Control PlanCP-05Critical Asset Protection

Protect essential systems without treating the process like office IT.

CP-05 Critical Asset Protection Control Plan icon

CP-05 keeps selected routes into essential systems within planned physical boundaries, while enterprise access, maintenance and transfers remain deliberate and approved.

Book a briefing See Control in Action

Plan: CP-05
Purpose: Critical Asset Protection
Selected connections: 4
Modules: Anchor · Validate · Relay · Transfer · Execute · Fracture
Scope: Selected enterprise, maintenance and exchange routes into an essential environment.

What is at stake

Why critical asset protection matters.

Essential systems often depend on legacy equipment, remote sites and specialist support. Sudden disconnection can create its own operational risk, so boundaries must be designed with operations.

Enterprise compromise reaches essential systemsA standing link from business networks can expose systems that keep a service running.

Maintenance access remains openEngineering and supplier routes can remain available outside approved work.

Legacy systems cannot be patchedSome equipment must keep operating with limited protection of its own.

Unsafe responseAn unplanned disconnection can affect operations if local control and safety dependencies are not understood.

The problem today

Where you are IP connected today.

CP-05 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

4IP-connected paths reviewed

4Risks to agree with owners

6Control modules applied

Risk 1Enterprise to essential systems
The selected link between business networks and the essential environment.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Connected only where required for service
Risk 2Maintenance route
The route used by engineers or suppliers for approved maintenance.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected outside approved windows
Risk 3Approved data exchange
The path used to move reports, configurations or updates across the boundary.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Disconnected outside approved exchanges
Risk 4Local control and safety functions
The process functions needed to keep the service safe.

Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

Agreed state: Not assumed disconnectable

Matching industry Blueprints

BP-01 · utilities water BP-02 · energy BP-03 · oil and gas BP-04 · rail BP-14 · critical infrastructure BP-19 · utilities gas

What Firevault changes

What changes with this Plan.

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.

Connection	Agreed normal state	Control action
Enterprise to essential systems	Connected only where required for service	Validate checks both approvals. Execute initiates the action. Fracture withdraws the link.
Maintenance route	Disconnected outside approved windows	Validate checks the request. Relay opens the route. Fracture withdraws it afterwards.
Approved data exchange	Disconnected outside approved exchanges	Validate checks the request. Transfer makes the exchange path available. Fracture withdraws it afterwards.
Local control and safety functions	Not assumed disconnectable	No automatic Control action is assumed.

CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control.

Control in Action

Critical Asset Protection: see the selected path change.

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.

Control in Action

Stage

Before agreed physical control

Essential systems often depend on legacy equipment, remote sites and specialist support. Sudden disconnection can create its own operational risk, so boundaries must be designed with operations.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack

10still running

Physical crossings

Enterprise to essential systemsAlways connected
Maintenance routeAlways connected
Approved data exchangeAlways connected
Local control and safety functionsConnected · ready to cut
Recovery access (OSS)Not in place

ARAnchor · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

Keeps critical assets within defined physical connection boundaries. Checks authority and purpose before a maintenance, transfer or response action. Opens a selected route for approved maintenance and closes it afterwards. Makes an approved exchange path available between separate environments. Initiates the approved action on the designated connection. Physically withdraws the selected route.

CP-05Critical Asset Protection

Z0Requesting environment

Z1Protected systems

Z2Related operations

Held in Offline Secure Storage®Selected recovery material, held separately

Out-of-band command path

This Control Plan

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.

Primary modules: Fracture, Relay, Execute, Validate, Anchor and Transfer.

Read the operational detail

Module in this plan

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-05

CP-04Physical Network SegmentationZones separated at Layer 1, so a boundary holds even when software controls are compromised.Open CP-04

CP-06Controlled Access & AssuranceConnect approvals and observed control states to agreed record sources, with collection and retention defined for the actions in scope.Open CP-06

CP-03Third-Party Access ControlSupplier and vendor paths that exist only for approved work, in a defined window.Open CP-03

See all Control Plans How Control works

As featured in

The Control Plan specification

Each selected connection, written down.

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.

Enterprise to essential systemsThe selected link between business networks and the essential environment.Connected only where required for service

Normal state: Connected only where required for service
Authorisation: Incident owner and operations owner approval
Module action: Validate checks both approvals. Execute initiates the action. Fracture withdraws the link.
Business effect: Business access pauses. Local operation must be confirmed before approval.
Failure behaviour: Behaviour agreed with operations and tested.

Maintenance routeThe route used by engineers or suppliers for approved maintenance.Disconnected outside approved windows

Normal state: Disconnected outside approved windows
Authorisation: Approved work order and operational readiness
Module action: Validate checks the request. Relay opens the route. Fracture withdraws it afterwards.
Business effect: Maintenance access is available only for the approved work.
Failure behaviour: Remains disconnected unless an approved recovery procedure is followed.

Approved data exchangeThe path used to move reports, configurations or updates across the boundary.Disconnected outside approved exchanges

Normal state: Disconnected outside approved exchanges
Authorisation: Approved exchange request
Module action: Validate checks the request. Transfer makes the exchange path available. Fracture withdraws it afterwards.
Business effect: Exchange runs only through the approved path and window.
Failure behaviour: Remains disconnected unless an approved recovery procedure is followed.

Local control and safety functionsThe process functions needed to keep the service safe.Not assumed disconnectable

Normal state: Not assumed disconnectable
Authorisation: Outside automatic action
Module action: No automatic Control action is assumed.
Business effect: Operational and safety dependencies remain with the system owner.
Failure behaviour: Assess separately with operations and safety owners.

CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record

1Normal operationAgreed states held

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes. Each selected connection sits at its agreed normal state.AnchorTransfer

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks both approvals. Execute initiates the action. Fracture withdraws the link.ValidateRelay

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.Fracture

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Before reconnection, operations confirm the service state and the security owner confirms the agreed checks.

The operational owner authorises each reconnection.

Each check and each reconnection.

CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control.

Engineering and integration

Fit the control around your existing environment.

Selected enterprise, maintenance and exchange routes into an essential environment.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.

Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.

Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.

Controlled changeVerify approved opening, closure and the operational impact.

Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Before reconnection, operations confirm the service state and the security owner confirms the agreed checks.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control.

What this addressesKeep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.

What it does not replaceCP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control.

Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Start with one maintenance route and confirm the local operation and safety dependencies around it.

Questions worth asking

Before you rely on CP-05.

Practical questions for the people who own these connections.

Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.

Selected enterprise, maintenance and exchange routes into an essential environment.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control.

Start with one maintenance route and confirm the local operation and safety dependencies around it.

Your next step

Take the next step with critical asset protection.

Start with one maintenance route and confirm the local operation and safety dependencies around it.

Book a briefing

Prefer to talk first? Speak to the team

Book a briefing Speak to the team