Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-12Privileged Access Control

Proposed Control Plan. Subject to technical and publication approval.

Administrator access through a controlled network entry point.

CP-12 Privileged Access Control Control Plan icon

Administrator access through a controlled network entry point.

Plan
CP-12
Purpose
Privileged Access Control
Selected connections
8
Modules
Fracture · Relay · Execute · Validate · Anchor · Lock
Scope
Privileged workstations, the controlled entry point and selected management interfaces.

What is at stake

Why privileged access control matters.

Identity approval and physical management reach are different controls.

Service dependencyA management interruption can delay maintenance even when production traffic remains available.
Unintended reachAn approved identity can still reach management interfaces outside its current task.
Suspended workA withdrawn administration path can leave changes incomplete, requiring a safe handover.
AccountabilityNamed owners need to connect each physical window to its task, role and target assets.

The problem today

Where you are IP connected today.

CP-12 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed
8Risks to agree with owners
6Control modules applied
  1. Risk 1Administration entry

    Privileged workstation network to the controlled management entry point.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  2. Risk 2Remote administrator entry

    Remote privileged access gateway to the controlled entry point.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  3. Risk 3Infrastructure management path

    Controlled entry point to server and hypervisor management interfaces.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  4. Risk 4Managed system crossing

    Controlled entry point to the approved managed-system interfaces.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: State subject to dependency review

  5. Risk 5Storage management path

    Controlled entry point to storage administration interfaces.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  6. Risk 6Secondary administration route

    Alternative administration circuit, including site and failover routes.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  7. Risk 7Operational administration conduit

    Controlled entry point to operational management interfaces, where present.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  8. Risk 8Shared management backbone

    Management connectivity serving multiple critical asset groups.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: State subject to dependency review

Matching industry Blueprints

BP-10 · colocationsBP-15 · education

What Firevault changes

What changes with this Plan.

Provide administrator access through a controlled network entry point, with task-specific management reach.

Connection Agreed normal state Control action
Administration entry Disconnected by default Validate checks authority. Relay limits the window. Lock retains identity, role and policy controls.
Remote administrator entry Disconnected by default Fracture withdraws the selected authorised connection; Execute applies the approved action.
Infrastructure management path Disconnected by default Fracture withdraws the selected authorised connection; Execute applies the approved action.
Managed system crossing State subject to dependency review Fracture withdraws the selected authorised connection; Execute applies the approved action.
Storage management path Disconnected by default Fracture withdraws the selected authorised connection; Execute applies the approved action.
Secondary administration route Disconnected by default Fracture withdraws the selected authorised connection; Execute applies the approved action.
Operational administration conduit Disconnected by default Fracture withdraws the selected authorised connection; Execute applies the approved action.
Shared management backbone State subject to dependency review Fracture withdraws the selected authorised connection; Execute applies the approved action.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Control in Action

Privileged Access Control: see the selected path change.

Provide administrator access through a controlled network entry point, with task-specific management reach.

Control in Action

Stage

Before agreed physical control

Identity approval and physical management reach are different controls.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Administration entryAlways connected
  • Remote administrator entryAlways connected
  • Infrastructure management pathAlways connected
  • Managed system crossingAlways connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-12: Check the supplier, purpose and approving owner. In CP-12: Constrain the asset to the authorised administrator role. In CP-12: Limit connectivity to the approved engagement.

CP-12Privileged Access Control

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Provide administrator access through a controlled network entry point, with task-specific management reach.

Primary modules: Fracture, Relay, Execute, Validate, Anchor and Lock.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Provide administrator access through a controlled network entry point, with task-specific management reach.

Administration entryPrivileged workstation network to the controlled management entry point.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 1Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Validate checks authority. Relay limits the window. Lock retains identity, role and policy controls.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Remote administrator entryRemote privileged access gateway to the controlled entry point.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Infrastructure management pathControlled entry point to server and hypervisor management interfaces.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 1Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Managed system crossingControlled entry point to the approved managed-system interfaces.State subject to dependency review
Normal state
State subject to dependency review
Authorisation
Tier 2Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Agree with service and operations owners; no assumed failure state.
Storage management pathControlled entry point to storage administration interfaces.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 1Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Secondary administration routeAlternative administration circuit, including site and failover routes.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Operational administration conduitControlled entry point to operational management interfaces, where present.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 3Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Agree with service and operations owners; no assumed failure state.
Shared management backboneManagement connectivity serving multiple critical asset groups.State subject to dependency review
Normal state
State subject to dependency review
Authorisation
Tier 3Approved window ends or the authorised owner suspends access; opening requires a validated request.
Module action
Fracture withdraws the selected authorised connection; Execute applies the approved action.
Business effect
Administration through this crossing pauses. Production independence must be demonstrated.
Failure behaviour
Agree with service and operations owners; no assumed failure state.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Provide administrator access through a controlled network entry point, with task-specific management reach. Each selected connection sits at its agreed normal state.Anchor

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks authority. Relay limits the window. Lock retains identity, role and policy controls.RelayValidateLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Provide administrator access through a controlled network entry point, with task-specific management reach.Fracture

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Reconnection is an authorised recovery decision. It is not proof that the estate is clean, so it follows a defined check.

The operational owner authorises each reconnection.

Each check and each reconnection.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Engineering and integration

Fit the control around your existing environment.

Privileged workstations, the controlled entry point and selected management interfaces.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Reconnection is an authorised recovery decision. It is not proof that the estate is clean, so it follows a defined check.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

What this addressesProvide administrator access through a controlled network entry point, with task-specific management reach.
What it does not replaceThreat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Start your own link register. Mark how each connection in your estate should behave during an incident. Your shortlist is the starting point for a discovery session with our team. The selections below are examples, so change them to match your organisation.

Questions worth asking

Before you rely on CP-12.

Practical questions for the people who own these connections.

Provide administrator access through a controlled network entry point, with task-specific management reach.

Privileged workstations, the controlled entry point and selected management interfaces.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Start your own link register. Mark how each connection in your estate should behave during an incident. Your shortlist is the starting point for a discovery session with our team. The selections below are examples, so change them to match your organisation.

Your next step

Take the next step with privileged access control.

Start your own link register. Mark how each connection in your estate should behave during an incident. Your shortlist is the starting point for a discovery session with our team. The selections below are examples, so change them to match your organisation.

Book a briefing

Prefer to talk first? Speak to the team