Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-20Multi-Party Authorisation

Proposed Control Plan. Subject to technical and publication approval.

One approval is not enough. Who else must authorise the connection?

CP-20 Multi-Party Authorisation Control Plan icon

Two independent approvals required before a connection opens.

Plan
CP-20
Purpose
Multi-Party Authorisation
Selected connections
8
Modules
Fracture · Relay · Execute · Validate · Anchor · Lock
Scope
Sensitive connections with an agreed two-person opening rule.

What is at stake

Why multi-party authorisation matters.

A compromised approver must not become sole authority to open a sensitive connection.

Extended joint accessThe jointly authorised connection can remain available beyond the approved need.
Approval delaysAccess waits if either approval is missing. Define a separate reviewed exception process.
Access ownershipName the access owner and the conditions for a connection change.
Joint connection checksCheck the observed state of the jointly authorised connection, including parallel routes.

The problem today

Where you are IP connected today.

CP-20 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed
8Risks to agree with owners
6Control modules applied
  1. Risk 1Sensitive access crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  2. Risk 2Remote administration crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  3. Risk 3Approval administration path · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  4. Risk 4Critical service crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  5. Risk 5Data exchange crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  6. Risk 6Secondary site crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  7. Risk 7Operational target conduit · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  8. Risk 8External partner crossing · All physical members and parallel paths to be mapped.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

Matching industry Blueprints

BP-09 · defence

What Firevault changes

What changes with this Plan.

Require two independent approvals before opening each scoped connection.

Connection Agreed normal state Control action
Sensitive access crossing · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Remote administration crossing · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Approval administration path · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Critical service crossing · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Data exchange crossing · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Secondary site crossing · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Operational target conduit · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
External partner crossing · All physical members and parallel paths to be mapped. Disconnected by default Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.

Request safety, application permissions and independently governed emergency procedures.

Control in Action

Multi-Party Authorisation: see the selected path change.

Require two independent approvals before opening each scoped connection.

Control in Action

Stage

Before agreed physical control

A compromised approver must not become sole authority to open a sensitive connection.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Sensitive access crossing · All physical members and parallel paths to be mapped.Always connected
  • Remote administration crossing · All physical members and parallel paths to be mapped.Always connected
  • Approval administration path · All physical members and parallel paths to be mapped.Always connected
  • Critical service crossing · All physical members and parallel paths to be mapped.Always connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-20: checks two independent approvals for the unchanged request. In CP-20: separates requester and approval authority. In CP-20: limits connectivity to the approved purpose and duration.

CP-20Multi-Party Authorisation

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Require two independent approvals before opening each scoped connection.

Primary modules: Fracture, Relay, Execute, Validate, Anchor and Lock.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Require two independent approvals before opening each scoped connection.

Sensitive access crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Remote administration crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Approval administration path · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Critical service crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Data exchange crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Secondary site crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
Operational target conduit · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.
External partner crossing · All physical members and parallel paths to be mapped.Disconnected by default
Normal state
Disconnected by default
Authorisation
Two independent approvals of the same unchanged request before any opening
Module action
Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.
Business effect
Requested access is unavailable while closed. Other approved windows are not implied to close.
Failure behaviour
Specify, justify and test power-loss and fault behaviour before approval.

Request safety, application permissions and independently governed emergency procedures.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Require two independent approvals before opening each scoped connection. Each selected connection sits at its agreed normal state.Anchor

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.RelayValidateLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Require two independent approvals before opening each scoped connection.Fracture

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Restoring a physical path is a new operating decision. Review the current system state, outstanding risks and authority before reconnecting.

The operational owner authorises each reconnection.

Each check and each reconnection.

Request safety, application permissions and independently governed emergency procedures.

Engineering and integration

Fit the control around your existing environment.

Sensitive connections with an agreed two-person opening rule.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Restoring a physical path is a new operating decision. Review the current system state, outstanding risks and authority before reconnecting.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Request safety, application permissions and independently governed emergency procedures.

What this addressesRequire two independent approvals before opening each scoped connection.
What it does not replaceRequest safety, application permissions and independently governed emergency procedures.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration.

Questions worth asking

Before you rely on CP-20.

Practical questions for the people who own these connections.

Require two independent approvals before opening each scoped connection.

Sensitive connections with an agreed two-person opening rule.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Request safety, application permissions and independently governed emergency procedures.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration.

Your next step

Take the next step with multi-party authorisation.

Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration.

Book a briefing

Prefer to talk first? Speak to the team