--- title: "CP-20 Multi-Party Authorisation | Control by Firevault" url: https://fire-vault.com/control-plan/multi-party-authorisation description: "Two independent approvals required before a connection opens." lang: en-GB --- Control Plan **CP-20**Multi-Party Authorisation Proposed Control Plan. Subject to technical and publication approval. # One approval is not enough. Who else must authorise the connection? Image: CP-20 Multi-Party Authorisation Control Plan icon (https://fire-vault.com/__l5e/assets-v1/47c68610-2b0a-443e-bedd-af9d26ed70ae/CP-20_multi-party-authorisation.png) Two independent approvals required before a connection opens. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-20 Purpose Multi-Party Authorisation Selected connections 8 Modules Fracture · Relay · Execute · Validate · Anchor · Lock Scope Sensitive connections with an agreed two-person opening rule. What is at stake ## Why multi-party authorisation matters. A compromised approver must not become sole authority to open a sensitive connection. **Extended joint access**The jointly authorised connection can remain available beyond the approved need. **Approval delays**Access waits if either approval is missing. Define a separate reviewed exception process. **Access ownership**Name the access owner and the conditions for a connection change. **Joint connection checks**Check the observed state of the jointly authorised connection, including parallel routes. The problem today ## Where you are IP connected today. CP-20 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **8**IP-connected paths reviewed **8**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**Sensitive access crossing · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 2. _Risk 2_**Remote administration crossing · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 3. _Risk 3_**Approval administration path · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 4. _Risk 4_**Critical service crossing · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 5. _Risk 5_**Data exchange crossing · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 6. _Risk 6_**Secondary site crossing · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 7. _Risk 7_**Operational target conduit · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 8. _Risk 8_**External partner crossing · All physical members and parallel paths to be mapped.** Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default Matching industry Blueprints BP-09 · defence (https://fire-vault.com/control-blueprint/defence) What Firevault changes ## What changes with this Plan. Require two independent approvals before opening each scoped connection. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Sensitive access crossing · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | Remote administration crossing · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | Approval administration path · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | Critical service crossing · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | Data exchange crossing · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | Secondary site crossing · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | Operational target conduit · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | | External partner crossing · All physical members and parallel paths to be mapped. | Disconnected by default | Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. | Request safety, application permissions and independently governed emergency procedures. Control in Action ## Multi-Party Authorisation: see the selected path change. Control in Action Stage Before agreed physical control A compromised approver must not become sole authority to open a sensitive connection.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Sensitive access crossing · All physical members and parallel paths to be mapped. _Always connected_ - Remote administration crossing · All physical members and parallel paths to be mapped. _Always connected_ - Approval administration path · All physical members and parallel paths to be mapped. _Always connected_ - Critical service crossing · All physical members and parallel paths to be mapped. _Always connected_ - Recovery access (OSS) _Not in place_ 1. _FB_**Fracture** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-20: checks two independent approvals for the unchanged request. In CP-20: separates requester and approval authority. In CP-20: limits connectivity to the approved purpose and duration. ### CP-20Multi-Party Authorisation Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Require two independent approvals before opening each scoped connection. Primary modules: Fracture, Relay, Execute, Validate, Anchor and Lock. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-20 **CP-19 · Proposed****Autonomous System Intervention**Disconnect the communications of an autonomous system. _Open CP-19_: https://fire-vault.com/control-plan/autonomous-system-intervention **CP-18 · Proposed****Data Exfiltration Interruption**Interrupt outbound paths at a physical boundary. _Open CP-18_: https://fire-vault.com/control-plan/data-exfiltration-interruption **CP-17 · Proposed****Change Window Enforcement**Approved changes made through a timed physical connection. _Open CP-17_: https://fire-vault.com/control-plan/change-window-enforcement See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Sensitive access crossing · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Two independent approvals of the same unchanged request before any opening Module action Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection. Business effect Requested access is unavailable while closed. Other approved windows are not implied to close. Failure behaviour Specify, justify and test power-loss and fault behaviour before approval. Remote administration crossing · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Approval administration path · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Critical service crossing · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Data exchange crossing · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Secondary site crossing · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Operational target conduit · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour External partner crossing · All physical members and parallel paths to be mapped._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Require two independent approvals before opening each scoped connection. Each selected connection sits at its agreed normal state.Anchor Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Validate checks both approvals. Lock constrains roles. Relay governs the window. Execute applies opening or closure; Fracture withdraws the selected connection.Relay Validate Lock The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Require two independent approvals before opening each scoped connection.Fracture Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Restoring a physical path is a new operating decision. Review the current system state, outstanding risks and authority before reconnecting. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Require two independent approvals before opening each scoped connection. **What it does not replace**Request safety, application permissions and independently governed emergency procedures. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Use this draft register to discuss connection scope and unresolved operating decisions. It is a discovery aid, not an approved deployment configuration. Questions worth asking ## Before you rely on CP-20. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with multi-party authorisation. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/multi-party-authorisation#webpage", "url": "https://fire-vault.com/control-plan/multi-party-authorisation", "name": "CP-20 Multi-Party Authorisation", "description": "Two independent approvals required before a connection opens.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/multi-party-authorisation#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/multi-party-authorisation#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-20 Multi-Party Authorisation", "item": "https://fire-vault.com/control-plan/multi-party-authorisation" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-20 Multi-Party Authorisation", "description": "Two independent approvals required before a connection opens.", "url": "https://fire-vault.com/control-plan/multi-party-authorisation" } ] ```