Control PlanCP-04Physical Network Segmentation

Different trust levels need more than a shared network rule.

CP-04 Physical Network Segmentation Control Plan icon

CP-04 separates selected trust zones with physically controlled crossings, so the connections between them exist only when the agreed design permits them.

Book a briefing See Control in Action

Plan: CP-04
Purpose: Physical Network Segmentation
Selected connections: 4
Modules: Isolate · Fracture · Relay · Unlink
Scope: Selected physical crossings between agreed trust zones, including redundant members of the same boundary.

What is at stake

Why physical network segmentation matters.

Flat or broadly connected networks let a problem in one area reach systems that should have been separate. Firewall rules matter, but some boundaries also need a physical control point.

Unnecessary standing crossingsConnections between zones can remain available because they were once needed.

Bypass routesRedundant links and persistent support connections can bypass the intended boundary.

Unclear zone ownershipWithout owners for each zone and crossing, exceptions accumulate over time.

Unknown dependenciesDisconnecting a crossing can affect services if the dependencies have not been mapped.

The problem today

Where you are IP connected today.

CP-04 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

4IP-connected paths reviewed

4Risks to agree with owners

4Control modules applied

Risk 1Enterprise to operational zone
The selected crossing between corporate systems and an operational or supervisory zone.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected only where required for service
Risk 2Engineering access crossing
The route used for approved engineering or administrative work.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected outside approved windows
Risk 3Approved data exchange crossing
A selected crossing used for scheduled transfers between zones.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected outside transfer windows
Risk 4Persistent support dependency
A standing relationship identified as bypassing the agreed boundary.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Removed or controlled after review

Matching industry Blueprints

BP-01 · utilities water BP-03 · oil and gas BP-05 · aviation BP-06 · telecommunications BP-07 · banking BP-08 · healthcare BP-09 · defence BP-10 · colocations BP-11 · maritime BP-12 · motorsport BP-13 · construction BP-15 · education BP-16 · public sector BP-17 · retail BP-18 · utilities

What Firevault changes

What changes with this Plan.

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.

Connection	Agreed normal state	Control action
Enterprise to operational zone	Connected only where required for service	Isolate defines the boundary. Fracture withdraws the selected crossing.
Engineering access crossing	Disconnected outside approved windows	Relay opens the crossing. Fracture withdraws it when the window ends.
Approved data exchange crossing	Disconnected outside transfer windows	Relay opens the crossing for the exchange. Fracture withdraws it afterwards.
Persistent support dependency	Removed or controlled after review	Unlink removes the dependency. Fracture controls any remaining physical crossing.

CP-04 does not replace firewall policy, inspect traffic, remove malware or control routes outside the approved register.

Control in Action

Physical Network Segmentation: see the selected path change.

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.

Control in Action

Stage

Before agreed physical control

Flat or broadly connected networks let a problem in one area reach systems that should have been separate. Firewall rules matter, but some boundaries also need a physical control point.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack

10still running

Physical crossings

Enterprise to operational zoneAlways connected
Engineering access crossingAlways connected
Approved data exchange crossingAlways connected
Persistent support dependencyAlways connected
Recovery access (OSS)Not in place

ISIsolate · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

Treats the agreed crossings around a zone as one defined boundary. Physically withdraws a selected crossing. Opens a selected crossing for an approved purpose and time. Removes persistent support relationships that leave a bypass route available.

CP-04Physical Network Segmentation

Z0Requesting environment

Z1Protected systems

Z2Related operations

Held in Offline Secure Storage®Selected recovery material, held separately

Out-of-band command path

This Control Plan

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.

Primary modules: Fracture, Isolate, Relay and Unlink.

Read the operational detail

Module in this plan

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-04

CP-03Third-Party Access ControlSupplier and vendor paths that exist only for approved work, in a defined window.Open CP-03

CP-05Critical Asset ProtectionSeparate business access from essential systems, with planned isolation boundaries.Open CP-05

CP-02Live Incident ContainmentPhysically disconnect the affected path during a live incident while the rest of the operation keeps running.Open CP-02

See all Control Plans How Control works

As featured in

The Control Plan specification

Each selected connection, written down.

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.

Enterprise to operational zoneThe selected crossing between corporate systems and an operational or supervisory zone.Connected only where required for service

Normal state: Connected only where required for service
Authorisation: Change approval or incident owner decision
Module action: Isolate defines the boundary. Fracture withdraws the selected crossing.
Business effect: Cross-zone access pauses. Confirm local operation before approval.
Failure behaviour: Behaviour agreed with the operational owner and tested.

Engineering access crossingThe route used for approved engineering or administrative work.Disconnected outside approved windows

Normal state: Disconnected outside approved windows
Authorisation: Approved work with named purpose and window
Module action: Relay opens the crossing. Fracture withdraws it when the window ends.
Business effect: Engineering access is available only for approved work.
Failure behaviour: Remains disconnected unless an approved recovery procedure is followed.

Approved data exchange crossingA selected crossing used for scheduled transfers between zones.Disconnected outside transfer windows

Normal state: Disconnected outside transfer windows
Authorisation: Approved schedule or exchange request
Module action: Relay opens the crossing for the exchange. Fracture withdraws it afterwards.
Business effect: Exchanges run only in agreed windows.
Failure behaviour: Remains disconnected unless an approved recovery procedure is followed.

Persistent support dependencyA standing relationship identified as bypassing the agreed boundary.Removed or controlled after review

Normal state: Removed or controlled after review
Authorisation: Owner confirms that the dependency is not operationally required
Module action: Unlink removes the dependency. Fracture controls any remaining physical crossing.
Business effect: Reduces routes that bypass the zone design.
Failure behaviour: Confirm with the operational owner before implementation.

CP-04 does not replace firewall policy, inspect traffic, remove malware or control routes outside the approved register.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record

1Normal operationAgreed states held

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Isolate defines the boundary. Fracture withdraws the selected crossing.RelayUnlink

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.IsolateFracture

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Reconnect crossings one at a time after the zone owner confirms the agreed checks.

The operational owner authorises each reconnection.

Each check and each reconnection.

CP-04 does not replace firewall policy, inspect traffic, remove malware or control routes outside the approved register.

Engineering and integration

Fit the control around your existing environment.

Selected physical crossings between agreed trust zones, including redundant members of the same boundary.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.

Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.

Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.

Controlled changeVerify approved opening, closure and the operational impact.

Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Reconnect crossings one at a time after the zone owner confirms the agreed checks.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

CP-04 does not replace firewall policy, inspect traffic, remove malware or control routes outside the approved register.

What this addressesDefine the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.

What it does not replaceCP-04 does not replace firewall policy, inspect traffic, remove malware or control routes outside the approved register.

Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Choose one boundary, list every physical crossing and identify which ones must remain connected for service.

Questions worth asking

Before you rely on CP-04.

Practical questions for the people who own these connections.

Define the crossings between trust zones, keep unnecessary crossings withdrawn and remove persistent dependencies that bypass the intended boundary.

Selected physical crossings between agreed trust zones, including redundant members of the same boundary.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

CP-04 does not replace firewall policy, inspect traffic, remove malware or control routes outside the approved register.

Choose one boundary, list every physical crossing and identify which ones must remain connected for service.

Your next step

Take the next step with physical network segmentation.

Choose one boundary, list every physical crossing and identify which ones must remain connected for service.

Book a briefing

Prefer to talk first? Speak to the team

Book a briefing Speak to the team