--- title: "CP-18 Data Exfiltration Interruption | Control by Firevault" url: https://fire-vault.com/control-plan/data-exfiltration-interruption description: "Interrupt outbound paths at a physical boundary. Firevault offline secure storage physically disconnects your data from the internet." lang: en-GB --- Control Plan **CP-18**Data Exfiltration Interruption Proposed Control Plan. Subject to technical and publication approval. # Which physical crossing carries sensitive data out of your environment? Image: CP-18 Data Exfiltration Interruption Control Plan icon (https://fire-vault.com/__l5e/assets-v1/18726064-1a29-4241-9c6f-617e786125e8/CP-18_data-exfiltration-interruption.png) Interrupt outbound paths at a physical boundary. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-18 Purpose Data Exfiltration Interruption Selected connections 8 Modules Fracture · Isolate · Execute Scope The physical crossings listed below and their parallel members. What is at stake ## Why data exfiltration interruption matters. An outbound transfer can use legitimate services and credentials. Waiting to identify every file can leave the selected route available for further disclosure. **Persistent outbound paths**The outbound transfer paths can remain available beyond the approved need. **Interrupted transfers**Legitimate transfers using the same route also stop. Data already disclosed cannot be recalled. **Data incident ownership**Name the data incident owner and the conditions for a connection change. **Outbound path checks**Check the observed state of the outbound transfer paths, including parallel routes. The problem today ## Where you are IP connected today. CP-18 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **8**IP-connected paths reviewed **8**Risks to agree with owners **3**Control modules applied 1. _Risk 1_**Protected data zone to egress gateway** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 2. _Risk 2_**Remote transfer gateway to internal data network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 3. _Risk 3_**Admin workstation to transfer gateway management** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 4. _Risk 4_**Export gateway to external destination network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 5. _Risk 5_**Approved export staging to recipient gateway** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 6. _Risk 6_**Protected site gateway to remote site network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 7. _Risk 7_**Operational data gateway to enterprise export network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 8. _Risk 8_**Organisation perimeter firewall to internet provider** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected Matching industry Blueprints What Firevault changes ## What changes with this Plan. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Protected data zone to egress gateway | Connected | Execute applies the approved alert response; Fracture withdraws zone egress. | | Remote transfer gateway to internal data network | Connected | Fracture withdraws the remote transfer gateway connection. | | Admin workstation to transfer gateway management | Disconnected | Execute closes the transfer administration path. | | Export gateway to external destination network | Connected | Fracture disconnects the external destination crossing. | | Approved export staging to recipient gateway | Disconnected | Transfer governs the approved export; Execute closes its physical path. | | Protected site gateway to remote site network | Connected | Isolate withdraws registered outbound site conduits together. | | Operational data gateway to enterprise export network | Connected | Fracture withdraws the operational data conduit. | | Organisation perimeter firewall to internet provider | Connected | Fracture withdraws the internet edge connection. | Content inspection, cloud identity, uncontrolled routes and activity already completed. Control in Action ## Data Exfiltration Interruption: see the selected path change. Control in Action Stage Before agreed physical control An outbound transfer can use legitimate services and credentials. Waiting to identify every file can leave the selected route available for further disclosure.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Protected data zone to egress gateway _Always connected_ - Remote transfer gateway to internal data network _Always connected_ - Admin workstation to transfer gateway management _Always connected_ - Export gateway to external destination network _Always connected_ - Recovery access (OSS) _Not in place_ 1. _FB_**Fracture** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-18: supports the approved boundary and purpose in the register. ### CP-18Data Exfiltration Interruption Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Interrupt outbound paths at a physical boundary. Primary modules: Fracture, Isolate and Execute. