--- title: "CP-13 Maintenance Window Control | Control by Firevault" url: https://fire-vault.com/control-plan/maintenance-window-control description: "Connections that exist only for a scheduled maintenance window." lang: en-GB --- Control Plan **CP-13**Maintenance Window Control Proposed Control Plan. Subject to technical and publication approval. # Connections for the maintenance window, not a standing route. Image: CP-13 Maintenance Window Control Control Plan icon (https://fire-vault.com/__l5e/assets-v1/959bf784-2dd5-41f7-baa4-03fabd5dbbfe/CP-13_maintenance-window-control.png) Connections that exist only for a scheduled maintenance window. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-13 Purpose Maintenance Window Control Selected connections 6 Modules Relay · Execute · Validate · Anchor · Lock · Transfer Scope Scheduled servicing, vendor diagnostics and equipment support on named physical crossings. What is at stake ## Why maintenance window control matters. A service connection can outlive the authority that justified it. **Persistent maintenance access**The maintenance access route can remain available beyond the approved need. **Unfinished servicing**Servicing stops when the route closes. Agree how unfinished work is handled. **Maintenance ownership**Name the maintenance owner and the conditions for a connection change. **Maintenance route checks**Check the observed state of the maintenance access route, including parallel routes. The problem today ## Where you are IP connected today. CP-13 reviews six IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **6**IP-connected paths reviewed **6**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**Maintenance workstation to servicing gateway** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 2. _Risk 2_**Vendor support gateway to equipment network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 3. _Risk 3_**Admin workstation to equipment management** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 4. _Risk 4_**Servicing network to production equipment** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 5. _Risk 5_**Diagnostic staging network to analysis environment** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected 6. _Risk 6_**Secondary service port to maintenance network** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected Matching industry Blueprints BP-04 · rail (https://fire-vault.com/control-blueprint/rail)BP-12 · motorsport (https://fire-vault.com/control-blueprint/motorsport)BP-19 · utilities gas (https://fire-vault.com/control-blueprint/utilities-gas) What Firevault changes ## What changes with this Plan. Connections exist only for a scheduled maintenance window. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Maintenance workstation to servicing gateway | Disconnected | Relay limits servicing access; Execute applies approved closure. | | Vendor support gateway to equipment network | Disconnected | Validate checks vendor task approval; Relay opens the support entry. | | Admin workstation to equipment management | Disconnected | Execute closes the management crossing after the approved task. | | Servicing network to production equipment | Disconnected | Validate checks equipment approval; Relay opens the service boundary. | | Diagnostic staging network to analysis environment | Disconnected | Transfer governs diagnostic movement; Execute closes the artefact crossing. | | Secondary service port to maintenance network | Disconnected | Relay opens only the approved secondary service connection. | Task safety validation, identity management and software deployment correctness. Control in Action ## Maintenance Window Control: see the selected path change. Control in Action Stage Before agreed physical control A service connection can outlive the authority that justified it.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Maintenance workstation to servicing gateway _Always connected_ - Vendor support gateway to equipment network _Always connected_ - Admin workstation to equipment management _Always connected_ - Servicing network to production equipment _Always connected_ - Recovery access (OSS) _Not in place_ 1. _RE_**Relay** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-13: governs the approved servicing period. In CP-13: checks the owner, task and approved window. In CP-13: applies the approved closure or authorised extension action. ### CP-13Maintenance Window Control Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Connections exist only for a scheduled maintenance window. Primary modules: Relay, Execute, Validate, Anchor, Lock and Transfer. Read the operational detail Module in this plan Image: Relay module icon (https://fire-vault.com/__l5e/assets-v1/bc644d30-1db5-42e6-b88a-647a62245447/relay-icon.png) #### Relay Controls the path Establishes connectivity only when authorised, for a defined purpose and a limited time, before removing the network path again. Explore the Relay module (https://fire-vault.com/control/modules/relay) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-13 **CP-12 · Proposed****Privileged Access Control**Administrator access through a controlled network entry point. _Open CP-12_: https://fire-vault.com/control-plan/privileged-access-control **CP-14 · Proposed****Compromised Device Isolation**Physically isolate one affected device from the network. _Open CP-14_: https://fire-vault.com/control-plan/compromised-device-isolation **CP-11 · Proposed****Supply Chain Isolation**Keep supplier networks separate from your own environment. _Open CP-11_: https://fire-vault.com/control-plan/supply-chain-isolation See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Maintenance workstation to servicing gateway_Disconnected_ Normal state Disconnected Authorisation 1 · Approved servicing window ends and safe closure conditions are met Module action Relay limits servicing access; Execute applies approved closure. Business effect Remote servicing commands stop. Failure behaviour Disconnected on fault; confirm equipment can tolerate lost servicing access. Vendor support gateway to equipment network_Disconnected_ Normal state Disconnected Authorisation 2 · Maintenance owner approves a named vendor diagnostic task Module action Validate checks vendor task approval; Relay opens the support entry. Business effect Vendor diagnostics and remote support stop. Failure behaviour Disconnected on power loss; vendor access requires renewed approval. Admin workstation to equipment management_Disconnected_ Normal state Disconnected Authorisation 1 · Approved management task completes or authority is withdrawn Module action Execute closes the management crossing after the approved task. Business effect Remote equipment configuration stops. Failure behaviour Disconnected on fault; use the tested local management procedure. Servicing network to production equipment_Disconnected_ Normal state Disconnected Authorisation 2 · Equipment owner approves service access and safe withdrawal conditions Module action Validate checks equipment approval; Relay opens the service boundary. Business effect Remote servicing of production equipment stops; local operation remains separately assessed. Failure behaviour Designed to disconnect on fault; equipment owner must approve safe loss of access. Diagnostic staging network to analysis environment_Disconnected_ Normal state Disconnected Authorisation 1 · Approved diagnostic export completes Module action Transfer governs diagnostic movement; Execute closes the artefact crossing. Business effect Diagnostic uploads stop; collected local artefacts remain. Failure behaviour Disconnected on fault; reconcile incomplete diagnostic files before retrying. Secondary service port to maintenance network_Disconnected_ Normal state Disconnected Authorisation 2 · Maintenance owner approves fallback after primary interface failure Module action Relay opens only the approved secondary service connection. Business effect Fallback servicing stops; primary access remains separately controlled. Failure behaviour Disconnected on power loss; no automatic fallback opening is permitted. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Connections exist only for a scheduled maintenance window. Each selected connection sits at its agreed normal state.Anchor Transfer Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Relay limits servicing access; Execute applies approved closure.Relay Validate Lock The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** A physical boundary does not prove task completion or device remediation. Apply the agreed evidence and owner checks. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Connections exist only for a scheduled maintenance window. **What it does not replace**Task safety validation, identity management and software deployment correctness. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions. Questions worth asking ## Before you rely on CP-13. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with maintenance window control. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/maintenance-window-control#webpage", "url": "https://fire-vault.com/control-plan/maintenance-window-control", "name": "CP-13 Maintenance Window Control", "description": "Connections that exist only for a scheduled maintenance window.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/maintenance-window-control#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/maintenance-window-control#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-13 Maintenance Window Control", "item": "https://fire-vault.com/control-plan/maintenance-window-control" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-13 Maintenance Window Control", "description": "Connections that exist only for a scheduled maintenance window.", "url": "https://fire-vault.com/control-plan/maintenance-window-control" } ] ```