--- title: "CP-12 Privileged Access Control | Control by Firevault" url: https://fire-vault.com/control-plan/privileged-access-control description: "Administrator access through a controlled network entry point." lang: en-GB --- Control Plan **CP-12**Privileged Access Control Proposed Control Plan. Subject to technical and publication approval. # Administrator access through a controlled network entry point. Image: CP-12 Privileged Access Control Control Plan icon (https://fire-vault.com/__l5e/assets-v1/a3ff75de-a878-4eaa-bc4a-c4470c1c600b/CP-12_privileged-access-control.png) Administrator access through a controlled network entry point. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-12 Purpose Privileged Access Control Selected connections 8 Modules Fracture · Relay · Execute · Validate · Anchor · Lock Scope Privileged workstations, the controlled entry point and selected management interfaces. What is at stake ## Why privileged access control matters. Identity approval and physical management reach are different controls. **Service dependency**A management interruption can delay maintenance even when production traffic remains available. **Unintended reach**An approved identity can still reach management interfaces outside its current task. **Suspended work**A withdrawn administration path can leave changes incomplete, requiring a safe handover. **Accountability**Named owners need to connect each physical window to its task, role and target assets. The problem today ## Where you are IP connected today. CP-12 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **8**IP-connected paths reviewed **8**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**Administration entry** Privileged workstation network to the controlled management entry point. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 2. _Risk 2_**Remote administrator entry** Remote privileged access gateway to the controlled entry point. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 3. _Risk 3_**Infrastructure management path** Controlled entry point to server and hypervisor management interfaces. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 4. _Risk 4_**Managed system crossing** Controlled entry point to the approved managed-system interfaces. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** State subject to dependency review 5. _Risk 5_**Storage management path** Controlled entry point to storage administration interfaces. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 6. _Risk 6_**Secondary administration route** Alternative administration circuit, including site and failover routes. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 7. _Risk 7_**Operational administration conduit** Controlled entry point to operational management interfaces, where present. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected by default 8. _Risk 8_**Shared management backbone** Management connectivity serving multiple critical asset groups. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** State subject to dependency review Matching industry Blueprints BP-10 · colocations (https://fire-vault.com/control-blueprint/colocations)BP-15 · education (https://fire-vault.com/control-blueprint/education) What Firevault changes ## What changes with this Plan. Provide administrator access through a controlled network entry point, with task-specific management reach. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Administration entry | Disconnected by default | Validate checks authority. Relay limits the window. Lock retains identity, role and policy controls. | | Remote administrator entry | Disconnected by default | Fracture withdraws the selected authorised connection; Execute applies the approved action. | | Infrastructure management path | Disconnected by default | Fracture withdraws the selected authorised connection; Execute applies the approved action. | | Managed system crossing | State subject to dependency review | Fracture withdraws the selected authorised connection; Execute applies the approved action. | | Storage management path | Disconnected by default | Fracture withdraws the selected authorised connection; Execute applies the approved action. | | Secondary administration route | Disconnected by default | Fracture withdraws the selected authorised connection; Execute applies the approved action. | | Operational administration conduit | Disconnected by default | Fracture withdraws the selected authorised connection; Execute applies the approved action. | | Shared management backbone | State subject to dependency review | Fracture withdraws the selected authorised connection; Execute applies the approved action. | Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity. Control in Action ## Privileged Access Control: see the selected path change. Control in Action Stage Before agreed physical control Identity approval and physical management reach are different controls.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Administration entry _Always connected_ - Remote administrator entry _Always connected_ - Infrastructure management path _Always connected_ - Managed system crossing _Always connected_ - Recovery access (OSS) _Not in place_ 1. _FB_**Fracture** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. In CP-12: Check the supplier, purpose and approving owner. In CP-12: Constrain the asset to the authorised administrator role. In CP-12: Limit connectivity to the approved engagement. ### CP-12Privileged Access Control Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Provide administrator access through a controlled network entry point, with task-specific management reach. Primary modules: Fracture, Relay, Execute, Validate, Anchor and Lock. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-12 **CP-11 · Proposed****Supply Chain Isolation**Keep supplier networks separate from your own environment. _Open CP-11_: https://fire-vault.com/control-plan/supply-chain-isolation **CP-13 · Proposed****Maintenance Window Control**Connections that exist only for a scheduled maintenance window. _Open CP-13_: https://fire-vault.com/control-plan/maintenance-window-control **CP-10****Executive Override**Authorised senior intervention that withdraws predefined connections. _Open CP-10_: https://fire-vault.com/control-plan/executive-override See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Administration entryPrivileged workstation network to the controlled management entry point._Disconnected by default_ Normal state Disconnected by default Authorisation Tier 1Approved window ends or the authorised owner suspends access; opening requires a validated request. Module action Validate checks authority. Relay limits the window. Lock retains identity, role and policy controls. Business effect Administration through this crossing pauses. Production independence must be demonstrated. Failure behaviour Designed to fail disconnected; confirm safe behaviour and test power loss and faults. Remote administrator entryRemote privileged access gateway to the controlled entry point._Disconnected by default_ Normal state Disconnected by default Authorisation Tier 2Approved window ends or the authorised owner suspends access; opening requires a validated request. Module action Fracture withdraws the selected authorised connection; Execute applies the approved action. Business effect Failure behaviour Infrastructure management pathControlled entry point to server and hypervisor management interfaces._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Managed system crossingControlled entry point to the approved managed-system interfaces._State subject to dependency review_ Normal state State subject to dependency review Authorisation Module action Business effect Failure behaviour Agree with service and operations owners; no assumed failure state. Storage management pathControlled entry point to storage administration interfaces._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Secondary administration routeAlternative administration circuit, including site and failover routes._Disconnected by default_ Normal state Disconnected by default Authorisation Module action Business effect Failure behaviour Operational administration conduitControlled entry point to operational management interfaces, where present._Disconnected by default_ Normal state Disconnected by default Authorisation Tier 3Approved window ends or the authorised owner suspends access; opening requires a validated request. Module action Business effect Failure behaviour Shared management backboneManagement connectivity serving multiple critical asset groups._State subject to dependency review_ Normal state State subject to dependency review Authorisation Module action Business effect Failure behaviour Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Provide administrator access through a controlled network entry point, with task-specific management reach. Each selected connection sits at its agreed normal state.Anchor Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Validate checks authority. Relay limits the window. Lock retains identity, role and policy controls.Relay Validate Lock The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Provide administrator access through a controlled network entry point, with task-specific management reach.Fracture Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Reconnection is an authorised recovery decision. It is not proof that the estate is clean, so it follows a defined check. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Provide administrator access through a controlled network entry point, with task-specific management reach. **What it does not replace**Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Start your own link register. Mark how each connection in your estate should behave during an incident. Your shortlist is the starting point for a discovery session with our team. The selections below are examples, so change them to match your organisation. Questions worth asking ## Before you rely on CP-12. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with privileged access control. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/privileged-access-control#webpage", "url": "https://fire-vault.com/control-plan/privileged-access-control", "name": "CP-12 Privileged Access Control", "description": "Administrator access through a controlled network entry point.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/privileged-access-control#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/privileged-access-control#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-12 Privileged Access Control", "item": "https://fire-vault.com/control-plan/privileged-access-control" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-12 Privileged Access Control", "description": "Administrator access through a controlled network entry point.", "url": "https://fire-vault.com/control-plan/privileged-access-control" } ] ```