Control PlanCP-13Maintenance Window Control

Proposed Control Plan. Subject to technical and publication approval.

Connections for the maintenance window, not a standing route.

CP-13 Maintenance Window Control Control Plan icon

Connections that exist only for a scheduled maintenance window.

Book a briefing See Control in Action

Plan: CP-13
Purpose: Maintenance Window Control
Selected connections: 6
Modules: Relay · Execute · Validate · Anchor · Lock · Transfer
Scope: Scheduled servicing, vendor diagnostics and equipment support on named physical crossings.

What is at stake

Why maintenance window control matters.

A service connection can outlive the authority that justified it.

Persistent maintenance accessThe maintenance access route can remain available beyond the approved need.

Unfinished servicingServicing stops when the route closes. Agree how unfinished work is handled.

Maintenance ownershipName the maintenance owner and the conditions for a connection change.

Maintenance route checksCheck the observed state of the maintenance access route, including parallel routes.

The problem today

Where you are IP connected today.

CP-13 reviews six IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

6IP-connected paths reviewed

6Risks to agree with owners

6Control modules applied

Risk 1Maintenance workstation to servicing gateway
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 2Vendor support gateway to equipment network
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 3Admin workstation to equipment management
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 4Servicing network to production equipment
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 5Diagnostic staging network to analysis environment
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected
Risk 6Secondary service port to maintenance network
Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected

Matching industry Blueprints

BP-04 · rail BP-12 · motorsport BP-19 · utilities gas

What Firevault changes

What changes with this Plan.

Connections exist only for a scheduled maintenance window.

Connection	Agreed normal state	Control action
Maintenance workstation to servicing gateway	Disconnected	Relay limits servicing access; Execute applies approved closure.
Vendor support gateway to equipment network	Disconnected	Validate checks vendor task approval; Relay opens the support entry.
Admin workstation to equipment management	Disconnected	Execute closes the management crossing after the approved task.
Servicing network to production equipment	Disconnected	Validate checks equipment approval; Relay opens the service boundary.
Diagnostic staging network to analysis environment	Disconnected	Transfer governs diagnostic movement; Execute closes the artefact crossing.
Secondary service port to maintenance network	Disconnected	Relay opens only the approved secondary service connection.

Task safety validation, identity management and software deployment correctness.

Control in Action

Maintenance Window Control: see the selected path change.

Connections exist only for a scheduled maintenance window.

Control in Action

Stage

Before agreed physical control

A service connection can outlive the authority that justified it.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack

10still running

Physical crossings

Maintenance workstation to servicing gatewayAlways connected
Vendor support gateway to equipment networkAlways connected
Admin workstation to equipment managementAlways connected
Servicing network to production equipmentAlways connected
Recovery access (OSS)Not in place

RERelay · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-13: governs the approved servicing period. In CP-13: checks the owner, task and approved window. In CP-13: applies the approved closure or authorised extension action.

CP-13Maintenance Window Control

Z0Requesting environment

Z1Protected systems

Z2Related operations

Held in Offline Secure Storage®Selected recovery material, held separately

Out-of-band command path

This Control Plan

Connections exist only for a scheduled maintenance window.

Primary modules: Relay, Execute, Validate, Anchor, Lock and Transfer.

Read the operational detail

Module in this plan

Relay

Controls the path

Establishes connectivity only when authorised, for a defined purpose and a limited time, before removing the network path again.

Explore the Relay module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-13

CP-12 · ProposedPrivileged Access ControlAdministrator access through a controlled network entry point.Open CP-12

CP-14 · ProposedCompromised Device IsolationPhysically isolate one affected device from the network.Open CP-14

CP-11 · ProposedSupply Chain IsolationKeep supplier networks separate from your own environment.Open CP-11

See all Control Plans How Control works

As featured in

The Control Plan specification

Each selected connection, written down.

Connections exist only for a scheduled maintenance window.

Maintenance workstation to servicing gatewayDisconnected

Normal state: Disconnected
Authorisation: 1 · Approved servicing window ends and safe closure conditions are met
Module action: Relay limits servicing access; Execute applies approved closure.
Business effect: Remote servicing commands stop.
Failure behaviour: Disconnected on fault; confirm equipment can tolerate lost servicing access.

Vendor support gateway to equipment networkDisconnected

Normal state: Disconnected
Authorisation: 2 · Maintenance owner approves a named vendor diagnostic task
Module action: Validate checks vendor task approval; Relay opens the support entry.
Business effect: Vendor diagnostics and remote support stop.
Failure behaviour: Disconnected on power loss; vendor access requires renewed approval.

Admin workstation to equipment managementDisconnected

Normal state: Disconnected
Authorisation: 1 · Approved management task completes or authority is withdrawn
Module action: Execute closes the management crossing after the approved task.
Business effect: Remote equipment configuration stops.
Failure behaviour: Disconnected on fault; use the tested local management procedure.

Servicing network to production equipmentDisconnected

Normal state: Disconnected
Authorisation: 2 · Equipment owner approves service access and safe withdrawal conditions
Module action: Validate checks equipment approval; Relay opens the service boundary.
Business effect: Remote servicing of production equipment stops; local operation remains separately assessed.
Failure behaviour: Designed to disconnect on fault; equipment owner must approve safe loss of access.

Diagnostic staging network to analysis environmentDisconnected

Normal state: Disconnected
Authorisation: 1 · Approved diagnostic export completes
Module action: Transfer governs diagnostic movement; Execute closes the artefact crossing.
Business effect: Diagnostic uploads stop; collected local artefacts remain.
Failure behaviour: Disconnected on fault; reconcile incomplete diagnostic files before retrying.

Secondary service port to maintenance networkDisconnected

Normal state: Disconnected
Authorisation: 2 · Maintenance owner approves fallback after primary interface failure
Module action: Relay opens only the approved secondary service connection.
Business effect: Fallback servicing stops; primary access remains separately controlled.
Failure behaviour: Disconnected on power loss; no automatic fallback opening is permitted.

Task safety validation, identity management and software deployment correctness.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record

1Normal operationAgreed states held

Connections exist only for a scheduled maintenance window. Each selected connection sits at its agreed normal state.AnchorTransfer

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Relay limits servicing access; Execute applies approved closure.RelayValidateLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Connections exist only for a scheduled maintenance window.

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

A physical boundary does not prove task completion or device remediation. Apply the agreed evidence and owner checks.

The operational owner authorises each reconnection.

Each check and each reconnection.

Task safety validation, identity management and software deployment correctness.

Engineering and integration

Fit the control around your existing environment.

Scheduled servicing, vendor diagnostics and equipment support on named physical crossings.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.

Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.

Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.

Controlled changeVerify approved opening, closure and the operational impact.

Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

A physical boundary does not prove task completion or device remediation. Apply the agreed evidence and owner checks.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Task safety validation, identity management and software deployment correctness.

What this addressesConnections exist only for a scheduled maintenance window.

What it does not replaceTask safety validation, identity management and software deployment correctness.

Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions.

Questions worth asking

Before you rely on CP-13.

Practical questions for the people who own these connections.

Connections exist only for a scheduled maintenance window.

Scheduled servicing, vendor diagnostics and equipment support on named physical crossings.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Task safety validation, identity management and software deployment correctness.

Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions.

Your next step

Take the next step with maintenance window control.

Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions.

Book a briefing

Prefer to talk first? Speak to the team

Book a briefing Speak to the team