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-18 **CP-17 · Proposed****Change Window Enforcement**Approved changes made through a timed physical connection. _Open CP-17_: https://fire-vault.com/control-plan/change-window-enforcement **CP-19 · Proposed****Autonomous System Intervention**Disconnect the communications of an autonomous system. _Open CP-19_: https://fire-vault.com/control-plan/autonomous-system-intervention **CP-16 · Proposed****Remote Site Isolation**Disconnect the communications link to a remote facility. _Open CP-16_: https://fire-vault.com/control-plan/remote-site-isolation See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Protected data zone to egress gateway_Connected_ Normal state Connected Authorisation 1 · Approved data loss alert identifies prohibited outbound transfer Module action Execute applies the approved alert response; Fracture withdraws zone egress. Business effect Outbound transfers from the protected zone stop. Failure behaviour Disconnected on fault; protected zone outbound services remain unavailable. Remote transfer gateway to internal data network_Connected_ Normal state Connected Authorisation 2 · Incident owner approves withdrawal after suspicious remote download activity Module action Fracture withdraws the remote transfer gateway connection. Business effect Remote file downloads and legitimate remote transfers stop. Failure behaviour Disconnected on power loss; remote transfer sessions must be reauthorised. Admin workstation to transfer gateway management_Disconnected_ Normal state Disconnected Authorisation 1 · Approved administration ends or transfer administrator authority is revoked Module action Execute closes the transfer administration path. Business effect Remote gateway configuration stops; existing data paths remain separately controlled. Failure behaviour Disconnected on fault; use the tested independent management route. Export gateway to external destination network_Connected_ Normal state Connected Authorisation 2 · Data owner approves withdrawal after destination approval is revoked Module action Fracture disconnects the external destination crossing. Business effect Exports to that destination stop; other destinations remain separately controlled. Failure behaviour Disconnected on power loss; verify recipient state before restarting exports. Approved export staging to recipient gateway_Disconnected_ Normal state Disconnected Authorisation 1 · Approved export completes or export authority is withdrawn Module action Transfer governs the approved export; Execute closes its physical path. Business effect Approved export delivery stops; recipients retain data already received. Failure behaviour Disconnected on fault; reconcile delivered records before retrying export. Protected site gateway to remote site network_Connected_ Normal state Connected Authorisation 2 · Incident owner approves withdrawal after suspicious intersite data movement Module action Isolate withdraws registered outbound site conduits together. Business effect Intersite data replication and business transfers stop. Failure behaviour Designed to stay connected on fault; replication availability retains an outbound exposure. Operational data gateway to enterprise export network_Connected_ Normal state Connected Authorisation 2 · Operations owner approves interruption after unauthorised operational data export Module action Fracture withdraws the operational data conduit. Business effect Operational reporting exports stop; local control remains separately assessed. Failure behaviour Designed to stay connected on fault; operations must accept residual export exposure. Organisation perimeter firewall to internet provider_Connected_ Normal state Connected Authorisation 3 · Two designated executives approve broad interruption after confirmed external exfiltration Module action Fracture withdraws the internet edge connection. Business effect Internet services and external transfers stop across the organisation. Failure behaviour Designed to stay connected on fault; availability retains exposure until independent intervention. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Interrupt outbound paths at a physical boundary. Each selected connection sits at its agreed normal state. Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Interrupt outbound paths at a physical boundary.Fracture Isolate Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Closure does not validate the systems or data on either side. Investigate the event and obtain the named owner approval before reopening. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Interrupt outbound paths at a physical boundary. **What it does not replace**Content inspection, cloud identity, uncontrolled routes and activity already completed. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Who owns the crossing, what authorises its use, and what must happen when approval ends? Use the draft register to identify unknowns, not as a deployment specification. Questions worth asking ## Before you rely on CP-18. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with data exfiltration interruption. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/data-exfiltration-interruption#webpage", "url": "https://fire-vault.com/control-plan/data-exfiltration-interruption", "name": "CP-18 Data Exfiltration Interruption", "description": "Interrupt outbound paths at a physical boundary. Firevault offline secure storage physically disconnects your data from the internet.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/data-exfiltration-interruption#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/data-exfiltration-interruption#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-18 Data Exfiltration Interruption", "item": "https://fire-vault.com/control-plan/data-exfiltration-interruption" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-18 Data Exfiltration Interruption", "description": "Interrupt outbound paths at a physical boundary.", "url": "https://fire-vault.com/control-plan/data-exfiltration-interruption" } ] ```