--- title: "CP-15 Operational Technology Protection | Control by Fireva…" url: https://fire-vault.com/control-plan/operational-technology-protection description: "Industrial controllers behind a physical network boundary." lang: en-GB --- Control Plan **CP-15**Operational Technology Protection Proposed Control Plan. Subject to technical and publication approval. # Your process depends on OT. Which connections could put it at risk? Image: CP-15 Operational Technology Protection Control Plan icon (https://fire-vault.com/__l5e/assets-v1/15b8a2eb-b5a0-41e9-aac9-093ff362430d/CP-15_operational-technology-protection.png) Industrial controllers behind a physical network boundary. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-15 Purpose Operational Technology Protection Selected connections 8 Modules Fracture · Isolate · Relay · Execute · Validate · Anchor Scope The assessed IT-to-OT crossing, support, management and alternate conduits. What is at stake ## Why operational technology protection matters. Assess the IT-to-OT crossing with the OT operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed. **Unnecessary exposure**The IT to OT conduits can remain available beyond the approved need. **Service impact**Loss of supervisory or support access needs operational approval. This Plan is not a safety system. **Unclear authority**Name the OT operations owner and the conditions for a connection change. **Unverified closure**Check the observed state of the IT to OT conduits, including parallel routes. The problem today ## Where you are IP connected today. CP-15 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **8**IP-connected paths reviewed **8**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**IT-to-OT conduit** Corporate or engineering access to the assessed OT access zone. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 2. _Risk 2_**Supplier support route** Support gateway to engineering access. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 3. _Risk 3_**Engineering management** Engineering services to managed OT assets. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 4. _Risk 4_**Process interface** OT access zone to the local controller environment. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 5. _Risk 5_**Approved exchange** Assessed data exchange service to engineering services. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 6. _Risk 6_**Parallel conduit** Redundant fibre, copper or wireless gateway route. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected 7. _Risk 7_**Alternate support path** Independent vendor or cellular gateway uplink. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** To assess 8. _Risk 8_**External gateway** Assessed OT external communications link. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected Matching industry Blueprints BP-01 · utilities water (https://fire-vault.com/control-blueprint/utilities-water)BP-14 · critical infrastructure (https://fire-vault.com/control-blueprint/critical-infrastructure)BP-20 · utilities renewables (https://fire-vault.com/control-blueprint/utilities-renewables) What Firevault changes ## What changes with this Plan. Keep local process control within the defined physical boundary. | Connection | Agreed normal state | Control action | | --- | --- | --- | | IT-to-OT conduit | Connected | Isolate operates the grouped conduits. | | Supplier support route | Disconnected by default | Relay opens a time-bound window; Validate checks the approval. | | Engineering management | Disconnected by default | Relay governs the approved window; Fracture withdraws the connection. | | Process interface | Connected | Fracture withdraws the authorised connection. | | Approved exchange | Disconnected by default | Transfer governs what moves; Relay limits the window. | | Parallel conduit | Connected | Isolate groups every conduit. | | Alternate support path | To assess | Unlink removes persistent dependencies that bypass the control. | | External gateway | Connected | Fracture withdraws the selected connection. | Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately. Control in Action ## Operational Technology Protection: see the selected path change. Control in Action Stage Before agreed physical control Assess the IT-to-OT crossing with the OT operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - IT-to-OT conduit _Always connected_ - Supplier support route _Always connected_ - Engineering management _Always connected_ - Process interface _Always connected_ - Recovery access (OSS) _Not in place_ 1. _FB_**Fracture** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-15: group C1 and C6, and any other assessed bypass. In CP-15: define the controller environment and its permitted physical connections. In CP-15: apply only the operationally approved boundary action. ### CP-15Operational Technology Protection Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Keep local process control within the defined physical boundary. Primary modules: Fracture, Isolate, Relay, Execute, Validate and Anchor. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-15 **CP-14 · Proposed****Compromised Device Isolation**Physically isolate one affected device from the network. _Open CP-14_: https://fire-vault.com/control-plan/compromised-device-isolation **CP-16 · Proposed****Remote Site Isolation**Disconnect the communications link to a remote facility. _Open CP-16_: https://fire-vault.com/control-plan/remote-site-isolation **CP-13 · Proposed****Maintenance Window Control**Connections that exist only for a scheduled maintenance window. _Open CP-13_: https://fire-vault.com/control-plan/maintenance-window-control See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. IT-to-OT conduitCorporate or engineering access to the assessed OT access zone._Connected_ Normal state Connected Authorisation Tier 2Operations and incident owner approval Module action Isolate operates the grouped conduits. Business effect Remote access to OT is lost; local control is assessed separately. Failure behaviour Assessed and tested with operations Supplier support routeSupport gateway to engineering access._Disconnected by default_ Normal state Disconnected by default Authorisation Tier 2Approved support window Module action Relay opens a time-bound window; Validate checks the approval. Business effect Supplier support is unavailable outside the window. Failure behaviour Assessed and tested with operations Engineering managementEngineering services to managed OT assets._Disconnected by default_ Normal state Disconnected by default Authorisation Tier 2Named maintenance request Module action Relay governs the approved window; Fracture withdraws the connection. Business effect Engineering changes cannot cross this route while disconnected. Failure behaviour Assessed and tested with operations Process interfaceOT access zone to the local controller environment._Connected_ Normal state Connected Authorisation Tier 2Operational and safety review Module action Fracture withdraws the authorised connection. Business effect Supervisory visibility may be lost; do not assume autonomous operation. Failure behaviour Assessed and tested with operations Approved exchangeAssessed data exchange service to engineering services._Disconnected by default_ Normal state Disconnected by default Authorisation Tier 2Approved transfer purpose Module action Transfer governs what moves; Relay limits the window. Business effect Transfers pause without changing the stored data. Failure behaviour Assessed and tested with operations Parallel conduitRedundant fibre, copper or wireless gateway route._Connected_ Normal state Connected Authorisation Tier 2Same approval as C1 Module action Isolate groups every conduit. Business effect Redundancy is withdrawn with the primary path. Failure behaviour Assessed and tested with operations Alternate support pathIndependent vendor or cellular gateway uplink._To assess_ Normal state To assess Authorisation Tier 2Boundary review Module action Unlink removes persistent dependencies that bypass the control. Business effect Out-of-band vendor access needs separate assessment. Failure behaviour Assessed and tested with operations External gatewayAssessed OT external communications link._Connected_ Normal state Connected Authorisation Tier 2Joint operational decision Module action Fracture withdraws the selected connection. Business effect External telemetry and support may be unavailable. Failure behaviour Assessed and tested with operations Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Keep local process control within the defined physical boundary. Each selected connection sits at its agreed normal state.Anchor Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Isolate operates the grouped conduits.Relay Validate The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Keep local process control within the defined physical boundary.Fracture Isolate Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Keep local process control within the defined physical boundary. **What it does not replace**Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Which routes cross the IT-to-OT crossing? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval. Questions worth asking ## Before you rely on CP-15. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with operational technology protection. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/operational-technology-protection#webpage", "url": "https://fire-vault.com/control-plan/operational-technology-protection", "name": "CP-15 Operational Technology Protection", "description": "Industrial controllers behind a physical network boundary.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/operational-technology-protection#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/operational-technology-protection#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-15 Operational Technology Protection", "item": "https://fire-vault.com/control-plan/operational-technology-protection" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-15 Operational Technology Protection", "description": "Industrial controllers behind a physical network boundary.", "url": "https://fire-vault.com/control-plan/operational-technology-protection" } ] ```