Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-15Operational Technology Protection

Proposed Control Plan. Subject to technical and publication approval.

Your process depends on OT. Which connections could put it at risk?

CP-15 Operational Technology Protection Control Plan icon

Industrial controllers behind a physical network boundary.

Plan
CP-15
Purpose
Operational Technology Protection
Selected connections
8
Modules
Fracture · Isolate · Relay · Execute · Validate · Anchor
Scope
The assessed IT-to-OT crossing, support, management and alternate conduits.

What is at stake

Why operational technology protection matters.

Assess the IT-to-OT crossing with the OT operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.

Unnecessary exposureThe IT to OT conduits can remain available beyond the approved need.
Service impactLoss of supervisory or support access needs operational approval. This Plan is not a safety system.
Unclear authorityName the OT operations owner and the conditions for a connection change.
Unverified closureCheck the observed state of the IT to OT conduits, including parallel routes.

The problem today

Where you are IP connected today.

CP-15 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed
8Risks to agree with owners
6Control modules applied
  1. Risk 1IT-to-OT conduit

    Corporate or engineering access to the assessed OT access zone.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  2. Risk 2Supplier support route

    Support gateway to engineering access.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  3. Risk 3Engineering management

    Engineering services to managed OT assets.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  4. Risk 4Process interface

    OT access zone to the local controller environment.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  5. Risk 5Approved exchange

    Assessed data exchange service to engineering services.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  6. Risk 6Parallel conduit

    Redundant fibre, copper or wireless gateway route.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  7. Risk 7Alternate support path

    Independent vendor or cellular gateway uplink.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: To assess

  8. Risk 8External gateway

    Assessed OT external communications link.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

What Firevault changes

What changes with this Plan.

Keep local process control within the defined physical boundary.

Connection Agreed normal state Control action
IT-to-OT conduit Connected Isolate operates the grouped conduits.
Supplier support route Disconnected by default Relay opens a time-bound window; Validate checks the approval.
Engineering management Disconnected by default Relay governs the approved window; Fracture withdraws the connection.
Process interface Connected Fracture withdraws the authorised connection.
Approved exchange Disconnected by default Transfer governs what moves; Relay limits the window.
Parallel conduit Connected Isolate groups every conduit.
Alternate support path To assess Unlink removes persistent dependencies that bypass the control.
External gateway Connected Fracture withdraws the selected connection.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Control in Action

Operational Technology Protection: see the selected path change.

Keep local process control within the defined physical boundary.

Control in Action

Stage

Before agreed physical control

Assess the IT-to-OT crossing with the OT operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • IT-to-OT conduitAlways connected
  • Supplier support routeAlways connected
  • Engineering managementAlways connected
  • Process interfaceAlways connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-15: group C1 and C6, and any other assessed bypass. In CP-15: define the controller environment and its permitted physical connections. In CP-15: apply only the operationally approved boundary action.

CP-15Operational Technology Protection

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Keep local process control within the defined physical boundary.

Primary modules: Fracture, Isolate, Relay, Execute, Validate and Anchor.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Keep local process control within the defined physical boundary.

IT-to-OT conduitCorporate or engineering access to the assessed OT access zone.Connected
Normal state
Connected
Authorisation
Tier 2Operations and incident owner approval
Module action
Isolate operates the grouped conduits.
Business effect
Remote access to OT is lost; local control is assessed separately.
Failure behaviour
Assessed and tested with operations
Supplier support routeSupport gateway to engineering access.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Approved support window
Module action
Relay opens a time-bound window; Validate checks the approval.
Business effect
Supplier support is unavailable outside the window.
Failure behaviour
Assessed and tested with operations
Engineering managementEngineering services to managed OT assets.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Named maintenance request
Module action
Relay governs the approved window; Fracture withdraws the connection.
Business effect
Engineering changes cannot cross this route while disconnected.
Failure behaviour
Assessed and tested with operations
Process interfaceOT access zone to the local controller environment.Connected
Normal state
Connected
Authorisation
Tier 2Operational and safety review
Module action
Fracture withdraws the authorised connection.
Business effect
Supervisory visibility may be lost; do not assume autonomous operation.
Failure behaviour
Assessed and tested with operations
Approved exchangeAssessed data exchange service to engineering services.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Approved transfer purpose
Module action
Transfer governs what moves; Relay limits the window.
Business effect
Transfers pause without changing the stored data.
Failure behaviour
Assessed and tested with operations
Parallel conduitRedundant fibre, copper or wireless gateway route.Connected
Normal state
Connected
Authorisation
Tier 2Same approval as C1
Module action
Isolate groups every conduit.
Business effect
Redundancy is withdrawn with the primary path.
Failure behaviour
Assessed and tested with operations
Alternate support pathIndependent vendor or cellular gateway uplink.To assess
Normal state
To assess
Authorisation
Tier 2Boundary review
Module action
Unlink removes persistent dependencies that bypass the control.
Business effect
Out-of-band vendor access needs separate assessment.
Failure behaviour
Assessed and tested with operations
External gatewayAssessed OT external communications link.Connected
Normal state
Connected
Authorisation
Tier 2Joint operational decision
Module action
Fracture withdraws the selected connection.
Business effect
External telemetry and support may be unavailable.
Failure behaviour
Assessed and tested with operations

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Keep local process control within the defined physical boundary. Each selected connection sits at its agreed normal state.Anchor

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Isolate operates the grouped conduits.RelayValidate

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Keep local process control within the defined physical boundary.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Assess the IT-to-OT crossing with the OT operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.

The operational owner authorises each reconnection.

Each check and each reconnection.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Engineering and integration

Fit the control around your existing environment.

The assessed IT-to-OT crossing, support, management and alternate conduits.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Assess the IT-to-OT crossing with the OT operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

What this addressesKeep local process control within the defined physical boundary.
What it does not replaceDetection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Which routes cross the IT-to-OT crossing? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval.

Questions worth asking

Before you rely on CP-15.

Practical questions for the people who own these connections.

Keep local process control within the defined physical boundary.

The assessed IT-to-OT crossing, support, management and alternate conduits.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Which routes cross the IT-to-OT crossing? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval.

Your next step

Take the next step with operational technology protection.

Which routes cross the IT-to-OT crossing? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval.

Book a briefing

Prefer to talk first? Speak to the team