remain available beyond the approved need.

Interrupted transfersLegitimate transfers using the same route also stop. Data already disclosed cannot be recalled.

Data incident ownershipName the data incident owner and the conditions for a connection change.

Outbound path checksCheck the observed state of the outbound transfer paths, including parallel routes.

The problem today

Where you are IP connected today.

CP-18 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed

8Risks to agree with owners

3Control modules applied

Risk 1Protected data zone to egress gateway
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected
Risk 2Remote transfer gateway to internal data network
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected
Risk 3Admin workstation to transfer gateway management
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 4Export gateway to external destination network
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected
Risk 5Approved export staging to recipient gateway
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 6Protected site gateway to remote site network
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected
Risk 7Operational data gateway to enterprise export network
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected
Risk 8Organisation perimeter firewall to internet provider
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected

Matching industry Blueprints

What Firevault changes

What changes with this Plan.

Interrupt outbound paths at a physical boundary.

Connection	Agreed normal state	Control action
Protected data zone to egress gateway	Connected	Execute applies the approved alert response; Fracture withdraws zone egress.
Remote transfer gateway to internal data network	Connected	Fracture withdraws the remote transfer gateway connection.
Admin workstation to transfer gateway management	Disconnected	Execute closes the transfer administration path.
Export gateway to external destination network	Connected	Fracture disconnects the external destination crossing.
Approved export staging to recipient gateway	Disconnected	Transfer governs the approved export; Execute closes its physical path.
Protected site gateway to remote site network	Connected	Isolate withdraws registered outbound site conduits together.
Operational data gateway to enterprise export network	Connected	Fracture withdraws the operational data conduit.
Organisation perimeter firewall to internet provider	Connected	Fracture withdraws the internet edge connection.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Control in Action

Data Exfiltration Interruption: see the selected path change.

Interrupt outbound paths at a physical boundary.

Control in Action

Stage

Before agreed physical control

An outbound transfer can use legitimate services and credentials. Waiting to identify every file can leave the selected route available for further disclosure.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack

10still running

Physical crossings

Protected data zone to egress gatewayAlways connected
Remote transfer gateway to internal data networkAlways connected
Admin workstation to transfer gateway managementAlways connected
Export gateway to external destination networkAlways connected
Recovery access (OSS)Not in place

FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-18: supports the approved boundary and purpose in the register.

CP-18Data Exfiltration Interruption

Z0Requesting environment

Z1Protected systems

Z2Related operations

Held in Offline Secure Storage®Selected recovery material, held separately

Out-of-band command path

This Control Plan

Interrupt outbound paths at a physical boundary.

Primary modules: Fracture, Isolate and Execute.

Read the operational detail

Module in this plan

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-18

CP-17 · ProposedChange Window EnforcementApproved changes made through a timed physical connection.Open CP-17

CP-19 · ProposedAutonomous System InterventionDisconnect the communications of an autonomous system.Open CP-19

CP-16 · ProposedRemote Site IsolationDisconnect the communications link to a remote facility.Open CP-16

See all Control Plans How Control works

As featured in

The Control Plan specification

Each selected connection, written down.

Interrupt outbound paths at a physical boundary.

Protected data zone to egress gatewayConnected

Normal state: Connected
Authorisation: 1 · Approved data loss alert identifies prohibited outbound transfer
Module action: Execute applies the approved alert response; Fracture withdraws zone egress.
Business effect: Outbound transfers from the protected zone stop.
Failure behaviour: Disconnected on fault; protected zone outbound services remain unavailable.

Remote transfer gateway to internal data networkConnected

Normal state: Connected
Authorisation: 2 · Incident owner approves withdrawal after suspicious remote download activity
Module action: Fracture withdraws the remote transfer gateway connection.
Business effect: Remote file downloads and legitimate remote transfers stop.
Failure behaviour: Disconnected on power loss; remote transfer sessions must be reauthorised.

Admin workstation to transfer gateway managementDisconnected

Normal state: Disconnected
Authorisation: 1 · Approved administration ends or transfer administrator authority is revoked
Module action: Execute closes the transfer administration path.
Business effect: Remote gateway configuration stops; existing data paths remain separately controlled.
Failure behaviour: Disconnected on fault; use the tested independent management route.

Export gateway to external destination networkConnected

Normal state: Connected
Authorisation: 2 · Data owner approves withdrawal after destination approval is revoked
Module action: Fracture disconnects the external destination crossing.
Business effect: Exports to that destination stop; other destinations remain separately controlled.
Failure behaviour: Disconnected on power loss; verify recipient state before restarting exports.

Approved export staging to recipient gatewayDisconnected

Normal state: Disconnected
Authorisation: 1 · Approved export completes or export authority is withdrawn
Module action: Transfer governs the approved export; Execute closes its physical path.
Business effect: Approved export delivery stops; recipients retain data already received.
Failure behaviour: Disconnected on fault; reconcile delivered records before retrying export.

Protected site gateway to remote site networkConnected

Normal state: Connected
Authorisation: 2 · Incident owner approves withdrawal after suspicious intersite data movement
Module action: Isolate withdraws registered outbound site conduits together.
Business effect: Intersite data replication and business transfers stop.
Failure behaviour: Designed to stay connected on fault; replication availability retains an outbound exposure.

Operational data gateway to enterprise export networkConnected

Normal state: Connected
Authorisation: 2 · Operations owner approves interruption after unauthorised operational data export
Module action: Fracture withdraws the operational data conduit.
Business effect: Operational reporting exports stop; local control remains separately assessed.
Failure behaviour: Designed to stay connected on fault; operations must accept residual export exposure.

Organisation perimeter firewall to internet providerConnected

Normal state: Connected
Authorisation: 3 · Two designated executives approve broad interruption after confirmed external exfiltration
Module action: Fracture withdraws the internet edge connection.
Business effect: Internet services and external transfers stop across the organisation.
Failure behaviour: Designed to stay connected on fault; availability retains exposure until independent intervention.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record

1Normal operationAgreed states held

Interrupt outbound paths at a physical boundary. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Execute applies the approved alert response; Fracture withdraws zone egress.

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Interrupt outbound paths at a physical boundary.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Closure does not validate the systems or data on either side. Investigate the event and obtain the named owner approval before reopening.

The operational owner authorises each reconnection.

Each check and each reconnection.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Engineering and integration

Fit the control around your existing environment.

The physical crossings listed below and their parallel members.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.

Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.

Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.

Controlled changeVerify approved opening, closure and the operational impact.

Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Closure does not validate the systems or data on either side. Investigate the event and obtain the named owner approval before reopening.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

What this addressesInterrupt outbound paths at a physical boundary.

What it does not replaceContent inspection, cloud identity, uncontrolled routes and activity already completed.

Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification.

Questions worth asking

Before you rely on CP-18.

Practical questions for the people who own these connections.

Interrupt outbound paths at a physical boundary.

The physical crossings listed below and their parallel members.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Content inspection, cloud identity, uncontrolled routes and activity already completed.

Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification.

Your next step

Take the next step with data exfiltration interruption.

Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification.

Book a briefing

Prefer to talk first? Speak to the team

Book a briefing Speak to the team